8.4 Release Notes

Anaconda replaces the original boot device NVRAM variable list with new values

Previously, booting from NVRAM could lead to boot system failure due to the entries with the incorrect values in the boot device list.

Graphical installation of KVM virtual machines on IBM Z is now available

When using the KVM hypervisor on IBM Z hardware, you can now use the graphical installation when creating virtual machines (VMs).

Warnings for deprecated kernel boot arguments

Anaconda boot arguments without the inst. prefix (for example, ks, stage2, repo and so on) are deprecated starting RHEL7. These arguments will be removed in the next major RHEL release.

Support to specify the kernel name as customization for RHEL for Edge image types

When creating OSTree commits for RHEL for Edge images, only one kernel package can be installed at a time, otherwise the commit creation fails in rpm-ostree. This prevents RHEL for Edge from adding alternative kernels, in particular, the real-time kernel (kernel-rt). With this enhancement, when creating a blueprint for RHEL for Edge image using the CLI, you can define the name of the kernel to be used in an image, by setting the customizations.kernel.name key. If you do not specify any kernel name, the image include the default kernel package.

New fill_sack_from_repos_in_cache function is now supported in DNF API

With this update, the new DNF API fill_sack_from_repos_in_cache function has been introduced which allows to load repositories only from the cached solv, solvx files, and the repomd.xml file. As a result, if the user manages dnf cache, it is possible to save resources without having duplicate information (xml and solv), and without processing xml into solv.

createrepo_c now automatically adds modular metadata to repositories

Previously, running the createrepo_c command on RHEL8 packages to create a new repository did not include modular repodata in this repository. Consequently, it caused various problems with repositories. With this update, createrepo_c:

The ability to mirror a transaction between systems within DNF is now supported

With this update, the user can store and replay a transaction within DNF.

createrepo_c rebased to version 0.16.2

The createrepo_c packages have been rebased to version 0.16.2 which provides the following notable changes over the previous version:

The protect_running_kernel configuration option is now available.

With this update, the protect_running_kernel configuration option for the dnf and microdnf commands has been introduced. This option controls whether the package corresponding to the running version of the kernel is protected from removal. As a result, the user can now disable protection of the running kernel.

OpenIPMI rebased to version 2.0.29

The OpenIPMI packages have been upgraded to version 2.0.29. Notable changes over the previous version include:

freeipmi rebased to version 1.6.6

The freeipmi packages have been upgraded to version 1.6.6. Notable changes over the previous version include:

opal-prd rebased to version 6.6.3

The opal-prd package has been rebased to version 6.6.3. Notable changes include:

opencryptoki rebased to version 3.15.1

The opencryptoki packages have been rebased to version 3.15.1. Notable changes include:

powerpc-utils rebased to version 1.3.8

The powerpc-utils packages have been rebased to version 1.3.8. Notable changes include:

New kernel cmdline option now generates network device name

The net_id built-in from systemd-udevd service gains a new kernel cmdline option net.naming-scheme=SCHEME_VERSION. Based on the value of the SCHEME_VERSION, a user can select a version of the algorithm that will generate the network device name.

Difference in default postfix-3.5.8 behavior

For better RHEL-8 backward compatibility, the behavior of the postfix-3.5.8 update differs from the default upstream postfix-3.5.8 behavior. For the default upstream postfix-3.5.8 behavior, run the following commands:

BIND rebased to version 9.11.26

The bind packages have been updated to version 9.11.26. Notable changes include:

unbound configuration now provides enhanced logging output

With this enhancement, the following three options have been added to the unbound configuration:

Tuned rebased to version 2.15-1.

Notable changes include:

DNSTAP now records incoming detailed queries.

DNSTAP provides an advanced way to monitor and log details of incoming name queries. It also records sent answers from the named service. Classic query logging of the named service has a negative impact on the performance of the named service.

SpamAssassin rebased to version 3.4.4

The SpamAssassin package has been upgraded to version 3.4.4. Notable changes include:

Key algorithm can be changed using the OMAPI shell

With this enhancement, users can now change the key algorithm. The key algorithm that was hardcoded as HMAC-MD5 is not considered secure anymore. As a result, users can use the omshell command to change the key algorithm.

Sendmail now supports TLSFallbacktoClear configuration

With this enhancement, if the outgoing TLS connection fails, the sendmail client will fall back to the plaintext. This overcomes the TLS compatibility problems with the other parties. Red Hat ships sendmail with the TLSFallbacktoClear option disabled by default.

tcpdump now allows viewing RDMA capable devices

This enhancement enables support for capturing RDMA traffic with tcpdump. It allows users to capture and analyze offloaded RDMA traffic with the tcpdump tool. As a result, users can use tcpdump to view RDMA capable devices, capture RoCE and VMA traffic, and analyze its content.

libreswan rebased to 4.3

The libreswan packages have been upgraded to version 4.3. Notable changes over the previous version include:

IPsec VPN now supports TCP transport

This update of the libreswan packages adds support for IPsec-based VPNs over TCP encapsulation as described in RFC 8229. The addition helps establish IPsec VPNs on networks that prevent traffic using Encapsulating Security Payload (ESP) and UDP. As a result, administrators can configure VPN servers and clients to use TCP either as a fallback or as the main VPN transport protocol.

Libreswan now supports IKEv2 for Labeled IPsec

The Libreswan Internet Key Exchange (IKE) implementation now includes Internet Key Exchange version 2 (IKEv2) support of Security Labels for IPsec. With this update, systems that use security labels with IKEv1 can be upgraded to IKEv2.

libpwquality rebased to 1.4.4

The libpwquality package has been rebased to version 1.4.4. This release includes multiple bug fixes and translation updates. Most notably, the following setting options have been added to the pwquality.conf file:

p11-kit rebased to 0.23.19

The p11-kit packages have been upgraded from version 0.23.14 to version 0.23.19. The new version fixes several bugs and provides various enhancements, notably:

pyOpenSSL rebased to 19.0.0

The pyOpenSSL packages have been rebased to upstream version 19.0.0. This version provides bug fixes and enhancements, most notably:

SCAP Security Guide rebased to 0.1.54

The scap-security-guide packages have been rebased to upstream version 0.1.54, which provides several bug fixes and improvements. Most notably:

OpenSCAP rebased to 1.3.4

The OpenSCAP packages have been rebased to upstream version 1.3.4. Notable fixes and enhancements include:

The RHEL 8 STIG security profile updated to version V1R1

With the release of the RHBA-2021:1886 advisory, the DISA STIG for Red Hat Enterprise Linux 8 profile in the SCAP Security Guide has been updated to align with the latest version V1R1. The profile is now also more stable and better aligns with the RHEL 8 STIG (Security Technical Implementation Guide) manual benchmark provided by the Defense Information Systems Agency (DISA). This first iteration brings approximately 60% of coverage with regards to the STIG.

New DISA STIG profile compatible with Server with GUI installations

A new profile, DISA STIG with GUI, has been added to the SCAP Security Guide with the release of the RHBA-2021:4098 advisory. This profile is derived from the DISA STIG profile and is compatible with RHEL installations that selected the Server with GUI package group. The previously existing stig profile was not compatible with Server with GUI because DISA STIG demands uninstalling any Graphical User Interface. However, this can be overridden if properly documented by a Security Officer during evaluation. As a result, the new profile helps when installing a RHEL system as a Server with GUI aligned with the DISA STIG profile.

Profiles for ANSSI-BP-028 Minimal, Intermediary and Enhanced levels are now available in SCAP Security Guide

With the new profiles, you can harden the system to the recommendations from the French National Security Agency (ANSSI) for GNU/Linux Systems at the Minimal, Intermediary and Enhanced hardening levels. As a result, you can configure and automate compliance of your RHEL 8 systems according to your required ANSSI hardening level by using the ANSSI Ansible Playbooks and the ANSSI SCAP profiles.

scap-workbench can now scan remote systems using sudo privileges

The scap-workbench GUI tool now supports scanning remote systems using passwordless sudo access. This feature reduces the security risk imposed by supplying root’s credentials.

rhel8-tang container image is now available

With this release, the rhel8/rhel8-tang container image is available in the registry.redhat.io catalog. The container image provides Tang-server decryption capabilities for Clevis clients that run either in OpenShift Container Platform (OCP) clusters or in separate virtual machines.

Clevis rebased to version 15

The clevis packages have been rebased to upstream version 15. This version provides many bug fixes and enhancements over the previous version, most notably:

Clevis no longer automatically adds rd.neednet=1

Clevis now correctly produces a generic initrd (initial ramdisk) without host-specific configuration options by default. As a result, Clevis no longer automatically adds the rd.neednet=1 parameter to the kernel command line.

New package: rsyslog-udpspoof

The rsyslog-udpspoof subpackage has been added back to RHEL 8. This module is similar to the regular UDP forwarder, but permits relaying syslog between different network segments while maintaining the source IP in the syslog packets.

fapolicyd rebased to 1.0.2

The fapolicyd packages have been rebased to upstream version 1.0.2. This version provides many bug fixes and enhancements over the previous version, most notably:

New RPM plugin notifies fapolicyd about changes during RPM transactions

This update of the rpm packages introduces a new RPM plugin that integrates the fapolicyd framework with the RPM database. The plugin notifies fapolicyd about installed and changed files during an RPM transaction. As a result, fapolicyd now supports integrity checking.

The PTP capabilities output format of the ethtool utility has changed

Starting with RHEL 8.4, the ethtool utility uses the netlink interface instead of the ioctl() system call to communicate with the kernel. Consequently, when you use the ethtool -T <network_controller> command, the format of Precision Time Protocol (PTP) values changes.

XDP is conditionally supported

Red Hat supports the eXpress Data Path (XDP) feature only if all of the following conditions apply:

NetworkManager rebased to version 1.30.0

The NetworkManager packages have been upgraded to upstream version 1.30.0, which provides a number of enhancements and bug fixes over the previous version:

The iproute2 utility introduces traffic control actions to add MPLS headers before Ethernet header

With this enhancement, the iproute2 utility offers three new traffic control (tc) actions:

The nmstate API is now fully supported

Nmstate, which was previously a Technology Preview, is a network API for hosts and fully supported in RHEL 8.4. The nmstate packages provide a library and the nmstatectl command-line utility to manage host network settings in a declarative manner. The networking state is described by a predefined schema. Reporting of the current state and changes to the desired state both conform to the schema.

New package: rshim

The rhsim package provides the Mellanox BlueField rshim user-space driver, which enables accessing the rshim resources on the BlueField SmartNIC target from the external host machine. The current version of the rshim user-space driver implements device files for boot image push and virtual console access. In addition, it creates a virtual network interface to connect to the BlueField target and provides a way to access internal rshim registers.

iptraf-ng rebased to 1.2.1

The iptraf-ng packages have been rebased to upstream version 1.2.1, which provides several bug fixes and improvements. Most notably:

Kernel version in RHEL 8.4

Red Hat Enterprise Linux 8.4 is distributed with the kernel version 4.18.0-305.

Extended Berkeley Packet Filter for RHEL 8.4

The Extended Berkeley Packet Filter (eBPF) is an in-kernel virtual machine that allows code execution in the kernel space, in the restricted sandbox environment with access to a limited set of functions. The virtual machine executes a special assembly-like code.

New package: kmod-redhat-oracleasm

This update adds the new kmod-redhat-oracleasm package, which provides the kernel module part of the ASMLib utility. Oracle Automated Storage Management (ASM) is a data volume manager for Oracle databases. ASMLib is an optional utility that can be used on Linux systems to manage Oracle ASM devices.

The xmon program changes to support Secure Boot and kernel_lock resilience against attacks

If the Secure Boot mechanism is disabled, you can set the xmon program into read-write mode (xmon=rw) on the kernel command-line. However, if you specify xmon=rw and boot into Secure Boot mode, the kernel_lockdown feature overrides xmon=rw and changes it to read-only mode. The additional behavior of xmon depending on Secure Boot enablement is listed below:

Cornelis Omni-Path Architecture (OPA) Host Software

Omni-Path Architecture (OPA) host software is fully supported in Red Hat Enterprise Linux 8.4. OPA provides Host Fabric Interface (HFI) hardware with initialization and setup for high performance data transfers (high bandwidth, high message rate, low latency) between compute and I/O nodes in a clustered environment.

SLAB cache merging disabled by default

The CONFIG_SLAB_MERGE_DEFAULT kernel configuration option has been disabled, and now SLAB caches are not merged by default. This change aims to enhance the allocator’s reliability and traceability of cache usage. If the previous slab-cache merging behavior was desirable, the user can re-enable it by adding the slub_merge parameter to the kernel command-line. For more information on how to set the kernel command-line parameters, see the Configuring kernel command-line parameters on Customer Portal.

The ima-evm-utils package rebased to version 1.3.2

The ima-evm-utils package has been upgraded to version 1.3.2, which provides multiple bug fixes and enhancements. Notable changes include:

Levelling IMA and EVM features across supported CPU architectures

All CPU architectures, except ARM, have a similar level of feature support for Integrity Measurement Architecture (IMA) and Extended Verification Module (EVM) technologies. The enabled functionalities are different for each CPU architecture. The following are the most significant changes for each supported CPU architecture:

Proactive compaction is now included in RHEL 8 as disabled-by-default

With ongoing workload activity, system memory becomes fragmented. The fragmentation can result in capacity and performance problems. In some cases, program errors are also possible. Thereby, the kernel relies on a reactive mechanism called memory compaction. The original design of the mechanism is conservative, and the compaction activity is initiated on demand of allocation request. However, reactive behavior tends to increase the allocation latency if the system memory is already heavily fragmented. Proactive compaction improves the design by regularly initiating memory compaction work before a request for allocation is made. This enhancement increases the chances that memory allocation requests find the physically contiguous blocks of memory without the need of memory compaction producing those on-demand. As a result, latency for specific memory allocation requests is lowered.

EDAC support has been added in RHEL 8

With this update, RHEL 8 supports the Error Detection and Correction (EDAC) kernel module set in 8th and 9th generation Intel Core Processors (CoffeeLake). The EDAC kernel module mainly handles Error Code Correction (ECC) memory and detect and report PCI bus parity errors.

A new package: kpatch-dnf

The kpatch-dnf package provides a DNF plugin, which makes it possible to subscribe a RHEL system to kernel live patch updates. The subscription will affect all kernels currently installed on the system, including kernels that will be installed in the future. For more details about kpatch-dnf, see the dnf-kpatch(8) manual page or the Managing, monitoring, and updating the kernel documentation.

A new cgroups controller implementation for slab memory

A new implementation of slab memory controller for the control groups technology is now available in RHEL 8. Currently, a single memory slab can contain objects owned by different memory control group. The slab memory controller brings improvement in slab utilization (up to 45%) and enables to shift the memory accounting from the page level to the object level. Also, this change eliminates each set of duplicated per-CPU and per-node slab caches for each memory control group and establishes one common set of per-CPU and per-node slab caches for all memory control groups. As a result, you can achieve a significant drop in the total kernel memory footprint and observe positive effects on memory fragmentation.

Time namespace has been added in RHEL 8

The time namespace enables the system monotonic and boot-time clocks to work with per-namespace offsets on AMD64, Intel 64, and the 64-bit ARM architectures. This feature is suited for changing the date and time inside Linux containers and for in-container adjustments of clocks after restoration from a checkpoint. As a result, users can now independently set time for each individual container.

New feature: Free memory page returning

With this update, the RHEL 8 host kernel is able to return memory pages that are not used by its virtual machines (VMs) back to the hypervisor. This improves the stability and resource efficiency of the host. Note that for memory page returning to work, it must be configured in the VM, and the VM must also use the virtio_balloon device.

Supports changing the sorting order in perf top

With this update, perf top can now sort samples by arbitrary event column in case multiple events in a group are sampled, instead of sorting by the first column. As a result, pressing a number key sorts the table by the matching data column.

The kabi_whitelist package has been renamed to kabi_stablelist

In accordance with Red Hat commitment to replacing problematic language, we renamed the kabi_whitelist package to kabi_stablelist in the RHEL 8.4 release.

bpf rebased to version 5.9

The bpf kernel technology in RHEL 8 has been brought up-to-date with its upstream counterpart from the kernel v5.9.

The bcc package rebased to version 0.16.0

The bcc package has been upgraded to version 0.16.0, which provides multiple bug fixes and enhancements. Notable changes include:

bpftrace rebased to version 0.11.0

The bpftrace package has been upgraded to version 0.11.0, which provides multiple bug fixes and enhancements. Notable changes include:

libbpf rebased to version 0.2.0.1

The libbpf package has been upgraded to version 0.2.0.1, which provides multiple bug fixes and enhancements. Notable changes include:

perf now supports adding or removing tracepoints from a running collector without having to stop or restart perf

Previously, to add or remove tracepoints from an instance of perf record, the perf process had to be stopped. As a consequence, performance data that occurred during the time the process was stopped was not collected and, therefore, lost. With this update, you can dynamically enable and disable tracepoints being collected by perf record via the control pipe interface without having to stop the perf record process.

The perf tool now supports recording and displaying absolute timestamps for trace data

With this update, perf script can now record and display trace data with absolute timestamps.

dwarves rebased to version 1.19.1

The dwarves package has been upgraded to version 1.19.1, which provides multiple bug fixes and enhancements. Notably, this update introduces a new way of checking functions from the DWARF debug data with related ftrace entries to ensure a subset of ftrace functions is generated.

perf now supports circular buffers that use specified events to trigger snapshots

With this update, you can create custom circular buffers that write data to a perf.data file when an event you specify is detected. As a result, perf record can run continuously in the system background without generating excess overhead by continuously writing data to a perf.data file, and only recording data you are interested in.

Kernel DRBG and Jitter entropy source are compliant to NIST SP 800-90A and NIST SP 800-90B

Kernel Deterministic Random Bit Generator (DRBG) and Jitter entropy source are now compliant to recommendation for random number generation using DRBG (NIST SP 800-90A) and recommendation for the entropy sources used for random bit generation (NIST SP 800-90B) specifications. As a result, applications in FIPS mode can use these sources as FIPS-compliant randomness and noise sources.

kdump now supports Virtual Local Area Network tagged team network interface

This update adds support to configure Virtual Local Area Network tagged team interface for kdump. As a result, this feature now enables kdump to use a Virtual Local Area Network tagged team interface to dump a vmcore file.

kernel-rt source tree has been updated to RHEL 8.4 tree

The kernel-rt source has been updated to use the latest Red Hat Enterprise Linux kernel source tree. The real-time patch set has also been updated to the latest upstream version, v5.10-rt7. Both of these updates provide a number of bug fixes and enhancements.

The stalld package is now added to RHEL 8.4 distribution

This update adds the stalld package to RHEL 8.4.0. stalld is a daemon that monitors threads on a system running low latency applications. It checks for job threads that have been on a run-queue without being scheduled onto a CPU for a specified threshold.

Support for CPU hotplug in the hv_24x7 and hv_gpci PMUs

With this update, PMU counters correctly react to the hot-plugging of a CPU. As a result, if a hv_gpci event counter is running on a CPU that gets disabled, the counting redirects to another CPU.

Metrics for POWERPC hv_24x7 nest events are now available

Metrics for POWERPC hv_24x7 nest events are now available for perf. By aggregating multiple events, these metrics provide a better understanding of the values obtained from perf counters and how effectively the CPU is able to process the workload.

hwloc rebased to version 2.2.0

The hwloc package has been upgraded to version 2.2.0, which provides the following change:

The igc driver is now fully supported

The igc Intel 2.5G Ethernet Linux wired LAN driver was introduced in RHEL 8.1 as a Technology Preview. Starting with RHEL 8.4, it is fully supported on all architectures. The ethtool utility also supports igc wired LANs.

RHEL installation now supports creating a swap partition of size 16 TiB

Previously, when installing RHEL, the installer created a swap partition of maximum 128 GB for automatic and manual partitioning.

Surprise removal of NVMe devices

With this enhancement, you can surprise remove NVMe devices from the Linux operating system without notifying the operating system beforehand. This will enhance the serviceability of NVMe devices because no additional steps are required to prepare the devices for orderly removal, which ensures the availability of servers by eliminating server downtime.

Stratis filesystem symlink paths have changed

With this enhancement, Stratis filesystem symlink paths have changed from /stratis/<stratis-pool>/<filesystem-name> to /dev/stratis/<stratis-pool>/<filesystem-name>. Consequently, all existing Stratis symlinks must be migrated to utilize the new symlink paths.

Stratis now supports binding encrypted pools to a supplementary Clevis encryption policy

With this enhancement, you can now bind encrypted Stratis pools to Network Bound Disk Encryption (NBDE) using a Tang server, or to the Trusted Platform Module (TPM) 2.0. Binding an encrypted Stratis pool to NBDE or TPM 2.0 facilitates automatic unlocking of pools. As a result, you can access your Stratis pools without having to provide the kernel keyring description after each system reboot. Note that binding a Stratis pool to a supplementary Clevis encryption policy does not remove the primary kernel keyring encryption.

New mount options to control when DAX is enabled on XFS and ext4 file systems

This update introduces new mount options which, when combined with the FS_XFLAG_DAX inode flag, provide finer-grained control of the Direct Access (DAX) mode for files on XFS and ext4 file systems. In prior releases, DAX was enabled for the entire file system using the dax mount option. Now, the direct access mode can be enabled on a per-file basis.

SMB Direct is now supported

With this update, the SMB client now supports SMB Direct.

New API for mounting filesystems has been added

With this update, a new API for mounting filesystems based on an internal kernel structure called a filesystem context (struct fs_context) has been added into RHEL 8.4, allowing greater flexibility in communication of mount parameters between userspace, the VFS, and the file system. Along with this, there are following system calls for operating on the file system context:

Discrepancy in vfat file system mtime no longer occurs

With this update, the discrepancy in the vfat file system mtime between in-memory and on-disk write times is no longer present. This discrepancy was caused by a difference between in-memory and on-disk mtime metadata, which no longer occurs.

RHEL 8.4 now supports close_range() system call

With this update, the close_range() system call was backported to RHEL 8.4. This system call closes all file descriptors in a given range effectively, preventing timing problems which are present when closing a wide range of file descriptors sequentially if applications configure very large limits.

Support for user extended attributes through the NFSv4.2 protocol has been added

This update adds NFSV4.2 client-side and server-side support for user extended attributes (RFC 8276) and newly includes the following protocol extensions:

Noncritical resources in colocation constraints are now supported

With this enhancement, you can configure a colocation constraint such that if the dependent resource of the constraint reaches its migration threshold for failure, Pacemaker will leave that resource offline and keep the primary resource on its current node rather than attempting to move both resources to another node. To support this behavior, colocation constraints now have an influence option, which can be set to true or false, and resources have a critical meta-attribute, which can also be set to true or false. The value of the critical resource meta option determines the default value of the influence option for all colocation constraints involving the resource as a dependent resource.

New number data type supported by Pacemaker rules

PCS now supports a data type of number, which you can use when defining Pacemaker rules in any PCS command that accepts rules. Pacemaker rules implement number as a double-precision floating-point number and integer as a 64-bit integer.

Ability to specify a custom clone ID when creating a clone resource or promotable clone resource

When you create a clone resource or a promotable clone resource, the clone resource is named resource-id -clone by default. If that ID is already in use, PCS adds the suffix -integer, starting with an integer value of 1 and incrementing by one for each additional clone. You can now override this default by specifying a name for a clone resource ID or promotable clone resource ID with the clone-id option when creating a clone resource with the pcs resource create or the pcs resource clone command. For information on creating clone resources, see Creating cluster resources that are active on multiple nodes.

New command to display Corosync configuration

You can now print the contents of the corosync.conf file in several output formats with the new pcs cluster config [show] command. By default, the pcs cluster config command uses the text output format, which displays the Corosync configuration in a human-readable form, with the same structure and option names as the pcs cluster setup and pcs cluster config update commands.

New command to modify the Corosync configuration of an existing cluster

You can now modify the parameters of the corosync.conf file with the new pcs cluster config update command. You can use this command, for example, to increase the totem token to avoid fencing during temporary system unresponsiveness. For information on modifying the corosync.conf file, see Modifying the corosync.conf file with the pcs command.

Enabling and disabling Corosync traffic encryption in an existing cluster

Previously, you could configure Corosync traffic encryption only when creating a new cluster. With this update:

New crypt resource agent for shared and encrypted GFS2 file systems

RHEL HA now supports a new crypt resource agent, which allows you to configure a LUKS encrypted block device that can be used to provide shared and encrypted GFS2 file systems. Using the crypt resource is currently supported only with GFS2 file systems. For information on configuring an encrypted GFS2 file system, see Configuring an encrypted GFS2 file system in a cluster.

A new module: python39

RHEL 8.4 introduces Python 3.9, provided by the new module python39 and the ubi8/python-39 container image.

Changes in the default separator for the Python urllib parsing functions

To mitigate the Web Cache Poisoning CVE-2021-23336 in the Python urllib library, the default separator for the urllib.parse.parse_qsl and urllib.parse.parse_qs functions is being changed from both ampersand (&) and semicolon (;) to only an ampersand.

A new module stream: swig:4.0

RHEL 8.4 introduces the Simplified Wrapper and Interface Generator (SWIG) version 4.0, available as a new module stream, swig:4.0.

A new module stream: subversion:1.14

RHEL 8.4 introduces a new module stream, subversion:1.14. Subversion 1.14 is the most recent Long Term Support (LTS) release.

A new module stream: redis:6

Redis 6, an advanced key-value store, is now available as a new module stream, redis:6.

A new module stream: postgresql:13

RHEL 8.4 introduces PostgreSQL 13, which provides a number of new features and enhancements over version 12. Notable changes include:

A new module stream: mariadb:10.5

MariaDB 10.5 is now available as a new module stream, mariadb:10.5. Notable enhancements over the previously available version 10.3 include:

MariaDB 10.5 provides the PAM plug-in version 2.0

MariaDB 10.5 adds a new version of the Pluggable Authentication Modules (PAM) plug-in. The PAM plug-in version 2.0 performs PAM authentication using a separate setuid root helper binary, which enables MariaDB to utilize additional PAM modules.

A new package: mysql-selinux

RHEL 8.4 adds a new mysql-selinux package that provides an SELinux module with rules for the MariaDB and MySQL databases. The package is installed by default with the database server. The module’s priority is set to 200.

python-PyMySQL rebased to version 0.10.1

The python-PyMySQL package, which provides the pure-Python MySQL client library, has been updated to version 0.10.1. The package is included in the python36, python38, and python39 modules.

A new package: python3-pyodbc

This update adds the python3-pyodbc package to RHEL 8. The pyodbc Python module provides access to Open Database Connectivity (ODBC) databases. This module implements the Python DB API 2.0 specification and can be used with third-party ODBC drivers. For example, you can now use the Performance Co-Pilot (pcp) to monitor performance of the SQL Server.

A new package: micropipenv

A new micropipenv package is now available. It provides a lightweight wrapper for the pip package installer to support Pipenv and Poetry lock files.

New packages: py3c-devel and py3c-docs

RHEL 8.4 introduces new py3c-devel and py3c-docs packages, which simplify porting C extensions to Python 3. These packages include a detailed guide and a set of macros for easier porting.

Enhanced ProxyRemote directive for configuring httpd

The ProxyRemote configuration directive in the Apache HTTP Server has been enhanced to optionally take user name and password credentials. These credentials are used for authenticating to the remote proxy using HTTP Basic authentication. This feature has been backported from httpd 2.5.

Non-end-entity certificates can be used with the SSLProxyMachineCertificateFile and SSLProxyMachineCertificatePath httpd directives

With this update, you can use non-end-entity (non-leaf) certificates, such as a Certificate Authority (CA) or intermediate certificate, with the SSLProxyMachineCertificateFile and SSLProxyMachineCertificatePath configuration directives in the Apache HTTP Server. The Apache HTTP server now treats such certificates as trusted CAs, as if they were used with the SSLProxyMachineCertificateChainFile directive. Previously, if non-end-entity certificates were used with the SSLProxyMachineCertificateFile and SSLProxyMachineCertificatePath directives, httpd failed to start with a configuration error.

A new SecRemoteTimeout directive in the mod_security module

Previously, you could not modify the default timeout for retrieving remote rules in the mod_security module for the Apache HTTP Server. With this update, you can set a custom timeout in seconds using the new SecRemoteTimeout configuration directive.

The mod_fcgid module can now pass up to 1024 environment variables to an FCGI server process

With this update, the mod_fcgid module for the Apache HTTP Server can pass up to 1024 environment variables to a FastCGI (FCGI) server process. The previous limit of 64 environment variables could cause applications running on the FCGI server to malfunction.

perl-IO-String is now available in the AppStream repository

The perl-IO-String package, which provides the Perl IO::String module, is now distributed through the supported AppStream repository. In previous releases of RHEL 8, the perl-IO-String package was available in the unsupported CodeReady Linux Builder repository.

A new package: quota-devel

RHEL 8.4 introduces the quota-devel package, which provides header files for implementing the quota Remote Procedure Call (RPC) service.

The glibc library now supports glibc-hwcaps subdirectories for loading optimized shared library implementations

On certain architectures, hardware upgrades sometimes caused glibc to load libraries with baseline optimizations, rather than optimized libraries for the previous hardware generation. Additionally, when running on AMD CPUs, optimized libraries were not loaded at all.

The glibc dynamic loader now activates selected audit modules at run time

Previously, the binutils link editor ld supported the --audit option to select audit modules for activation at run time, but the glibc dynamic loader ignored the request. With this update, the glib dynamic loader no longer ignores the request, and loads the indicated audit modules. As a result, it is possible to activate audit modules for specific programs without writing wrapper scripts or using similar mechanisms.

glibc now provides improved performance on IBM POWER9

This update introduces new implementations of the functions strlen, strcpy, stpcpy, and rawmemchr for IBM POWER9. As a result, these functions now execute faster on IBM POWER9 hardware which leads to performance gains.

Optimized performance of memcpy and memset on IBM Z

With this enhancement, the core library implementation for the memcpy and memset APIs were adjusted to accelerate both small (< 64KiB) and larger data copies on IBM Z processors. As a result, applications working with in-memory data now benefit from significantly improved performance across a wide variety of workloads.

GCC now supports the ARMv8.1 LSE atomic instructions

With this enhancement, the GCC compiler now supports Large System Extensions (LSE), atomic instructions added with the ARMv8.1 specification. These instructions provide better performance in multi-threaded applications than the ARMv8.0 Load-Exclusive and Store-Exclusive instructions.

GCC now emits vector alignment hints for certain IBM Z systems

This update enables the GCC compiler to emit vector load and store alignment hints for IBM z13 processors. To use this enhancement the assembler must support such hints. As a result, users now benefit from improved performance of certain vector operations.

Dyninst rebased to version 10.2.1

The Dyninst binary analysis and modification tool has been updated to version 10.2.1. Notable bug fixes and enhancements include:

elfutils rebased to version 0.182

The elfutils package has been updated to version 0.182. Notable bug fixes and enhancements include:

SystemTap rebased to version 4.4

The SystemTap instrumentation tool has been updated to version 4.4, which provides multiple bug fixes and enhancements. Notable changes include:

Valgrind now supports IBM z14 instructions

With this update, the Valgrind tool suite supports instructions for the IBM z14 processor. As a result, you can now use the Valgrind tools to debug programs using the z14 vector instructions and the miscellaneous z14 instruction set.

CMake rebased to version 3.18.2

The CMake build system has been upgraded from version 3.11.4 to version 3.18.2. It is available in RHEL 8.4 as the cmake-3.18.2-8.el8 package.

libmpc rebased to version 1.1.0

The libmpc package has been rebased to version 1.1.0, which provides several enhancements and bug fixes over the previous version. For details, see GNU MPC 1.1.0 release notes.

Updated GCC Toolset 10

GCC Toolset 10 is a compiler toolset that provides recent versions of development tools. It is available as an Application Stream in the form of a Software Collection in the AppStream repository.

GCC Toolset 10: GCC now supports bfloat16

In GCC Toolset 10, the GCC compiler now supports the bfloat16 extension through ACLE Intrinsics. This enhancement provides high-performance computing.

GCC Toolset 10: GCC now supports ENQCMD and ENQCMDS instructions on Intel Sapphire Rapids processors

In GCC Toolset 10, the GNU Compiler Collection (GCC) now supports the ENQCMD and ENQCMDS instructions, which you can use to submit work descriptors to devices automatically. To apply this enhancement, run GCC with the -menqcmd option.

GCC Toolset 10: Dyninst rebased to version 10.2.1

In GCC Toolset 10, the Dyninst binary analysis and modification tool has been updated to version 10.2.1. Notable bug fixes and enhancements include:

GCC Toolset 10: elfutils rebased to version 0.182

In GCC Toolset 10, the elfutils package has been updated to version 0.182. Notable bug fixes and enhancements include:

Go Toolset rebased to version 1.15.7

Go Toolset has been upgraded to 1.15.7. Notable enhancements include:

Rust Toolset rebased to version 1.49.0

Rust Toolset has been updated to version 1.49.0. Notable changes include:

LLVM Toolset rebased to version 11.0.0

LLVM Toolset has been upgraded to version 11.0.0. Notable changes include:

pcp rebased to version 5.2.5

The pcp package has been upgraded to version 5.2.5. Notable changes include:

Accessing remote hosts through a central pmproxy for the Vector data source in grafana-pcp

In some environments, the network policy does not allow connections from the dashboard viewer’s browser to the monitored hosts directly. This update makes it possible to customize the hostspec in order to connect to a central pmproxy, which forwards the requests to the individual hosts.

grafana rebased to version 7.3.6

The grafana package has been upgraded to version 7.3.6. Notable changes include:

grafana-pcp rebased to version 3.0.2

The grafana-pcp package has been upgraded to version 3.0.2. Notable changes include:

Active Directory authentication for accessing SQL Server metrics in PCP

With this update, a system administrator can configure pmdamssql(1) to connect securely to the SQL Server metrics using Active Directory (AD) authentication.

grafana-container rebased to version 7.3.6

The rhel8/grafana container image provides Grafana. Grafana is an open source utility with metrics dashboard, and graphic editor for Graphite, Elasticsearch, OpenTSDB, Prometheus, InfluxDB, and Performance Co-Pilot (PCP). The grafana-container package has been upgraded to version 7.3.6. Notable changes include:

pcp-container rebased to version 5.2.5

The rhel8/pcp container image provides Performance Co-Pilot, which is a system performance analysis toolkit. The pcp-container package has been upgraded to version 5.2.5. Notable changes include:

JDK Mission Control rebased to version 8.0.0

The JDK Mission Control (JMC) profiler for HotSpot JVMs, provided by the jmc:rhel8 module stream, has been upgraded to version 8.0.0. Notable enhancements include:

Making Identity Management more inclusive

Red Hat is committed to using conscious language.

The dsidm utility supports renaming and moving entries

With this enhancement, you can use the dsidm utility to rename and move users, groups, POSIX groups, roles, and organizational units (OU) in Directory Server. For further details and examples, see the Renaming Users, Groups, POSIX Groups, and OUs section in the Directory Server Administration Guide.

Deleting Sub-CAs in IdM

With this enhancement, if you run the ipa ca-del command and have not disabled the Sub-CA, an error indicates the Sub-CA cannot be deleted and it must be disabled. First run the ipa ca-disable command to disable the Sub-CA and then delete it using the ipa ca-del command.

IdM now supports new Ansible management role and modules

RHEL 8.4 provides Ansible modules for automated management of role-based access control (RBAC) in Identity Management (IdM), an Ansible role for backing up and restoring IdM servers, and an Ansible module for location management:

IdM in FIPS mode now supports a cross-forest trust with AD

With this enhancement, administrators can establish a cross-forest trust between an IdM domain with FIPS mode enabled and an Active Directory (AD) domain. Note that you cannot establish a trust using a shared secret while FIPS mode is enabled in IdM, see FIPS compliance.

AD users can now log in to IdM with UPN suffixes subordinate to known UPN suffixes

Previously, Active Directory (AD) users could not log into Identity Management (IdM) with a Universal Principal Name (UPN) (for example, sub1.ad-example.com) that is a subdomain of a known UPN suffix (for example, ad-example.com) because internal Samba processes filtered subdomains as duplicates of any Top Level Names (TLNs). This update validates UPNs by testing if they are subordinate to the known UPN suffixes. As a result, users can now log in using subordinate UPN suffixes in the described scenario.

IdM now supports new password policy options

With this update, Identity Management (IdM) supports additional libpwquality library options:

Improved Active Directory site discovery process

The SSSD service now discovers Active Directory sites in parallel over connection-less LDAP (CLDAP) to multiple domain controllers to speed up site discovery in situations where some domain controllers are unreachable. Previously, site discovery was performed sequentially and, in situations where domain controllers were unreachable, a timeout eventually occurred and SSSD went offline.

The default value of nsslapd-nagle has been turned off to increase the throughput

Previously, the nsslapd-nagle parameter in the cn=config entry was enabled by default. As a consequence, Directory Server performed a high number of setsocketopt system calls which slowed down the server. This update changes the default value of nsslapd-nagle to off. As a result, Directory Server performs a lower number of setsocketopt system calls and can handle a higher number of operations per second.

Enabling or disabling SSSD domains within the [domain] section of the sssd.conf file

With this update, you can now enable or disable an SSSD domain by modifying its respective [domain] section in the sssd.conf file.

Added an option to manually control the maximum offline timeout

The offline_timeout period determines the time incrementation between attempts by SSSD to go back online. Previously, the maximum possible value for this interval was hardcoded to 3600 seconds, which was adequate for general usage but resulted in issues in fast or slow changing environments.

Support for exclude_users and exclude_groups with scope=all in SSSD session recording configuration

Red Hat Enterprise 8.4 now provides new SSSD options for defining session recording for large lists of groups or users:

samba rebased to version 4.13.2

The samba packages have been upgraded to upstream version 4.13.2, which provides a number of bug fixes and enhancements over the previous version:

New GSSAPI PAM module for passwordless sudo authentication with SSSD

With the new pam_sss_gss.so Pluggable Authentication Module (PAM), you can configure the System Security Services Daemon (SSSD) to authenticate users to PAM-aware services with the Generic Security Service Application Programming Interface (GSSAPI).

Directory Server rebased to version 1.4.3.16

The 389-ds-base packages have been upgraded to upstream version 1.4.3.16, which provides a number of bug fixes and enhancements over the previous version. For a complete list of notable changes, read the upstream release notes before updating:

Directory Server now logs the work and operation time in RESULT entries

With this update, Directory Server now logs two additional time values in RESULT entries in the /var/log/dirsrv/slapd-<instance_name>/access file:

Directory Server can now reject internal unindexed searches

This enhancement adds the nsslapd-require-internalop-index parameter to the cn=<database_name>,cn=ldbm database,cn=plugins,cn=config entry to reject internal unindexed searches. When a plug-in modifies data, it has a write lock on the database. On large databases, if a plug-in then executes an unindexed search, the plug-in sometimes uses all database locks, which corrupts the database or causes the server to become unresponsive. To avoid this problem, you can now reject internal unindexed searches by enabling the nsslapd-require-internalop-index parameter.

You can configure the unresponsive application timeout in GNOME

GNOME periodically sends a signal to every application to detect if the application is unresponsive. When GNOME detects an unresponsive application, it displays a dialog over the application window that asks if you want to stop the application or wait.

Intel Tiger Lake GPUs are now supported

This release adds support for the Intel Tiger Lake CPU microarchitecture with integrated graphics. This includes Intel UHD Graphics and Intel Xe integrated GPUs found with the following CPU models:

Intel GPUs that use the 11th generation Core microprocessors are now supported

This release adds support for the 11th generation Core CPU architecture (formerly known as Rocket Lake) with Xe gen 12 integrated graphics, which is found in the following CPU models:

Nvidia Ampere is now supported

This release adds support for the Nvidia Ampere GPUs that use the GA102 or GA104 chipset. That includes the following GPU models:

Various updated graphics drivers

The following graphics drivers have been updated to the latest upstream version:

Software Updates page checks for required restarts

With this update, the Software Updates page in the RHEL web console checks if it is sufficient to only restart some services or running processes for updates to become effective after installation. In these cases this avoids having to reboot the machine.

Graphical performance analysis in the web console

With this update the system graphs page has been replaced with a new dedicated page for analyzing the performance of a machine. To view the performance metrics, click View details and history from the Overview page. It shows current metrics and historical events based on the Utilization Saturation, and Errors (USE) method.

Web console assists with SSH key setup

Previously, the web console allowed logging into remote hosts with your initial login password when Reuse my password for remote connections was selected during login. This option has been removed, and instead of that the web console now helps with setting up SSH keys for users that want automatic and password-less login to remote hosts.

The RELP secure transport support added to the Logging role configuration

Reliable Event Logging Protocol, RELP, is a secure, reliable protocol to forward and receive log messages among rsyslog servers. With this enhancement, administrators can now benefit from the RELP, which is a useful protocol with high demands from rsyslog users, as rsyslog servers are capable of forwarding and receiving log messages over the RELP protocol.

SSH Client RHEL system role is now supported

Previously, there was no vendor-supported automation tooling to configure RHEL SSH in a consistent and stable manner for servers and clients. With this enhancement, you can use the RHEL system roles to configure SSH clients in a systematic and unified way, independently of the operating system version.

An alternative to the traditional RHEL system roles format: Ansible Collection

RHEL 8.4 introduces RHEL system roles in the Collection format, available as an option to the traditional RHEL system roles format.

Metrics role supports configuration and enablement of metrics collection for SQL server via PCP

The metrics RHEL system role now provides the ability to connect SQL Server, mssql with Performance Co-Pilot, pcp. SQL Server is a general purpose relational database from Microsoft. As it runs, SQL Server updates internal statistics about the operations it is performing. These statistics can be accessed using SQL queries but it is important for system and database administrators undertaking performance analysis tasks to be able to record, report, visualize these metrics. With this enhancement, users can use the metrics RHEL system role to automate connecting SQL server, mssql, with Performance Co-Pilot, pcp, which provides recording, reporting, and visualization functionality for mssql metrics.

exporting-metric-data-to-elasticsearch functionality available in the Metrics RHEL system role

Elasticsearch is a popular, powerful and scalable search engine. With this enhancement, by exporting metric values from the Metrics RHEL system role to the Elasticsearch, users are able to access metrics via Elasticsearch interfaces, including via graphical interfaces, REST APIs, between others. As a result, users are able to use these Elasticsearch interfaces to help diagnose performance problems and assist in other performance related tasks like capacity planning, benchmarking and so on.

Support for SSHD RHEL system role

Previously, there was no vendor-supported automation tooling to configure SSH RHEL system roles in a consistent and stable manner for servers and clients. With this enhancement, you can use the RHEL system roles to configure sshd servers in a systematic and unified way regardless of operating system version.

Crypto Policies RHEL system role is now supported

With this enhancement, RHEL 8 introduces a new feature for system-wide cryptographic policy management. By using RHEL system roles, you now can consistently and easily configure cryptographic policies on any number of RHEL 8 systems.

The Logging RHEL system role now supports rsyslog behavior

With this enhancement, rsyslog receives the message from Red Hat Virtualization and forwards the message to the elasticsearch.

The networking RHEL system role now supports the ethtool settings

With this enhancement, you can use the networking RHEL system role to configure ethtool coalesce settings of a NetworkManager connection. When using the interrupt coalescing procedure, the system collects network packets and generates a single interrupt for multiple packets. As a result, this increases the amount of data sent to the kernel with one hardware interrupt, which reduces the interrupt load, and maximizes the throughput.

IBM Z virtual machines can now run up to 248 CPUs

Previously, the number of CPUs that you could use in an IBM Z (s390x) virtual machine (VM), with DIAG318 enabled, was limited to 240. Now, using the Extended-Length SCCB, IBM Z VMs can run up to 248 CPUs.

HMAT is now supported on RHEL KVM

With this update, ACPI Heterogeneous Memory Attribute Table (HMAT) is now supported on RHEL KVM. The ACPI HMAT optimizes memory by providing information about memory attributes, such as memory side cache attributes as well as bandwidth and latency details related to the System Physical Address (SPA) Memory Ranges.

Virtual machines can now use features of Intel Atom P5000 Processors

The Snowridge CPU model name is now available for virtual machines (VMs). On hosts with Intel Atom P5000 processors, using Snowridge as the CPU type in the XML configuration of the VM exposes new features of these processors to the VM.

virtio-gpu devices now work better on virtual machines with Windows 10 and later

This update extends the virtio-win drivers to also provide custom drivers for virtio-gpu devices on selected Windows platforms. As a result, the virtio-gpu devices now have improved performance on virtual machines that use Windows 10 or later as their guest systems. In addition, the devices will also benefit from future enhancements to virtio-win.

Virtualization support for 3rd generation AMD EPYC processors

With this update, virtualization on RHEL 8 adds support for the 3rd generation AMD EPYC processors, also known as EPYC Milan. As a result, virtual machines hosted on RHEL 8 can now use the EPYC-Milan CPU model and utilise new features that the processors provide.

Automatic registration for gold images for AWS

With this update, gold images of RHEL 8.4 and later for Amazon Web Services and Microsoft Azure can be configured by the user to automatically register to Red Hat Subscription Management (RHSM) and Red Hat Insights. This makes it faster and easier to configure a large number of virtual machines created from a gold image.

cloud-init is now supported on Power Systems Virtual Server in IBM Cloud

With this update, the cloud-init utility can be used to configure RHEL 8 virtual machines hosted on IBM Power Systems hosts and running in the IBM Cloud Virtual Server service.

sos rebased to version 4.0

The sos package has been upgraded to version 4.0. This major version release includes a number of new features and changes.

Podman now supports volume plugins written for Docker

Podman now has support for Docker volume plugins. These volume plugins or drivers, written by vendors and community members, can be used by Podman to create and manage container volumes.

The ubi-micro container image is now available

The registry.redhat.io/ubi8/ubi-micro container image is the smallest base image that uses the package manager on the underlying host to install packages, typically using Buildah or multi-stage builds with Podman. Excluding package managers and all of its dependencies increases the level of security of the image.

Support to auto-update container images is available

With this enhancement, users can use the podman auto-update command to auto-update containers according to their auto-update policy. The containers have to be labeled with a specified "io.containers.autoupdate=image" label to check if the image has been updated. If it has, Podman pulls the new image and restarts the systemd unit executing the container. The podman auto-update command relies on systemd and requires a fully-specified image name to create a container.

Podman now supports secure short names

Short-name aliases for images can now be configured in the registries.conf file in the [aliases] table. The short-names modes are:

container-tools:3.0 stable stream is now available

The container-tools:3.0 stable module stream, which contains the Podman, Buildah, Skopeo, and runc tools is now available. This update provides bug fixes and enhancements over the previous version.

Anaconda now shows a dialog for ldl or unformatted DASD disks in text mode

Previously, during an installation in text mode, Anaconda failed to show a dialog for Linux disk layout (ldl) or unformatted Direct-Access Storage Device (DASD) disks. As a result, users were unable to utilize those disks for the installation.

RHEL installer failed to start when InfiniBand network interfaces were configured using installer boot options

Previously, when you configured InfiniBand network interfaces at an early stage of RHEL installation using installer boot options (for example, downloaded installer image using PXE server), the installer failed to activate the network interfaces.

The automatic partitioning can be scheduled in Anaconda

Previously, during automatic partitioning on LVM type disks, the installer tried to create a partition for an LVM PV on each selected disk. If these disks already had partitioning layout, the schedule of the automatic partitioning could have failed with the error message.

Configuring a wireless network using Anaconda GUI is fixed

Previously, configuring the wireless network while using Anaconda graphical user interface (GUI) caused the installation to crash.

New -m and -M parameters are now supported for the %autopatch rpm macro

With this update, the -m (min) and -M (max) parameters have been added to the %autopatch macro to apply only a range of patches with given parameters.

popt rebased to version 1.18

The popt packages have been upgraded to the upstream version 1.18, which provides the following notable changes over the previous version:

snmpbulkget now provides valid output for a non-existing PID

Previously, the snmpbulkget command did not provide valid output for a non-existing PID. Consequently, this command would fail with the output as no results found.

The CRON command now sends an email as per the trigger conditions.

Previously, when the Relax-and-Recover (ReaR) utility was configured incorrectly, the CRON command triggered an error message that was sent to the administrator through an email. Consequently, the administrator would receive emails even if the configuration was not performed for ReaR.

Using NetBackup version 8.2 as the backup mechanism in ReaR now works.

Previously, when using NetBackup as a backup method, the Relax-and-Recover (ReaR) utility did not start the vxpbx_exchanged service in the rescue system. Consequently, restoring the data from the backup in the rescue system with NetBackup 8.2 failed with the following error messages logged on the NetBackup server:

libvpd rebased to version 2.2.8.

Notable changes include:

ReaR utility now restores system using LUKS2 encrypted partition

Previously, when at least one LUKS2 encrypted partition was present on the system to backup with Relax-and-Recover (Rear) utility, the user was not informed that ReaR does not support LUKS2 encrypted partition. Consequently, the ReaR utility was unable to recreate the original state of the system during the restore phase.

Texlive now correctly works with Poppler

Previously, the Poppler utility underwent an update for API changes. Consequently, due to these API changes the Texlive build did not function. With this update, the Texlive build now functions correctly with the new Poppler utility.

RPZ now works with wildcard characters

Previously, the dns_rpz_find_name function in the lib/dns/rpz.c file did not consider wildcard characters when a record for the same suffix was present. Consequently, some records containing wildcard characters were ignored. With this update, the dns_rpz_find_name function has been fixed and it now considers wildcard characters.

Improved padding for pkcs11

Previously, the pkcs11 token label had extra padding for some smart cards. As a consequence, the wrong padding could cause issues matching cards based on the label attribute. With this update, the padding is fixed for all the cards and defined PKCS #11 URIs and matching against them in application should work as expected.

Fixed sealert connection issue handling

Previously, a crash of the setroubleshoot daemon could cause the sealert process to stop responding. Consequently, the GUI did not show any analysis and also became unresponsive, the command line tool did not print any output and kept running until killed. This update improves handling of connection issues between sealert and setroubleshootd. Now sealert reports an error message and exits in case the setroubleshoot daemon crashes.

Optimized audit record analysis by setroubleshoot

Previously, new features introduced in setroubleshoot-3.3.23-1 had a negative impact on performance, which led to the AVC analysis being up to 8 times slower than before. This update provides optimizations that significantly reduce the AVC analysis times.

Fixed SELinux policy interface parser

Previously, the policy interface parser caused syntax error messages to appear when installing a custom policy that contained an ifndef block in its interface file. This update improves the interface file parsing, and thus resolves this issue.

setfiles does not stop on labeling error

Previously, the setfiles utility stopped whenever it failed to relabel a file. Consequently, mislabeled files were left in the target directory. With this update, setfiles skips files it cannot relabel, and as a result, setfiles processes all files in the target directory.

Rebuilds of the SELinux policy store are now more resistant to power failures

Previously, SELinux-policy rebuilds were not resistant to power failures due to write caching. Consequently, the SELinux policy store may become corrupted after a power failure during a policy rebuild. With this update, the libsemanage library writes all pending modifications to metadata and cached file data to the file system that contains the policy store before using it. As a result, the policy store is now more resistant to power failures and other interruptions.

libselinux now determines the default context of SELinux users correctly

Previously, the libselinux library failed to determine the default context of SELinux users on some systems, due to the use of the deprecated security_compute_user() function. As a consequence, some system services were unavailable on systems with complex security policies. With this update, libselinux no longer uses security_compute_user() and determines the SELinux user’s default context properly, regardless of policy complexity.

Geo-replication in rsync mode no longer fails due to SELinux

Previously, SELinux policy did not allow processes running under rsync_t to set the value of the security.trusted extended attribute. As a consequence, geo-replication in Red Hat Gluster Storage (RHGS) failed. This update includes the new SELinux boolean rsync_sys_admin that allows the rsync_t processes to set security.trusted. As a result, if the rsync_sys_admin boolean is enabled, rsync can set the security.trusted extended attribute and geo-replication no longer fails.

OpenSCAP can now scan systems with large numbers of files without running out of memory

Previously, when scanning systems with low RAM and large numbers of files, the OpenSCAP scanner sometimes caused the system to run out of memory. With this update, OpenSCAP scanner memory management has been improved. As a result, the scanner no longer runs out of memory on systems with low RAM when scanning large numbers of files, for example package groups Server with GUI and Workstation.

CIS-remediated systems with FAT no longer fail on boot

Previously, the Center for Internet Security (CIS) profile in the SCAP Security Guide (SSG) contained a rule which disabled loading of the kernel module responsible for access to FAT file systems. As a consequence, if SSG remediated this rule, the system could not access partitions formatted with FAT12, FAT16, and FAT32 file systems, including EFI System Partitions (ESP). This caused the systems to fail to boot. With this update, the rule has been removed from the profile. As a result, systems that use these file systems no longer fail to boot.

OVAL checks consider GPFS as remote

Previously, the OpenSCAP scanner did not identify mounted General Parallel File Systems (GPFS) as remote file systems (FS). As a consequence, OpenSCAP scanned GPFS even for OVAL checks that applied only to local systems. This sometimes caused the scanner to run out of resources and fail to complete the scan. With this update, GPFS has been included in the list of remote FS. As a result, OVAL checks correctly consider GPFS as a remote FS, and the scans are faster.

The fapolicyd-selinux SELinux policy now covers all file types

Previously, the fapolicyd-selinux SELinux policy did not cover all file types. Consequently, the fapolicyd service could not access files located on non-monitored locations such as sysfs. With this update, the fapolicyd service covers and analyzes all file system types.

fapolicyd no longer prevents RHEL updates

When an update replaces the binary of a running application, the kernel modifies the application binary path in memory by appending the (deleted) suffix. Previously, the fapolicyd file access policy daemon treated such applications as untrusted. As a consequence, fapolicyd prevented these applications from opening and executing any other files. With this update, fapolicyd ignores the suffix in the binary path so the binary can match the trust database. As a result, fapolicyd enforces the rules correctly and the update process can finish.

USBGuard rebased to 1.0.0-1

The usbguard packages have been rebased to the upstream version 1.0.0-1. This update provides improvements and bug fixes, most notably:

USBGuard now can send Audit messages

As part of service hardening, the capabilities of usbguard.service were limited while the CAP_AUDIT_WRITE capability was missing. As a consequence, usbguard running as a system service could not send Audit events. With this update, the service configuration has been updated, and as a result, USBGuard can send Audit messages.

tangd now handles invalid requests correctly

Previously, the tangd daemon returned an error exit code for some invalid requests. As a consequence, tangd.socket@.service failed, which in turn might have caused problems if the number of such failed units increased. With this update, tangd exits with an error code only when the tangd server itself is facing problems. As a result, tangd handles invalid requests correctly.

Migrating an iptables rule set from RHEL 7 to RHEL 8 with rules involving ipset lookups no longer fails

Previously, the ipset counters were updated only if all the additional constraints match while referring to an ipset command with enabled counters from an iptables rule set. Consequently, the rules involving ipset lookups, e.g. -m set --match-set xxx src --bytes-gt 100 will never get chance to match, because the member’s counter of ipset will not be added up. With this update, migrating an iptables rule set with rules involving ipset lookups works as expected.

The iptraf-ng no longer exposes raw memory content

Previously, when setting %p in a filter in iptraf-ng, the application displayed raw memory content in the status bar. Consequently, inessential information was getting displayed. With this update, the iptraf-ng processes do not show any raw memory content on the status bar at the bottom.

Network access is now available when using DHCP in the Anaconda ip boot option

The initial RAM disk (initrd) uses NetworkManager to manage networking. Previously, the dracut NetworkManager module provided by the RHEL 8.3 ISO file incorrectly assumed that the first field of the ip option in the Anaconda boot options was always set. As a consequence, if you used DHCP and set ip=::::<host_name>::dhcp, NetworkManager did not retrieve an IP address, and the network was not available in Anaconda. This problem has been fixed. As a result, the Anaconda ip boot option works as expected when you use the RHEL 8.4 ISO to install a host in the mentioned scenario.

Unloading XDP programs no longer fails on Netronome network cards that use the nfp driver

Previously, the nfp driver for Netronome network cards contained a bug. As a consequence, unloading eXpress Data Path (XDP) programs failed if you used such a card and loaded the XDP program using the IFLA_XDP_EXPECTED_FD feature with the XDP_FLAGS_REPLACE flag. For example, this affected XDP programs that were loaded using the libxdp library. This bug has been fixed. As a result, unloading an XDP program from Netronome network cards works as expected.

NetworkManager now tries to retrieve the host name using DHCP and reverse DNS lookups on all interfaces

Previously, if the host name was not set in the /etc/hostname file, NetworkManager tried to obtain the host name using DHCP or a reverse DNS lookup only through the interface with the default route with the lowest metric value. As a consequence, it was not possible to automatically assign a host name on networks without a default route. This update changes the behavior, and NetworkManager now first tries to retrieve the host name using the default route interface. If this process fails, NetworkManager tries other available interfaces. As a result, NetworkManager tries to retrieve the host name using DHCP and reverse DNS lookups on all interfaces if it is not set in /etc/hostname.

The kernel no longer returns false positive warnings on IBM Z systems

Previously, IBM Z systems on RHEL 8 were missing an allowed entry for the ZONE_DMA memory zone to allow user access. Consequently, the kernel returned false positive warnings such as:

RHEL systems boot as expected from the tboot GRUB entry

Previously, the tboot utility of version 1.9.12-2 caused some RHEL systems with Trusted Platform Module (TPM) 2.0 enabled to fail to boot in legacy mode. As a consequence, the system halted when it attempted to boot from the tboot Grand Unified Bootloader (GRUB) entry. With a new version of RHEL 8 and the update of the tboot utility, the problem has been fixed and RHEL systems boot as expected.

The kernel successfully reclaims memory in heavy-workload container scenarios

When a volume was constrained for I/O and memory within a container, the kernel code responsible for reclaiming memory experienced soft-lockup due to a data race condition. Data race is a phenomenon that happens if:

RHEL 8 with offline memory no longer causes kernel panics

Previously, when running RHEL 8 with memory that was initiated but marked as offline, the kernel in some cases attempted to access uninitialized memory pages. As a consequence, a kernel panic occurred. This update fixes the kernel mechanism for idle page tracking, which prevents the problem from occurring.

The NUMA systems no longer experience unexpected memory layout

Previously, ARM64 and S390 architectures experienced unexpected memory layouts on NUMA systems due to missing of the CONFIG_NODES_SPAN_OTHER_NODES option. As a consequence, the memory regions from different NUMA nodes intersected and the intersecting memory regions from low NUMA nodes were added into the high NUMA.

The rngd service no longer busy-waits on poll() system call

A new kernel entropy source for FIPS mode was added for kernels, starting with version 4.18.0-193.10. Consequently, the rngd service busy-waited on the poll() system call for the /dev/random device. This situation caused consumption of 100% of CPU time, when a system was in a FIPS mode. With this update, in FIPS mode, a poll() handler for the /dev/random device has been changed from a default one to a handler developed especially for the /dev/random device. As a result, the rngd service no longer busy-waits on poll() in the described scenario.

HRTICK support for SCHED_DEADLINE scheduler is enabled

Previously, the feature for high resolution system timers (HRTICK) was not armed for certain tasks configured with the SCHED_DEADLINE policy. Consequently, the throttling mechanism for these tasks using the SCHED_DEADLINE scheduler, consumed all the runtime configured for those tasks. This behavior caused an unexpected latency spike in the real-time environment.

tpm2-abrmd rebased to version 2.3.3.2

The tpm2-abrmd package has been upgraded to version 2.3.3.2, which provides multiple bug fixes. Notable changes include:

The cxgb4 driver no longer causes crash in the kdump kernel

Previously, the kdump kernel would crash while trying to save information in the vmcore file. Consequently, the cxgb4 driver prevented the kdump kernel from saving a core for later analysis. To work around this problem, add the novmcoredd parameter to the kdump kernel command line to allow saving core files.

Accessing SMB targets no longer fail with EREMOTE error

Previously, mounting a DFS namespace on a RHEL SMB client with the cifsacl mount option was inaccessible and a listing failed with an EREMOTE error. This update fixes the kernel to account for EREMOTE, and thus makes the SMB share accessible.

Performance improvements for NFS readdir function

Previously, a process on a NFS client listing a directory could take a long time to complete the listing, with possibility to never complete. With this update, the NFS client directory listing performance is improved in the following scenarios:

Default token timeout value in corosync.conf file increased from 1 second to 3 seconds

Previously, the TOTEM token timeout value in the corosync.conf file was set to 1 second. This short timeout makes the cluster react quickly but in the case of network delays it may result in premature failover. The default value is now set to 3 seconds to provide a better trade-off between quick response and broader applicability. For information on modifying the token timeout value, see How to change totem token timeout value in a RHEL 5, 6, 7, or 8 High Availability cluster?

An in-place upgrade is now possible when perl-Time-HiRes is installed

Previously, the perl-Time-HiRes package distributed in RHEL 8 was missing an epoch number that was included in the RHEL 7 version of the package. As a consequence, it was impossible to perform an in-place upgrade from RHEL 7 to RHEL 8 when perl-Time-HiRes was installed. The missing epoch number has been added, and the in-place upgrade no longer fails when perl-Time-HiRes is installed.

The glibc DNS stub resolver correctly processes parallel queries with identical transaction IDs

Prior to this update, the DNS stub resolver in the GNU C library glibc did not process responses to parallel queries with identical transaction IDs correctly. Consequently, when the transaction IDs were equal, the second parallel response was never matched to a query, resulting in a timeout and retry.

Reading configuration files with fgetsgent() and fgetsgent_r() is now more robust

Specifically structured entries in the /etc/gshadow file, or changes in file sizes while reading, sometimes caused the fgetsgent() and fgetsgent_r() functions to return invalid pointers. Consequently, applications that used these functions to read /etc/gshadow, or other configuration files in /etc/, failed with a segmentation fault error. This update modifies fgetsgent() and fgetsgent_r() to make reading of configuration files more robust. As a result, applications are now able to read configuration files successfully.

The glibc string functions now avoid negative impact on system cache on AMD64 and Intel 64 processors

Previously, the glibc implementation of string functions incorrectly estimated the amount of last-level cache available to a thread on the 64-bit AMD and Intel processors. As a consequence, calling the memcpy function on large buffers either negatively impacted the overall cache performance of the system or slowed down the memcpy system call.

The glibc dynamic loader now avoids certain failures of libc.so.6

Previously, when the libc.so.6 shared object ran as a main program (for example, to display the glibc version information), the glibc dynamic loader did not order relocation of libc.so.6 correctly in relation to the objects loaded using the LD_PRELOAD environment variable. Consequently, when LD_PRELOAD was set, invoking libc.so.6 sometimes caused libc.so.6 to terminate unexpectedly with a segmentation fault. This update fixes the bug, and the dynamic loader now correctly handles the relocation of libc.so.6. As a result, the described problem no longer occurs.

The glibc dynamic linker now restricts part of the static thread-local storage space to static TLS allocations

Previously, the glibc dynamic linker used all available static thread-local storage (TLS) space for dynamic TLS, on a first come, first served basis. Consequently, loading additional shared objects at run time using the dlopen function sometimes failed, because dynamic TLS allocations had already consumed all available static TLS space. This problem occurred particularly on the 64-bit ARM architecture and IBM Power Systems.

The glibc dynamic linker now disables lazy binding for the 64-bit ARM variant calling convention

Previously, the glibc dynamic linker did not disable lazy binding for functions using the 64-bit ARM (AArch64) variant calling convention. As a consequence, the dynamic linker corrupted arguments in such function calls, leading to incorrect results or process failures. With this update, the dynamic linker now disables lazy binding in the described scenario, and the function arguments are passed correctly.

gcc rebased to version 8.4

The GNU Compiler Collection (GCC) has been rebased to upstream version 8.4, which provides a number of bug fixes over the previous version.

The Samba wide links feature has been converted to a VFS module

Previously, the wide links parameter was part of the smbd service’s core functionality. Enabling this feature is insecure and, therefore, has been moved into a separate virtual file system (VFS) module named widelinks. For backward compatibility, Samba in RHEL 8.4 automatically loads this module for shares that have wide links = yes set in their configuration.

Network connection idle timeouts are no longer reported as resource errors

Previously, Directory Server reported a misleading error that a resource was temporarily unavailable when an idle network connection timed out. With this update, the error macro for network connection idle timeouts has been changed from EAGAIN to ETIMEDOUT, and an accurate error message describing a timeout is written to the Directory Server access logs.

Certificates issued by PKI ACME Responder connected to PKI CA no longer fail OCSP validation

Previously, the default ACME certificate profile provided by PKI CA contained a sample OCSP URL that did not point to an actual OCSP service. As a consequence, if PKI ACME Responder was configured to use a PKI CA issuer, the certificates issued by the responder could fail OCSP validation. This update removes hard-coded URLs in the ACME certificate profile and adds an upgrade script to fix the profile configuration file in case you did not customize it.

Display backlight now works reliably on recent Intel laptops

Certain recent laptops with Intel CPUs require a proprietary interface to control display backlight. Previously, RHEL did not support the proprietary interface, and attempted to use the VESA interface, which was unreliable on the laptops. As a consequence, RHEL could not control display backlight on those laptops.

tests_luks.yml no longer cause partition case fail with NVME disk

Previously, NVME disks used a different partition naming convention than the one used by virtio/scsi and the Storage role did not reflect it. As a consequence, running the Storage role with NVME disks resulted in a crash. With this fix, the Storage RHEL system role now obtains the partition name from the blivet module.

The selinux RHEL system role no longer uses variable named present

Previously, some tasks in the selinux RHEL system role were incorrectly using a variable named present instead of using the string present. As a consequence, the selinux RHEL system role returned an error informing that there is no variable named present. This update fixes this issue, changing those tasks to use the string present. As a result, the selinux RHEL system role works as expected, with no error message.

Logging output no longer fails when the rsyslog-gnutls package is missing

A global tls rsyslog-gnutls package is required when the logging RHEL system role is configured to provide secure remote input and secure forward output. Previously, thel tls rsyslog-gnutls package was changed to install unconditionally in the previous version. As a consequence, when the tls rsyslog-gnutls package was not available on the managed nodes, the logging role configuration failed, even if the secure remote input and secure forward output were not included as part of the configuration. This update fixes the issue by examining if the secure connection is configured and checking the global tls logging_pki_files variable. The rsyslog-gnutls package is installed only when the secure connection is configured. As a result, the operation to configure Red Hat Enterprise Virtualization Hypervisor to integrate elasticsearch as the logging output no longer fails with the missing rsyslog-gnutls package.

Connecting to the RHEL 8 guest console on a Windows Server 2019 host is no longer slowed down

Previously, when using RHEL 8 as a guest operating system in multi-user mode on a Windows Server 2019 host, connecting to a console output of the guest currently took significantly longer than expected. This update improves the performance of VRAM on the Hyper-V hypervisor, which fixes the problem.

Displaying multiple monitors of virtual machines that use Wayland is now possible with QXL

Previously, using the remote-viewer utility to display more than one monitor of a virtual machine (VM) that was using the Wayland display server caused the VM to become unresponsive and the Waiting for display status message to be displayed indefinitely. The underlying code has been fixed, which prevents the described problem from occurring.

GPU-optimized Azure instances now work correctly after hibernation

When running RHEL 8 as a guest operating system on a Microsoft Azure instance with GPU-optmized virtual machine (VM) size, such as NV6, resuming the VM from hibernation previously caused the VM’s GPU to work incorrectly. When this occurred, the kernel logged the following message:

The TX/RX packet counters increase as intended after virtual machines resume from hibernation

Previously, the TX/RX packet counters stopped increasing when a RHEL 8 virtual machine using a CX4 VF NIC resumed from hibernation on Microsoft Azure. This update resolves the issue, and the packet counters increase as intended.

RHEL 8 virtual machines no longer fail to resume from hibernation on Azure

Previously, the GUID of the virtual function (VF), vmbus device, changed when a RHEL 8 virtual machine (VM), with SR-IOV enabled, was hibernated and deallocated on Microsoft Azure. Consequently, when the VM was restarted, it failed to resume and terminated unexpectedly. With this update, the vmbus device VF no longer changes, and the VM resumes from hibernation successfully.

Removed a redundant error message in Hyper-V and KVM guests

Previously, when a RHEL 8 guest operating system was running in a KVM or Hyper-V virtual machine, the following error message was reported in the /var/log/messages file:

podman system connection add automatically set the default connection

Previously, the podman system connection add command did not automatically set the first connection to be the default connection. As a consequence, you must manually run the podman system connection default <connection_name> command to set the default connection. With this update, the podman system connection add command works as expected.

The podman run --pid=host works in a rootless mode

Previously, running the podman run --pid=host command as a rootless user did not work. Consequently, an OCI permission error occurred:

Red Hat Connector available as a Technology Preview

You can now connect to a RHEL system with a single command to consume Red Hat Insights and your subscription content. Available as a Technology Preview in Red Hat Enterprise Linux 8.4, the Red Hat connector (rhc) CLI unifies the registration experience and eliminates the need to separately run the subscription-manager and insights-client commands to connect to Red Hat. With Red Hat connector and a Smart Management subscription, you can also remediate issues directly from the cloud.

Introducing bareudp device support for encapsulating MPLS traffic over UDP tunnel as a Technology Preview

The support for bareudp devices is now available with the ip link command as a Technology Preview. The bareudp devices provide L3 encapsulation tunnelling support for routing traffic with different L3 protocols, such as unicast and multicast multi protocol label switching (MPLS) and IPv4/IPv6 inside the UDP tunnel. You can start routing MPLS packets in UDP with the help of adding tc filters and actions.

AF_XDP available as a Technology Preview

Address Family eXpress Data Path (AF_XDP) socket is designed for high-performance packet processing. It accompanies XDP and grants efficient redirection of programmatically selected packets to user space applications for further processing.

KTLS available as a Technology Preview

In Red Hat Enterprise Linux 8, Kernel Transport Layer Security (KTLS) is provided as a Technology Preview. KTLS handles TLS records using the symmetric encryption or decryption algorithms in the kernel for the AES-GCM cipher. KTLS also provides the interface for offloading TLS record encryption to Network Interface Controllers (NICs) that support this functionality.

XDP features that are available as Technology Preview

Red Hat provides the usage of the following eXpress Data Path (XDP) features as unsupported Technology Preview:

Multi-protocol Label Switching for TC available as a Technology Preview

The Multi-protocol Label Switching (MPLS) is an in-kernel data-forwarding mechanism to route traffic flow across enterprise networks. In an MPLS network, the router that receives packets decides the further route of the packets based on the labels attached to the packet. With the usage of labels, the MPLS network has the ability to handle packets with particular characteristics. For example, you can add tc filters for managing packets received from specific ports or carrying specific types of traffic, in a consistent way.

act_mpls module available as a Technology Preview

The act_mpls module is now available in the kernel-modules-extra rpm as a Technology Preview. The module allows the application of Multiprotocol Label Switching (MPLS) actions with Traffic Control (TC) filters, for example, push and pop MPLS label stack entries with TC filters. The module also allows the Label, Traffic Class, Bottom of Stack, and Time to Live fields to be set independently.

Improved Multipath TCP support is available as a Technology Preview

Multipath TCP (MPTCP) improves resource usage within the network and resilience to network failure. For example, with Multipath TCP on the RHEL server, smartphones with MPTCP v1 enabled can connect to an application running on the server and switch between Wi-Fi and cellular networks without interrupting the connection to the server.

The systemd-resolved service is now available as a Technology Preview

The systemd-resolved service provides name resolution to local applications. The service implements a caching and validating DNS stub resolver, an Link-Local Multicast Name Resolution (LLMNR), and Multicast DNS resolver and responder.

The nispor package is now available as a Technology Preview

The nispor package is now available as a Technology Preview, which is a unified interface for Linux network state querying. It provides a unified way to query all running network status through the python and C api, and rust crate. nispor works as the dependency in the nmstate tool.

The kexec fast reboot feature is available as Technology Preview

The kexec fast reboot feature continues to be available as a Technology Preview. kexec fast reboot significantly speeds the boot process by allowing the kernel to boot directly into the second kernel without passing through the Basic Input/Output System (BIOS) first. To use this feature:

The accel-config package available as a Technology Preview

The accel-config package is now available on Intel EM64T and AMD64 architectures for RHEL 8.4 as a Technology Preview. This package helps in controlling and configuring data-streaming accelerator (DSA) sub-system in the Linux Kernel. Also, it configures devices via sysfs (pseudo-filesystem), saves and loads the configuration in the json format.

SGX available as a Technology Preview

Software Guard Extensions (SGX) is an Intel® technology for protecting software code and data from disclosure and modification. This release initiates the kernel support for SGX v1 and v1.5. The version 1 enables platforms using the Flexible Launch Control mechanism to use the SGX technology.

eBPF available as a Technology Preview

Extended Berkeley Packet Filter (eBPF) is an in-kernel virtual machine that allows code execution in the kernel space, in the restricted sandbox environment with access to a limited set of functions.

The data streaming accelerator driver for kernel is available as a Technology Preview

The data streaming accelerator (DSA) driver for the kernel is currently available as a Technology Preview. DSA is an Intel CPU integrated accelerator and supports a shared work queue with process address space ID (pasid) submission and shared virtual memory (SVM).

Soft-RoCE available as a Technology Preview

Remote Direct Memory Access (RDMA) over Converged Ethernet (RoCE) is a network protocol which implements RDMA over Ethernet. Soft-RoCE is the software implementation of RoCE which supports two protocol versions, RoCE v1 and RoCE v2. The Soft-RoCE driver, rdma_rxe, is available as an unsupported Technology Preview in RHEL 8.

NVMe/TCP is available as a Technology Preview

Accessing and sharing Nonvolatile Memory Express (NVMe) storage over TCP/IP networks (NVMe/TCP) and its corresponding nvme-tcp.ko and nvmet-tcp.ko kernel modules have been added as a Technology Preview.

File system DAX is now available for ext4 and XFS as a Technology Preview

In Red Hat Enterprise Linux 8, file system DAX is available as a Technology Preview. DAX provides a means for an application to directly map persistent memory into its address space. To use DAX, a system must have some form of persistent memory available, usually in the form of one or more Non-Volatile Dual In-line Memory Modules (NVDIMMs), and a file system that supports DAX must be created on the NVDIMM(s). Also, the file system must be mounted with the dax mount option. Then, an mmap of a file on the dax-mounted file system results in a direct mapping of storage into the application’s address space.

OverlayFS

OverlayFS is a type of union file system. It enables you to overlay one file system on top of another. Changes are recorded in the upper file system, while the lower file system remains unmodified. This allows multiple users to share a file-system image, such as a container or a DVD-ROM, where the base image is on read-only media.

Stratis is now available as a Technology Preview

Stratis is a new local storage manager. It provides managed file systems on top of pools of storage with additional features to the user.

IdM now supports setting up a Samba server on an IdM domain member as a Technology Preview

With this update, you can now set up a Samba server on an Identity Management (IdM) domain member. The new ipa-client-samba utility provided by the same-named package adds a Samba-specific Kerberos service principal to IdM and prepares the IdM client. For example, the utility creates the /etc/samba/smb.conf with the ID mapping configuration for the sss ID mapping back end. As a result, administrators can now set up Samba on an IdM domain member.

Local mode version of pcs cluster setup command available as a Technology Preview

By default, the pcs cluster setup command automatically synchronizes all configuration files to the cluster nodes. Since Red Hat Enterprise Linux 8.3, the pcs cluster setup command provides the --corosync-conf option as a Technology Preview. Specifying this option switches the command to local mode. In this mode, pcs creates a corosync.conf file and saves it to a specified file on the local node only, without communicating with any other node. This allows you to create a corosync.conf file in a script and handle that file by means of the script.

Pacemaker podman bundles available as a Technology Preview

Pacemaker container bundles now run on Podman, with the container bundle feature being available as a Technology Preview. There is one exception to this feature being Technology Preview: Red Hat fully supports the use of Pacemaker bundles for Red Hat Openstack.

Heuristics in corosync-qdevice available as a Technology Preview

Heuristics are a set of commands executed locally on startup, cluster membership change, successful connect to corosync-qnetd, and, optionally, on a periodic basis. When all commands finish successfully on time (their return error code is zero), heuristics have passed; otherwise, they have failed. The heuristics result is sent to corosync-qnetd where it is used in calculations to determine which partition should be quorate.

New fence-agents-heuristics-ping fence agent

As a Technology Preview, Pacemaker now supports the fence_heuristics_ping agent. This agent aims to open a class of experimental fence agents that do no actual fencing by themselves but instead exploit the behavior of fencing levels in a new way.

Identity Management JSON-RPC API available as Technology Preview

An API is available for Identity Management (IdM). To view the API, IdM also provides an API browser as a Technology Preview.

DNSSEC available as Technology Preview in IdM

Identity Management (IdM) servers with integrated DNS now support DNS Security Extensions (DNSSEC), a set of extensions to DNS that enhance security of the DNS protocol. DNS zones hosted on IdM servers can be automatically signed using DNSSEC. The cryptographic keys are automatically generated and rotated.

ACME available as a Technology Preview

The Automated Certificate Management Environment (ACME) service is now available in Identity Management (IdM) as a Technology Preview. ACME is a protocol for automated identifier validation and certificate issuance. Its goal is to improve security by reducing certificate lifetimes and avoiding manual processes from certificate lifecycle management.

GNOME for the 64-bit ARM architecture available as a Technology Preview

The GNOME desktop environment is now available for the 64-bit ARM architecture as a Technology Preview. This enables administrators to configure and manage servers from a graphical user interface (GUI) remotely, using the VNC session.

GNOME desktop on IBM Z is available as a Technology Preview

The GNOME desktop, including the Firefox web browser, is now available as a Technology Preview on the IBM Z architecture. You can now connect to a remote graphical session running GNOME using VNC to configure and manage your IBM Z servers.

VNC remote console available as a Technology Preview for the 64-bit ARM architecture

On the 64-bit ARM architecture, the Virtual Network Computing (VNC) remote console is available as a Technology Preview. Note that the rest of the graphics stack is currently unverified for the 64-bit ARM architecture.

Intel Tiger Lake graphics available as a Technology Preview

Intel Tiger Lake UP3 and UP4 Xe graphics are now available as a Technology Preview.

HA Cluster RHEL system role available as a Technology Preview

The High Availability Cluster (HA Cluster) role is now available as a Technology Preview. Currently, the following notable configurations are available:

The postfix role of RHEL system roles available as a Technology Preview

Red Hat Enterprise Linux system roles provides a configuration interface for Red Hat Enterprise Linux subsystems, which makes system configuration easier through the inclusion of Ansible Roles. This interface enables managing system configurations across multiple versions of Red Hat Enterprise Linux, as well as adopting new major releases.

KVM virtualization is usable in RHEL 8 Hyper-V virtual machines

As a Technology Preview, nested KVM virtualization can now be used on the Microsoft Hyper-V hypervisor. As a result, you can create virtual machines on a RHEL 8 guest system running on a Hyper-V host.

AMD SEV for KVM virtual machines

As a Technology Preview, RHEL 8 provides the Secure Encrypted Virtualization (SEV) feature for AMD EPYC host machines that use the KVM hypervisor. If enabled on a virtual machine (VM), SEV encrypts VM memory so that the host cannot access data on the VM. This increases the security of the VM if the host is successfully infected by malware.

Intel vGPU

As a Technology Preview, it is now possible to divide a physical Intel GPU device into multiple virtual devices referred to as mediated devices. These mediated devices can then be assigned to multiple virtual machines (VMs) as virtual GPUs. As a result, these VMs share the performance of a single physical Intel GPU.

Creating nested virtual machines

Nested KVM virtualization is provided as a Technology Preview for KVM virtual machines (VMs) running on Intel, AMD64, and IBM Z systems hosts with RHEL 8. With this feature, a RHEL 7 or RHEL 8 VM that runs on a physical RHEL 8 host can act as a hypervisor, and host its own VMs.

Select Intel network adapters now support SR-IOV in RHEL guests on Hyper-V

As a Technology Preview, Red Hat Enterprise Linux guest operating systems running on a Hyper-V hypervisor can now use the single-root I/O virtualization (SR-IOV) feature for Intel network adapters supported by the ixgbevf and iavf drivers. This feature is enabled when the following conditions are met:

ESXi hypervisor and SEV-ES available as a Technology Preview for RHEL VMs

As a Technology Preview, in RHEL 8.4 and later, you can enable the AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES) to secure RHEL virtual machines (VMs) on VMware’s ESXi hypervisor, versions 7.0.2 and later.

CNI plugins are available in Podman as a Technology Preview

CNI plugins are now available to use in Podman rootless mode as a Technology Preview. To enable this feature, users are required to build their own rootless CNI infrastructure container image.

The crun is available as a Technology Preview

The crun OCI runtime is now available for the container-tools:rhel8 module as a Technology Preview. The crun container runtime supports an annotation that allows the container to access the rootless user’s additional groups. This is useful for volume mounting in a directory where setgid is set, or where the user only has group access. Currently, neither the crun or runc runtimes fully support cgroupsv2.

A podman container image is available as a Technology Preview

The registry.redhat.io/rhel8/podman container image is a containerized implementation of the podman package. The podman tool is used for managing containers and images, volumes mounted into those containers, and pods made of groups of containers.

The podman-machine command is unsupported

The podman-machine command for managing virtual machines, is available only as a Technology Preview. Instead, run Podman directly from the command line.

Several Kickstart commands and options have been deprecated

Using the following commands and options in RHEL 8 Kickstart files will print a warning in the logs.

The --interactive option of the ignoredisk Kickstart command has been deprecated

Using the --interactive option in future releases of Red Hat Enterprise Linux will result in a fatal installation error. It is recommended that you modify your Kickstart file to remove the option.

The Kickstart autostep command has been deprecated

The autostep command has been deprecated. The related section about this command has been removed from the RHEL 8 documentation.

lorax-composer back end for Image Builder is deprecated in RHEL 8

The previous back end lorax-composer for Image Builder is considered deprecated. It will only receive select fixes for the rest of the Red Hat Enterprise Linux 8 life cycle and will be omitted from future major releases.  Red Hat recommends that you uninstall lorax-composer the and install osbuild-composer back end instead.

rpmbuild --sign is deprecated

With this update, the rpmbuild --sign command has become deprecated. Using this command in future releases of Red Hat Enterprise Linux can result in an error. It is recommended that you use the rpmsign command instead.

The OpenEXR component has been deprecated

The OpenEXR component has been deprecated. Hence, the support for the EXR image format has been dropped from the imagecodecs module.

Metalink support for curl has been disabled.

A flaw was found in curl functionality in the way it handles credentials and file hash mismatch for content downloaded using the Metalink. This flaw allows malicious actors controlling a hosting server to:

NSS SEED ciphers are deprecated

The Mozilla Network Security Services (NSS) library will not support TLS cipher suites that use a SEED cipher in a future release. To ensure smooth transition of deployments that rely on SEED ciphers when NSS removes support, Red Hat recommends enabling support for other cipher suites.

TLS 1.0 and TLS 1.1 are deprecated

The TLS 1.0 and TLS 1.1 protocols are disabled in the DEFAULT system-wide cryptographic policy level. If your scenario, for example, a video conferencing application in the Firefox web browser, requires using the deprecated protocols, switch the system-wide cryptographic policy to the LEGACY level:

DSA is deprecated in RHEL 8

The Digital Signature Algorithm (DSA) is considered deprecated in Red Hat Enterprise Linux 8. Authentication mechanisms that depend on DSA keys do not work in the default configuration. Note that OpenSSH clients do not accept DSA host keys even in the LEGACY system-wide cryptographic policy level.

SSL2 Client Hello has been deprecated in NSS

The Transport Layer Security (TLS) protocol version 1.2 and earlier allow to start a negotiation with a Client Hello message formatted in a way that is backward compatible with the Secure Sockets Layer (SSL) protocol version 2. Support for this feature in the Network Security Services (NSS) library has been deprecated and it is disabled by default.

TPM 1.2 is deprecated

The Trusted Platform Module (TPM) secure cryptoprocessor standard version was updated to version 2.0 in 2016. TPM 2.0 provides many improvements over TPM 1.2, and it is not backward compatible with the previous version. TPM 1.2 is deprecated in RHEL 8, and it might be removed in the next major release.

Runtime disabling SELinux using /etc/selinux/config is now deprecated

Runtime disabling SELinux using the SELINUX=disabled option in the /etc/selinux/config file has been deprecated. In RHEL 9, when you disable SELinux only through /etc/selinux/config, the system starts with SELinux enabled but with no policy loaded.

ipa SELinux module removed from selinux-policy

The ipa SELinux module has been removed from the selinux-policy package, because it is no longer maintained. The functionality is now included in the ipa-selinux subpackage. If you need to use types or interfaces from the ipa module in a local SELinux policy, install the ipa-selinux package.

Network scripts are deprecated in RHEL 8

Network scripts are deprecated in Red Hat Enterprise Linux 8 and they are no longer provided by default. The basic installation provides a new version of the ifup and ifdown scripts which call the NetworkManager service through the nmcli tool. In Red Hat Enterprise Linux 8, to run the ifup and the ifdown scripts, NetworkManager must be running.

The dropwatch tool is deprecated

The dropwatch tool has been deprecated. The tool will not be supported in future releases. Thus the tool is not recommended for new deployments As a replacement of this package, Red Hat recommends to use the perf command line tool.

The term slaves is deprecated in the nmstate API

Red Hat is committed to using conscious language. Therefore the slaves term is deprecated in the Nmstate API. Use the term port when you use nmstatectl.

Installing RHEL for Real Time 8 using diskless boot is now deprecated

Diskless booting allows multiple systems to share a root file system via the network. While convenient, diskless boot is prone to introducing network latency in realtime workloads. With a future minor update of RHEL for Real Time 8, the diskless booting feature will no longer be supported.

The rdma_rxe Soft-RoCE driver is deprecated

Software Remote Direct Memory Access over Converged Ethernet (Soft-RoCE), also known as RXE, is a feature that emulates Remote Direct Memory Access (RDMA). In RHEL 8, the Soft-RoCE feature is available as an unsupported Technology Preview. However, due to stability issues, this feature has been deprecated and will be removed in RHEL 9.

The Linux firewire sub-system and its associated user-space components are deprecated in RHEL 8

The firewire sub-system provides interfaces to use and maintain any resources on the IEEE 1394 bus. In RHEL 9, firewire will no longer be supported in the kernel package.

The elevator kernel command line parameter is deprecated

The elevator kernel command line parameter was used in earlier RHEL releases to set the disk scheduler for all devices. In RHEL 8, the parameter is deprecated.

LVM mirror is deprecated

The LVM mirror segment type is now deprecated. Support for mirror will be removed in a future major release of RHEL.

peripety is deprecated

The peripety package is deprecated since RHEL 8.3.

VDO write modes other than async are deprecated

VDO supports several write modes in RHEL 8:

NFSv3 over UDP has been disabled

The NFS server no longer opens or listens on a User Datagram Protocol (UDP) socket by default. This change affects only NFS version 3 because version 4 requires the Transmission Control Protocol (TCP).

cramfs has been deprecated

Due to lack of users, the cramfs kernel module is deprecated. squashfs is recommended as an alternative solution.

pcs commands that support the clufter tool have been deprecated

The pcs commands that support the clufter tool for analyzing cluster configuration formats have been deprecated. These commands now print a warning that the command has been deprecated and sections related to these commands have been removed from the pcs help display and the pcs(8) man page.

The gdb.i686 packages are deprecated

In RHEL 8.1, the 32-bit versions of the GNU Debugger (GDB), gdb.i686, were shipped due to a dependency problem in another package. Because RHEL 8 does not support 32-bit hardware, the gdb.i686 packages are deprecated since RHEL 8.4. The 64-bit versions of GDB, gdb.x86_64, are fully capable of debugging 32-bit applications.

libdwarf has been deprecated

The libdwarf library has been deprecated in RHEL 8. The library will likely not be supported in future major releases. Instead, use the elfutils and libdw libraries for applications that wish to process ELF/DWARF files.

openssh-ldap has been deprecated

The openssh-ldap subpackage has been deprecated in Red Hat Enterprise Linux 8 and will be removed in RHEL 9. As the openssh-ldap subpackage is not maintained upstream, Red Hat recommends using SSSD and the sss_ssh_authorizedkeys helper, which integrate better with other IdM solutions and are more secure.

DES and 3DES encryption types have been removed

Due to security reasons, the Data Encryption Standard (DES) algorithm has been deprecated and disabled by default since RHEL 7. With the recent rebase of Kerberos packages, single-DES (DES) and triple-DES (3DES) encryption types have been removed from RHEL 8.

Standalone use of the ctdb service has been deprecated

As of RHEL 8.4, customers are advised to use the ctdb clustered Samba service only when both of the following conditions apply:

Running Samba as a PDC or BDC is deprecated

The classic domain controller mode that enabled administrators to run Samba as an NT4-like primary domain controller (PDC) and backup domain controller (BDC) is deprecated. The code and settings to configure these modes will be removed in a future Samba release.

The SSSD version of libwbclient has been deprecated

The SSSD implementation of the libwbclient package was added to allow the Samba smbd service to retrieve user and group information from AD without the need to run the winbind service. As Samba now requires that the winbind service is running and handling communication with AD, the related code has been removed from smdb for security reasons. As this additional required functionality is not part of SSSD and the SSSD implementation of libwbclient cannot be used with recent versions of Samba, the SSSD implementation of libwbclient is being deprecated.

The SMB1 protocol is deprecated in Samba

Starting with Samba 4.11, the insecure Server Message Block version 1 (SMB1) protocol is deprecated and will be removed in a future release.

The libgnome-keyring library has been deprecated

The libgnome-keyring library has been deprecated in favor of the libsecret library, as libgnome-keyring is not maintained upstream, and does not follow the necessary cryptographic policies for RHEL. The new libsecret library is the replacement that follows the necessary security standards.

AGP graphics cards are no longer supported

Graphics cards using the Accelerated Graphics Port (AGP) bus are not supported in Red Hat Enterprise Linux 8. Use the graphics cards with PCI-Express bus as the recommended replacement.

The web console no longer supports incomplete translations

The RHEL web console no longer provides translations for languages that have translations available for less than 50 % of the Console’s translatable strings. If the browser requests translation to such a language, the user interface will be in English instead.

The geoipupdate package has been deprecated

The geoipupdate package requires a third-party subscription and it also downloads proprietary content. Therefore, the geoipupdate package has been deprecated, and will be removed in the next major RHEL version.

SPICE has been deprecated

The SPICE remote display protocol has become deprecated. As a result, SPICE will remain supported in RHEL 8, but Red Hat recommends using alternate solutions for remote display streaming:

virt-manager has been deprecated

The Virtual Machine Manager application, also known as virt-manager, has been deprecated. The RHEL 8 web console, also known as Cockpit, is intended to become its replacement in a subsequent release. It is, therefore, recommended that you use the web console for managing virtualization in a GUI. Note, however, that some features available in virt-manager may not be yet available the RHEL 8 web console.

Virtual machine snapshots are not properly supported in RHEL 8

The current mechanism of creating virtual machine (VM) snapshots has been deprecated, as it is not working reliably. As a consequence, it is recommended not to use VM snapshots in RHEL 8.

The Cirrus VGA virtual GPU type has been deprecated

With a future major update of Red Hat Enterprise Linux, the Cirrus VGA GPU device will no longer be supported in KVM virtual machines. Therefore, Red Hat recommends using the stdvga or virtio-vga devices instead of Cirrus VGA.

KVM on IBM POWER has been deprecated

Using KVM virtualization on IBM POWER hardware has become deprecated. As a result, KVM on IBM POWER is still supported in RHEL 8, but will become unsupported in a future major release of RHEL.

SecureBoot image verification using SHA1-based signatures is deprecated

Performing SecureBoot image verification using SHA1-based signatures on UEFI (PE/COFF) executables has become deprecated.

The Podman varlink-based API v1.0 has been removed

The Podman varlink-based API v1.0 was deprecated in a previous release of RHEL 8. Podman v2.0 introduced a new Podman v2.0 RESTful API. With the release of Podman v3.0, the varlink-based API v1.0 has been completely removed.

container-tools:1.0 has been deprecated

The container-tools:1.0 module has been deprecated and will no longer receive security updates. It is recommended to use a newer supported stable module stream, such as container-tools:2.0 or container-tools:3.0.

The auth and authconfig Kickstart commands require the AppStream repository

The authselect-compat package is required by the auth and authconfig Kickstart commands during installation. Without this package, the installation fails if auth or authconfig are used. However, by design, the authselect-compat package is only available in the AppStream repository.

The reboot --kexec and inst.kexec commands do not provide a predictable system state

Performing a RHEL installation with the reboot --kexec Kickstart command or the inst.kexec kernel boot parameters do not provide the same predictable system state as a full reboot. As a consequence, switching to the installed system without rebooting can produce unpredictable results.

Network access is not enabled by default in the installation program

Several installation features require network access, for example, registration of a system using the Content Delivery Network (CDN), NTP server support, and network installation sources. However, network access is not enabled by default, and as a result, these features cannot be used until network access is enabled.

The USB CD-ROM drive is not available as an installation source in Anaconda

Installation fails when the USB CD-ROM drive is the source for it and the Kickstart ignoredisk --only-use= command is specified. In this case, Anaconda cannot find and use this source disk.

Anaconda does not show encryption for a custom partition

The Encrypt my data radio button is not available when you choose the Custom partitioning during the system installation. As a result, your data is not encrypted when installation is complete.

Installation program attempts automatic partitioning when no partitioning scheme is specified in the Kickstart file

When using a Kickstart file to perform an automated installation, the installation program attempts to perform automatic partitioning even when you do not specify any partitioning commands in the Kickstart file. The installation program behaves as if the autopart command was used in the Kickstart file, resulting in unexpected partitions. To work around this problem, use the reqpart command in the Kickstart file so that you can interactively configure manual partitioning.

The new osbuild-composer back end does not replicate the blueprint state from lorax-composer on upgrades

Image Builder users that are upgrading from the lorax-composer back end to the new osbuild-composer back end, blueprints can disappear. As a result, once the upgrade is complete, the blueprints do not display automatically. To work around this problem, perform the following steps.

Adding the same username in both blueprint and Kickstart files causes Edge image installation to fail

To install a RHEL for Edge image, users must create a blueprint to build a rhel-edge-container image and also create a Kickstart file to install the RHEL for Edge image. When a user adds the same username, password, and SSH key in both the blueprint and the Kickstart file, the RHEL for Edge image installation fails. Currently, there is no workaround.

GUI installation might fail if an attempt to unregister using the CDN is made before the repository refresh is completed

Since RHEL 8.2, when registering your system and attaching subscriptions using the Content Delivery Network (CDN), a refresh of the repository metadata is started by the GUI installation program. The refresh process is not part of the registration and subscription process, and as a consequence, the Unregister button is enabled in the Connect to Red Hat window. Depending on the network connection, the refresh process might take more than a minute to complete. If you click the Unregister button before the refresh process is completed, the GUI installation might fail as the unregister process removes the CDN repository files and the certificates required by the installation program to communicate with the CDN.

Registration fails for user accounts that belong to multiple organizations

Currently, when you attempt to register a system with a user account that belongs to multiple organizations, the registration process fails with the error message You must specify an organization for new units.

Red Hat Insights client fails to register the operating system when using the graphical installer

Currently, the installation fails with an error at the end, which points to the Insights client.

Installation with autopart utility fails with inconsistent disk sector sizes

Installing RHEL using autopart with multiple inconsistent disk sector sizes fails. As a workaround, use a plain partitioning scheme, for example autopart --type=plain, instead of the default LVM scheme. Another option is to try re-configuring sector sizes, for example by running hdparm --set-sector-size=<SIZE> <DEVICE>.

The GRUB retries to access the disk after initial failures during boot

Sometimes, Storage Area Networks (SANs) fail to acknowledge the open and read disk calls. Previously, the GRUB tool used to enter into the grub_rescue prompt resulting in the boot failure. With this update, GRUB retries to access the disk up to 20 times after the initial call to open and read the disk fails. If the GRUB tool is still unable to open or read the disk after these attempts, it will enter into the grub_rescue mode.

IBM Power systems with HASH MMU mode fail to boot with memory allocation failures

IBM Power Systems with HASH memory allocation unit (MMU) mode support kdump up to a maximum of 192 cores. Consequently, the system fails to boot with memory allocation failures if kdump is enabled on more than 192 cores. This limitation is due to RMA memory allocations during early boot in HASH MMU mode. To work around this problem, use the Radix MMU mode with fadump enabled instead of using kdump.

Unable to rebuild grub.cfg by using grub2-mkconfig on rhel-guest-image-8.4 images

The rhel-guest-image-8.4 type does not contain the entry 'GRUB_DEFAULT=saved' entry in the /etc/default/grub file. As a consequence, if you install a new kernel and rebuild the grub using the grub2-mkconfig -o /boot/grub2/grub.cfg command, after reboot, the system will not boot up with the new kernel. To work around this issue, you can append the GRUB_DEFAULT=saved to the /etc/default/grub file. As a result, the system should boot up with the new kernel.

syspurpose addons have no effect on the subscription-manager attach --auto output.

In Red Hat Enterprise Linux 8, four attributes of the syspurpose command-line tool have been added: role,usage, service_level_agreement and addons. Currently, only role, usage and service_level_agreement affect the output of running the subscription-manager attach --auto command. Users who attempt to set values to the addons argument will not observe any effect on the subscriptions that are auto-attached.

Postfix TLS fingerprint algorithm in the FIPS mode needs to be changed to SHA-256

By default in RHEL 8, postfix uses MD5 fingerprints with the TLS for backward compatibility. But in the FIPS mode, the MD5 hashing function is not available, which may cause TLS to incorrectly function in the default postfix configuration. To workaround this problem, the hashing function needs to be changed to SHA-256 in the postfix configuration file.

Users can run sudo commands as locked users

In systems where sudoers permissions are defined with the ALL keyword, sudo users with permissions can run sudo commands as users whose accounts are locked. Consequently, locked and expired accounts can still be used to execute commands.

libselinux-python is available only through its module

The libselinux-python package contains only Python 2 bindings for developing SELinux applications and it is used for backward compatibility. For this reason, libselinux-python is no longer available in the default RHEL 8 repositories through the dnf install libselinux-python command.

udica processes UBI 8 containers only when started with --env container=podman

The Red Hat Universal Base Image 8 (UBI 8) containers set the container environment variable to the oci value instead of the podman value. This prevents the udica tool from analyzing a container JavaScript Object Notation (JSON) file.

Negative effects of the default logging setup on performance

The default logging environment setup might consume 4 GB of memory or even more and adjustments of rate-limit values are complex when systemd-journald is running with rsyslog.

File permissions of /etc/passwd- are not aligned with the CIS RHEL 8 Benchmark 1.0.0

Because of an issue with the CIS Benchmark, the remediation of the SCAP rule that ensures permissions on the /etc/passwd- backup file configures permissions to 0644. However, the CIS Red Hat Enterprise Linux 8 Benchmark 1.0.0 requires file permissions 0600 for that file. As a consequence, the file permissions of /etc/passwd- are not aligned with the benchmark after remediation.

SELINUX=disabled in /etc/selinux/config does not work properly

Disabling SELinux using the SELINUX=disabled option in the /etc/selinux/config results in a process in which the kernel boots with SELinux enabled and switches to disabled mode later in the boot process. This might cause memory leaks.

crypto-policies incorrectly allow Camellia ciphers

The RHEL 8 system-wide cryptographic policies should disable Camellia ciphers in all policy levels, as stated in the product documentation. However, the Kerberos protocol enables the ciphers by default.

Connections to servers with SHA-1 signatures do not work with GnuTLS

SHA-1 signatures in certificates are rejected by the GnuTLS secure communications library as insecure. Consequently, applications that use GnuTLS as a TLS backend cannot establish a TLS connection to peers that offer such certificates. This behavior is inconsistent with other system cryptographic libraries.

Libreswan ignores the leftikeport and rightikeport options

Libreswan ignores the leftikeport and rightikeport options in any host-to-host Libreswan connections. As a consequence, Libreswan uses the default ports regardless of leftikeport and rightikeport settings. No workaround is available at the moment.

Using multiple labeled IPsec connections with IKEv2 do not work correctly

When Libreswan uses the IKEv2 protocol, security labels for IPsec do not work correctly for more than one connection. As a consequence, Libreswan using labeled IPsec can establish only the first connection, but cannot establish subsequent connections correctly. To use more than one connection, use the IKEv1 protocol.

OpenSSL in FIPS mode accepts only specific D-H parameters

In FIPS mode, TLS clients that use OpenSSL return a bad dh value error and abort TLS connections to servers that use manually generated parameters. This is because OpenSSL, when configured to work in compliance with FIPS 140-2, works only with Diffie-Hellman parameters compliant to NIST SP 800-56A rev3 Appendix D (groups 14, 15, 16, 17, and 18 defined in RFC 3526 and with groups defined in RFC 7919). Also, servers that use OpenSSL ignore all other parameters and instead select known parameters of similar size. To work around this problem, use only the compliant groups.

Smart-card provisioning process through OpenSC pkcs15-init does not work properly

The file_caching option is enabled in the default OpenSC configuration, and the file caching functionality does not handle some commands from the pkcs15-init tool properly. Consequently, the smart-card provisioning process through OpenSC fails.

systemd cannot execute commands from arbitrary paths

The systemd service cannot execute commands from /home/user/bin arbitrary paths because the SELinux policy package does not include any such rule. Consequently, the custom services that are executed on non-system paths fail and eventually log the Access Vector Cache (AVC) denial audit messages when SELinux denied access. To work around this problem, do one of the following:

selinux-policy prevents IPsec from working over TCP

The libreswan package in RHEL 8.4 supports IPsec-based VPNs using TCP encapsulation. However, the selinux-policy package does not reflect this update. As a consequence, when you set Libreswan to use TCP, the ipsec service fails to bind to the given TCP port.

Installation with the Server with GUI or Workstation software selections and CIS security profile is not possible

The CIS security profile is not compatible with the Server with GUI and Workstation software selections. As a consequence, a RHEL 8 installation with the Server with GUI software selection and CIS profile is not possible. An attempted installation using the CIS profile and either of these software selections will generate the error message:

rpm_verify_permissions fails in the CIS profile

The rpm_verify_permissions rule compares file permissions to package default permissions. However, the Center for Internet Security (CIS) profile, which is provided by the scap-security-guide packages, changes some file permissions to be more strict than default. As a consequence, verification of certain files using rpm_verify_permissions fails.

Kickstart uses org_fedora_oscap instead of com_redhat_oscap in RHEL 8

The Kickstart references the Open Security Content Automation Protocol (OSCAP) Anaconda add-on as org_fedora_oscap instead of com_redhat_oscap which might cause confusion. That is done to preserve backward compatibility with Red Hat Enterprise Linux 7.

Certain sets of interdependent rules in SSG can fail

Remediation of SCAP Security Guide (SSG) rules in a benchmark can fail due to undefined ordering of rules and their dependencies. If two or more rules need to be executed in a particular order, for example, when one rule installs a component and another rule configures the same component, they can run in the wrong order and remediation reports an error. To work around this problem, run the remediation twice, and the second run fixes the dependent rules.

OSCAP Anaconda Addon does not install all packages in text mode

The OSCAP Anaconda Addon plugin cannot modify the list of packages selected for installation by the system installer if the installation is running in text mode. Consequently, when a security policy profile is specified using Kickstart and the installation is running in text mode, any additional packages required by the security policy are not installed during installation.

OSCAP Anaconda Addon does not correctly handle customized profiles

The OSCAP Anaconda Addon plugin does not properly handle security profiles with customizations in separate files. Consequently, the customized profile is not available in the RHEL graphical installation even when you properly specify it in the corresponding Kickstart section.

Remediating service-related rules during kickstart installations might fail

During a kickstart installation, the OpenSCAP utility sometimes incorrectly shows that a service enable or disable state remediation is not needed. Consequently, OpenSCAP might set the services on the installed system to a non-compliant state. As a workaround, you can scan and remediate the system after the kickstart installation. This will fix the service-related issues.

Certain rsyslog priority strings do not work correctly

Support for the GnuTLS priority string for imtcp that allows fine-grained control over encryption is not complete. Consequently, the following priority strings do not work properly in rsyslog:

Conflict in SELinux Audit rules and SELinux boolean configurations

If the Audit rule list includes an Audit rule that contains a subj_* or obj_* field, and the SELinux boolean configuration changes, setting the SELinux booleans causes a deadlock. As a consequence, the system stops responding and requires a reboot to recover. To work around this problem, disable all Audit rules containing the subj_* or obj_* field, or temporarily disable such rules before changing SELinux booleans.

The nm-cloud-setup service removes manually-configured secondary IP addresses from interfaces

Based on the information received from the cloud environment, the nm-cloud-setup service configures network interfaces. Disable nm-cloud-setup to manually configure interfaces. However, in certain cases, other services on the host can configure interfaces as well. For example, these services could add secondary IP addresses. To avoid that nm-cloud-setup removes secondary IP addresses:

IPsec network traffic fails during IPsec offloading when GRO is disabled

IPsec offloading is not expected to work when Generic Receive Offload (GRO) is disabled on the device. If IPsec offloading is configured on a network interface and GRO is disabled on that device, IPsec network traffic fails.

Certain BCC utilities display a harmless warning

Due to macro redefinitions in some compiler specific kernel headers. Some BPF Compiler Collection (BCC) utilities show the following warning:

A vmcore capture fails after memory hot-plug or unplug operation

After performing the memory hot-plug or hot-unplug operation, the event comes after updating the device tree which contains memory layout information. Thereby the makedumpfile utility tries to access a non-existent physical address. The problem appears if all of the following conditions meet:

kdump fails to dump vmcore on SSH or NFS dump targets

The new version of dracut-network drops dependency on dhcp-client that requires an ipcalc. Consequently, when NIC port is configured to a static IP and kdump is configured to dump on SSH or NFS dump targets, kdump fails with the following error message:

Debug kernel fails to boot in crash capture environment in RHEL 8

Due to memory-demanding nature of the debug kernel, a problem occurs when the debug kernel is in use and a kernel panic is triggered. As a consequence, the debug kernel is not able to boot as the capture kernel, and a stack trace is generated instead. To work around this problem, increase the crash kernel memory accordingly. As a result, the debug kernel successfully boots in the crash capture environment.

Memory allocation on crash kernel fails at boot time

On some Ampere Altra systems, memory allocation fails when the 32-bit region is disabled in BIOS settings. Consequently, the kdump service fails to start because the conventional memory is not large enough to reserve the memory allocation.

Certain kernel drivers do not display their version

The behavior for module versioning of many networking kernel drivers has changed in RHEL 8.4. Consequently, those drivers now do not display their version. Alternatively, after executing the ethtool -i command, the drivers display the kernel version instead of the driver version. To work around this problem, users can run the following command:

Using irqpoll causes vmcore generation failure

Due to an existing problem with the nvme driver on the 64-bit ARM architectures that run on the Amazon Web Services (AWS) cloud platforms, the vmcore generation fails when you provide the irqpoll kernel command line parameter to the first kernel. Consequently, no vmcore file is dumped in the /var/crash/ directory after a kernel crash. To work around this problem:

The HP NMI watchdog does not always generate a crash dump

In certain cases, the hpwdt driver for the HP NMI watchdog is not able to claim a non-maskable interrupt (NMI) generated by the HPE watchdog timer because the NMI was instead consumed by the perfmon driver.

The tuned-adm profile powersave command causes the system to become unresponsive

Executing the tuned-adm profile powersave command leads to an unresponsive state of the Penguin Valkyrie 2000 2-socket systems with the older Thunderx (CN88xx) processors. Consequently, reboot the system to resume working. To work around this problem, avoid using the powersave profile if your system matches the mentioned specifications.

The kernel ACPI driver reports it has no access to a PCIe ECAM memory region

The Advanced Configuration and Power Interface (ACPI) table provided by firmware does not define a memory region on the PCI bus in the Current Resource Settings (_CRS) method for the PCI bus device. Consequently, the following warning message occurs during the system boot:

The hwloc commands with the default settings do not work on single CPU Power9 and Power10 LPARs

With the hwloc package of version 2.2.0, any single-node Non-Uniform Memory Access (NUMA) system that runs Power9 / Power10 CPU is considered to be "disallowed". Consequently, all hwloc commands do not work and the following error message is displayed:

The OPEN MPI library may trigger run-time failures with default PML

In OPEN Message Passing Interface (OPEN MPI) implementation 4.0.x series, Unified Communication X (UCX) is the default point-to-point communicator (PML). The later versions of OPEN MPI 4.0.x series deprecated openib Byte Transfer Layer (BTL).

Connections fail when attaching a virtual function to virtual machine

Pensando network cards that use the ionic device driver silently accept VLAN tag configuration requests and attempt configuring network connections while attaching network virtual functions (VF) to a virtual machine (VM). Such network connections fail as this feature is not yet supported by the card’s firmware.

The default 7 4 1 7 printk value sometimes causes temporary system unresponsiveness

The default 7 4 1 7 printk value allows for better debugging of the kernel activity. However, when coupled with a serial console, this printk setting can cause intense I/O bursts that can lead to a RHEL system becoming temporarily unresponsive. To work around this problem, we have added a new optimize-serial-console TuneD profile, which reduces the default printk value to 4 4 1 7. Users can instrument their system as follows:

The /boot file system cannot be placed on LVM

You cannot place the /boot file system on an LVM logical volume. This limitation exists for the following reasons:

LVM no longer allows creating volume groups with mixed block sizes

LVM utilities such as vgcreate or vgextend no longer allow you to create volume groups (VGs) where the physical volumes (PVs) have different logical block sizes. LVM has adopted this change because file systems fail to mount if you extend the underlying logical volume (LV) with a PV of a different block size.

Limitations of LVM writecache

The writecache LVM caching method has the following limitations, which are not present in the cache method:

LVM mirror devices that store a LUKS volume sometimes become unresponsive

Mirrored LVM devices with a segment type of mirror that store a LUKS volume might become unresponsive under certain conditions. The unresponsive devices reject all I/O operations.

An NFS 4.0 patch can result in reduced performance under an open-heavy workload

Previously, a bug was fixed that, in some cases, could cause an NFS open operation to overlook the fact that a file had been removed or renamed on the server. However, the fix may cause slower performance with workloads that require many open operations. To work around this problem, it might help to use NFS version 4.1 or higher, which have been improved to grant delegations to clients in more cases, allowing clients to perform open operations locally, quickly, and safely.

xfs_quota state doesn’t output all grace times when multiple quota types are specified

Currently, the xfs_quota state command doesn’t output the grace time for quotas as expected with options specifying multiple quota types. To work around this issue, specify the required quota type in command option individually, i. e. xfs_quota state -g, xfs_quota state -p or xfs_quota state -u.

The ocf:heartbeat:pgsql resource agent and any third-party agents that parse crm_mon output in their stop operation may fail to stop during a shutdown process in RHEL 8.4

In the RHEL 8.4 GA release, Pacemaker’s crm_mon command-line tool was modified to display a "shutting down" message rather than the usual cluster information when Pacemaker starts to shut down. As a result, shutdown progress, such as the stopping of resources, can not be monitored, and resource agents that parse crm_mon output in their stop operation (such as the ocf:heartbeat:pgsql agent distributed with the resource-agents package, or some custom or third-party agents) could fail to stop, leading to cluster problems.

getpwnam() might fail when called by a 32-bit application

When a user of NIS uses a 32-bit application that calls the getpwnam() function, the call fails if the nss_nis.i686 package is missing. To work around this problem, manually install the missing package by using the yum install nss_nis.i686 command.

Symbol conflicts between OpenLDAP libraries might cause crashes in httpd

When both the libldap and libldap_r libraries provided by OpenLDAP are loaded and used within a single process, symbol conflicts between these libraries might occur. Consequently, Apache httpd child processes using the PHP ldap extension might terminate unexpectedly if the mod_security or mod_auth_openidc modules are also loaded by the httpd configuration.

MariaDB 10.5 does not warn about dropping a non-existent table when the OQGraph plug-in is enabled

When the OQGraph storage engine plug-in is loaded to the MariaDB 10.5 server, MariaDB does not warn about dropping a non-existent table. In particular, when the user attempts to drop a non-existent table using the DROP TABLE or DROP TABLE IF EXISTS SQL commands, MariaDB neither returns an error message nor logs a warning.

PAM plug-in version 1.0 does not work in MariaDB

MariaDB 10.3 provides the Pluggable Authentication Modules (PAM) plug-in version 1.0. MariaDB 10.5 provides the plug-in versions 1.0 and 2.0, version 2.0 is the default.

pyodbc does not work with MariaDB 10.3

The pyodbc module currently does not work with the MariaDB 10.3 server included in the RHEL 8.4 release. Earlier versions of the MariaDB 10.3 server and the MariaDB 10.5 server are not affected by this problem.

GCC Toolset 10: Valgrind erroneously reports IBM z15 architecture support

Valgrind does not support certain IBM z15 processors features yet, but a bug in GCC Toolset 10 Valgrind causes it to report z15 support when run on a z15-capable system. As a consequence, software that tries to use z15 features when available cannot run under Valgrind. To work around this problem, when running on a z15 processor, use the system version of Valgrind accessible via /usr/bin/valgrind. This build will not report z15 support.

Memory leaks in pmproxy in PCP

The pmproxy service experiences memory leaks in Performance Co-Pilot (PCP) versions earlier than 5.3.0. The PCP version 5.3.0 is unavailable in RHEL 8.4 and the earlier minor versions of RHEL 8. As a consequence, RHEL 8 users might experience higher memory usage than expected.

Installing KRA fails if all KRA members are hidden replicas

The ipa-kra-install utility fails on a cluster where the Key Recovery Authority (KRA) is already present, if the first KRA instance is installed on a hidden replica. Consequently, you cannot add further KRA instances to the cluster.

Using the cert-fix utility with the --agent-uid pkidbuser option breaks Certificate System

Using the cert-fix utility with the --agent-uid pkidbuser option corrupts the LDAP configuration of Certificate System. As a consequence, Certificate System might become unstable and manual steps are required to recover the system.

The /var/log/lastlog sparse file on IdM hosts can cause performance problems

During the IdM installation, a range of 200,000 UIDs from a total of 10,000 possible ranges is randomly selected and assigned. Selecting a random range in this way significantly reduces the probability of conflicting IDs in case you decide to merge two separate IdM domains in the future.