Chapter 5. RHEL 8.3.0 release

Anaconda rebased to version 33.16

With this release, Anaconda has been rebased to version 33.16. This version provides the following notable enhancements over the previous version.

GUI changes in RHEL Installation Program

The RHEL Installation Program now includes the following user settings on the Installation Summary window:

Image Builder backend osbuild-composer replaces lorax-composer

The osbuild-composer backend replaces lorax-composer. The new service provides REST APIs for image building. As a result, users can benefit from a more reliable backend and more predictable output images.

Image Builder osbuild-composer supports a set of image types

With the osbuild-composer backend replacement, the following set of image types supported in osbuild-composer this time:

Image Builder now supports push to clouds through GUI

With this enhancement, when creating images, users can choose the option of pushing to Azure and AWS service clouds through GUI Image Builder. As a result, users can benefit from easier uploads and instantiation.

Introducing RHEL for Edge images

With this release, you can now create customized RHEL images for Edge servers.

The default value for the best dnf configuration option has been changed from True to False

With this update, the value for the best dnf configuration option has been set to True in the default configuration file to retain the original dnf behavior. As a result, for users that use the default configuration file the behavior remains unchanged.

New --norepopath option for the dnf reposync command is now available

Previously, the reposync command created a subdirectory under the --download-path directory for each downloaded repository by default. With this update, the --norepopath option has been introduced, and reposync does not create the subdirectory. As a result, the repository is downloaded directly into the directory specified by --download-path. This option is also present in the YUM v3.

Ability to enable and disable the libdnf plugins

Previously, subscription checking was hardcoded into the RHEL version of the libdnf plug-ins. With this update, the microdnf utility can enable and disable the libdnf plug-ins, and subscription checking can now be disabled the same way as in DNF. To disable subscription checking, use the --disableplugin=subscription-manager command. To disable all plug-ins, use the --noplugins command.

ReaR updates

RHEL 8.3 introduces a number of updates to the Relax-and-Recover (ReaR) utility. Notable changes include:

smartmontools rebased to version 7.1

The smartmontools package has been upgraded to version 7.1, which provides multiple bug fixes and enhancements. Notable changes include:

opencryptoki rebased to version 3.14.0

The opencryptoki packages have been upgraded to version 3.14.0, which provides multiple bug fixes and enhancements. Notable changes include:

gpgme rebased to version 1.13.1.

The gpgme packages have been upgraded to upstream version 1.13.1. Notable changes include:

powertop rebased to version 2.12

The powertop packages have been upgraded to version 2.12. Notable changes over the previously available version 2.11 include:

tuned rebased to version 2.14.0

The tuned packages have been upgraded to upstream version 2.14.0. Notable enhancements include:

tcpdump rebased to version 4.9.3

The tcpdump utility has been updated to version 4.9.3 to fix Common Vulnerabilities and Exposures (CVE).

libpcap rebased to version 1.9.1

The libpcap packages have been updated to version 1.9.1 to fix Common Vulnerabilities and Exposures (CVE).

iperf3 now supports sctp option on the client side

With this enhancement, the user can use Stream Control Transmission Protocol (SCTP) instead of Transmission Control Protocol (TCP) on the client side of testing network throughput.

iperf3 now supports SSL

With this enhancement, the user can use RSA authentication between the client and the server to restrict the connections to the server only to legitimate clients.

bind rebased to 9.11.20

The bind package has been upgraded to version 9.11.20, which provides multiple bug fixes and enhancements. Notable changes include:

A new optimize-serial-console TuneD profile to reduce I/O to serial consoles by lowering the printk value

With this update, a new optimize-serial-console TuneD profile is available. In some scenarios, kernel drivers can send large amounts of I/O operations to the serial console. Such behavior can cause temporary unresponsiveness while the I/O is written to the serial console. The optimize-serial-console profile reduces this I/O by lowering the printk value from the default of 7 4 1 7 to 4 4 1 7. Users with a serial console who wish to make this change on their system can instrument their system as follows:

New TuneD profiles added for the AMD-based platforms

In RHEL 8.3, the throughput-performance TuneD profile was updated to include tuning for the AMD-based platforms. There is no need to change any parameter manually and the tuning is automatically applied on the AMD system. The AMD Epyc Naples and Rome systems alters the following parameters in the default throughput-performance profile:

memcached rebased to version 1.5.22

The memcached packages have been upgraded to version 1.5.22. Notable changes over the previous version include:

Cyrus SASL now supports channel bindings with the SASL/GSSAPI and SASL/GSS-SPNEGO plug-ins

This update adds support for channel bindings with the SASL/GSSAPI and SASL/GSS-SPNEGO plug-ins. As a result, when used in the openldap libraries, this feature enables Cyrus SASL to maintain compatibility with and access to Microsoft Active Directory and Microsoft Windows systems which are introducing mandatory channel binding for LDAP connections.

Libreswan rebased to 3.32

With this update, Libreswan has been rebased to upstream version 3.32, which includes several new features and bug fixes. Notable features include:

The libssh library has been rebased to version 0.9.4

The libssh library, which implements the SSH protocol, has been upgraded to version 0.9.4.

gnutls rebased to 3.6.14

The gnutls packages have been rebased to upstream version 3.6.14. This version provides many bug fixes and enhancements, most notably:

gnutls FIPS DH checks now conform with NIST SP 800-56A rev. 3

This update of the gnutls packages provides checks required by NIST Special Publication 800-56A Revision 3, sections 5.7.1.1 and 5.7.1.2, step 2. The change is necessary for future FIPS 140-2 certifications. As a result, gnutls now accept only 2048-bit or larger parameters from RFC 7919 and RFC 3526 during the Diffie-Hellman key exchange when operating in FIPS mode.

gnutls now performs validations according to NIST SP 800-56A rev 3

This update of the gnutls packages adds checks required by NIST Special Publication 800-56A Revision 3, sections 5.6.2.2.2 and 5.6.2.1.3, step 2. The addition prepares gnutls for future FIPS 140-2 certifications. As a result, gnutls perform additional validation steps for generated and received public keys during the Diffie-Hellman key exchange when operating in FIPS mode.

update-crypto-policies and fips-mode-setup moved into crypto-policies-scripts

The update-crypto-policies and fips-mode-setup scripts, which were previously included in the crypto-policies package, are now moved into a separate RPM subpackage crypto-policies-scripts. The package is automatically installed through the Recommends dependency on regular installations. This enables the ubi8/ubi-minimal image to avoid the inclusion of the Python language interpreter and thus reduces the image size.

OpenSC rebased to version 0.20.0

The opensc package has been rebased to version 0.20.0 which addresses multiple bugs and security issues. Notable changes include:

stunnel rebased to version 5.56

With this update, the stunnel encryption wrapper has been rebased to upstream version 5.56, which includes several new features and bug fixes. Notable features include:

libkcapi rebased to version 1.2.0

The libkcapi package has been rebased to upstream version 1.2.0, which includes minor changes.

setools rebased to 4.3.0

The setools package, which is a collection of tools designed to facilitate SELinux policy analysis, has been upgraded to version 4.3.0.

Individual CephFS files and directories can now have SELinux labels

The Ceph File System (CephFS) has recently enabled storing SELinux labels in the extended attributes of files. Previously, all files in a CephFS volume were labeled with a single common label system_u:object_r:cephfs_t:s0. With this enhancement, you can change the labels for individual files, and SELinux defines the labels of newly created files based on transition rules. Note that previously unlabeled files still have the system_u:object_r:cephfs_t:s0 label until explicitly changed.

OpenSCAP rebased to version 1.3.3

The openscap packages have been upgraded to upstream version 1.3.3, which provides many bug fixes and enhancements over the previous version, most notably:

SCAP Security Guide now provides a profile aligned with the CIS RHEL 8 Benchmark v1.0.0

With this update, the scap-security-guide packages provide a profile aligned with the CIS Red Hat Enterprise Linux 8 Benchmark v1.0.0. The profile enables you to harden the configuration of the system using the guidelines by the Center for Internet Security (CIS). As a result, you can configure and automate compliance of your RHEL 8 systems with CIS by using the CIS Ansible Playbook and the CIS SCAP profile.

scap-security-guide now provides a profile that implements HIPAA

This update of the scap-security-guide packages adds the Health Insurance Portability and Accountability Act (HIPAA) profile to the RHEL 8 security compliance content. This profile implements recommendations outlined on the The HIPAA Privacy Rule website.

scap-security-guide rebased to 0.1.50

The scap-security-guide packages, which contain the latest set of security policies for Linux systems, have been upgraded to version 0.1.50.

SCAP Workbench can now generate results-based remediations from tailored profiles

With this update, you can now generate result-based remediation roles from tailored profiles using the SCAP Workbench tool.

New Ansible role provides automated deployments of Clevis clients

This update of the rhel-system-roles package introduces the nbde_client RHEL system role. This Ansible role enables you to deploy multiple Clevis clients in an automated way.

New Ansible role can now set up a Tang server

With this enhancement, you can deploy and manage a Tang server as part of an automated disk encryption solution with the new nbde_server system role. The nbde_server Ansible role, which is included in the rhel-system-roles package, supports the following features:

clevis rebased to version 13

The clevis packages have been rebased to version 13, which provides multiple bug fixes and enhancements. Notable changes include:

clevis luks edit enables you to edit a specific pin configuration

This update of the clevis packages introduces the new clevis luks edit subcommand that enables you to edit a specific pin configuration. For example, you can now change the URL address of a Tang server and the pcr_ids parameter in a TPM2 configuration. You can also add and remove new sss pins and change the threshold of an sss pin.

clevis luks bind -y now allows automated binding

With this enhancement, Clevis supports automated binding with the -y parameter. You can now use the -y option with the clevis luks bind command, which automatically answers subsequent prompts with yes. For example, when using a Tang pin, you are no longer required to manually trust Tang keys.

fapolicyd rebased to version 1.0

The fapolicyd packages have been rebased to version 1.0, which provides multiple bug fixes and enhancements. Notable changes include:

fapolicyd now provides its own SELinux policy in fapolicyd-selinux

With this enhancement, the fapolicyd framework now provides its own SELinux security policy. The daemon is confined under the fapolicyd_t domain and the policy is installed through the fapolicyd-selinux subpackage.

USBGuard rebased to version 0.7.8

The usbguard packages have been rebased to version 0.7.8 which provides multiple bug fixes and enhancements. Notable changes include:

USBGuard provides many improvements for corporate desktop users

This addition to the USBGuard project contains enhancements and bug fixes to improve the usability for corporate desktop users. Important changes include:

USBGuard now provides its own SELinux policy in usbguard-selinux

With this enhancement, the USBGuard framework now provides its own SELinux security policy. The daemon is confined under the usbguard_t domain and the policy is installed through the usbguard-selinux subpackage.

libcap now supports ambient capabilities

With this update, users are able to grant ambient capabilities at login and prevent the need to have root access for the appropriately configured processes.

The libseccomp library has been rebased to version 2.4.3

The libseccomp library, which provides an interface to the seccomp system call filtering mechanism, has been upgraded to version 2.4.3.

omamqp1 module is now supported

With this update, the AMQP 1.0 protocol supports sending messages to a destination on the bus. Previously, Openstack used the AMQP1 protocol as a communication standard, and this protocol can now log messages in AMQP messages. This update introduces the rsyslog-omamqp1 sub-package to deliver the omamqp1 output mode, which logs messages and sends them to the destination on the bus.

OpenSCAP compresses remote content

With this update, OpenSCAP uses gzip compression for transferring remote content. The most common type of remote content is text-based CVE feeds, which increase in size over time and typically have to be downloaded for every scan. The gzip compression reduces the bandwidth to 10% of bandwidth needed for uncompressed content. As a result, this reduces bandwidth requirements across the entire chain between the scanned system and the server that hosts the remote content.

SCAP Security Guide now provides a profile aligned with NIST-800-171

With this update, the scap-security-guide packages provide a profile aligned with the NIST-800-171 standard. The profile enables you to harden the system configuration in accordance with security requirements for protection of Controlled Unclassified Information (CUI) in non-federal information systems. As a result, you can more easily configure systems to be aligned with the NIST-800-171 standard.

The IPv4 and IPv6 connection tracking modules have been merged into the nf_conntrack module

This enhancement merges the nf_conntrack_ipv4 and nf_conntrack_ipv6 Netfilter connection tracking modules into the nf_conntrack kernel module. Due to this change, blacklisting the address family-specific modules no longer work in RHEL 8.3, and you can blacklist only the nf_conntrack module to disable connection tracking support for both the IPv4 and IPv6 protocols.

firewalld rebased to version 0.8.2

The firewalld packages have been upgraded to upstream version 0.8.2, which provides a number of bug fixes over the previous version. For details, see the firewalld 0.8.2 Release Notes.

NetworkManager rebased to version 1.26.0

The NetworkManager packages have been upgraded to upstream version 1.26.0, which provides a number of enhancements and bug fixes over the previous version:

XDP is conditionally supported

Red Hat supports the eXpress Data Path (XDP) feature only if all of the following conditions apply:

xdp-tools is partially supported

The xdp-tools package, which contains user space support utilities for the kernel eXpress Data Path (XDP) feature, is now supported on the AMD and Intel 64-bit architectures. This includes the libxdp library, the xdp-loader utility for loading XDP programs, and the xdp-filter example program for packet filtering. Note that the xdpdump utility for capturing packets from a network interface with XDP enabled is still a Technology Preview. (BZ#1820670)

The dracut utility by default now uses NetworkManager in initial RAM disk

Previously, the dracut utility was using a shell script to manage networking in the initial RAM disk, initrd. In certain cases, this could cause problems. For example, the NetworkManager sends another DHCP request, even if the script in the RAM disk has already requested an IP address, which could result in a timeout.

Network configuration in the kernel command line has been consolidated under the ip parameter

The ipv6, netmask, gateway, and hostname parameters to set the network configuration in the kernel command line have been consolidated under the ip parameter. The ip parameter accepts different formats, such as the following:

Kernel version in RHEL 8.3

Red Hat Enterprise Linux 8.3 is distributed with the kernel version 4.18.0-240.

Extended Berkeley Packet Filter for RHEL 8.3

The Extended Berkeley Packet Filter (eBPF) is an in-kernel virtual machine that allows code execution in the kernel space, in the restricted sandbox environment with access to a limited set of functions. The virtual machine executes a special assembly-like code.

Cornelis Networks Omni-Path Architecture (OPA) Host Software

Omni-Path Architecture (OPA) host software is fully supported in Red Hat Enterprise Linux 8.3. OPA provides Host Fabric Interface (HFI) hardware with initialization and setup for high performance data transfers (high bandwidth, high message rate, low latency) between compute and I/O nodes in a clustered environment.

TSX is now disabled by default

Starting with RHEL 8.3, the kernel now has the Intel® Transactional Synchronization Extensions (TSX) technology disabled by default to improve the OS security. The change applies to those CPUs that support disabling TSX, including the 2nd Generation Intel® Xeon® Scalable Processors (formerly known as Cascade Lake with Intel® C620 Series Chipsets).

RHEL 8.3 now supports the page owner tracking feature

With this update, you can use the page owner tracking feature to observe the kernel memory utilization at the page allocation level.

EDAC for AMD EPYC™ 7003 Series Processors is now supported

This enhancement provides Error Detection And Correction (EDAC) device support for AMD EPYC™ 7003 Series Processors. Previously, corrected (CEs) and uncorrected (UEs) memory errors were not reported on systems based on AMD EPYC™ 7003 Series Processors. With this update, such errors will now be reported using EDAC.

Flamegraph is now supported with perf tool

With this update, the perf command line tool supports flamegraphs to create a graphical representation of the system’s performance. The perf data is grouped together into samples with similar stack backtraces. As a result, this data is converted into a visual representation to allow easier identification of computationally intensive areas of code. To generate a flamegraph using the perf tool, execute the following commands:

/dev/random and /dev/urandom are now conditionally powered by the Kernel Crypto API DRBG

In FIPS mode, the /dev/random and /dev/urandom pseudorandom number generators are powered by the Kernel Crypto API Deterministic Random Bit Generator (DRBG). Applications in FIPS mode use the mentioned devices as a FIPS-compliant noise source, therefore the devices have to employ FIPS-approved algorithms. To achieve this goal, necessary hooks have been added to the /dev/random driver. As a result, the hooks are enabled in the FIPS mode and cause /dev/random and /dev/urandom to connect to the Kernel Crypto API DRBG.

libbpf fully supported

The libbpf package, crucial for bpf related applications like bpftrace and bpf/xdp development, is now fully supported.

lshw utility now provides additional CPU information

With this enhancement, the List Hardware utility (lshw) displays more CPU information. The CPU version field now provides the family, model and stepping details of the system processors in numeric format as version: <family>.<model>.<stepping>.

kernel-rt source tree has been updated to the RHEL 8.3 tree

The kernel-rt sources have been updated to use the latest Red Hat Enterprise Linux kernel source tree. The real-time patch set has also been updated to the latest upstream version, v5.6.14-rt7. Both of these updates provide a number of bug fixes and enhancements.

tpm2-tools rebased to version 4.1.1

The tpm2-tools package has been upgraded to version 4.1.1, which provides a number of command additions, updates, and removals. For more details, see the Updates to tpm2-tools package in RHEL8.3 solution.

The Mellanox ConnectX-6 Dx network adapter is now fully supported

This enhancement adds the PCI IDs of the Mellanox ConnectX-6 Dx network adapter to the mlx5_core driver. On hosts that use this adapter, RHEL loads the mlx5_core driver automatically. This feature, previously available as a technology preview, is now fully supported in RHEL 8.3.

mlxsw driver rebased to version 5.7

The mlxsw driver is upgraded to upstream version 5.7 and include following new features:

The crash kernel now expands memory reserve for kdump

With this enhancement, the crashkernel=auto argument now reserves more memory on machines with 4GB to 64GB memory capacity. Previously, due to limited memory reserve, the crash kernel failed to capture the crash dump as the kernel space and user space memory expanded. As a consequence, the crash kernel experienced an out-of-memory (OOM) error. This update helps to reduce the OOM error occurrences in the described scenario and expands the memory capacity for kdump accordingly.

LVM can now manage VDO volumes

LVM now supports the Virtual Data Optimizer (VDO) segment type. As a result, you can now use LVM utilities to create and manage VDO volumes as native LVM logical volumes.

The SCSI stack now works better with high-performance adapters

The performance of the SCSI stack has been improved. As a result, next-generation, high performance host bus adapters (HBAs) are now capable of higher IOPS (I/Os per second) on RHEL.

The megaraid_sas driver has been updated to the latest version

The megaraid_sas driver has been updated to version 07.713.01.00-rc1. This update provides several bug fixes and enhancements relating to improving performance, better stability of supported MegaRAID adapters, and a richer feature set.

Stratis now lists the pool name on error

When you attempt to create a Stratis pool on a block device that is already in use by an existing Stratis pool, the stratis utility now reports the name of the existing pool. Previously, the utility listed only the UUID label of the pool.

FPIN ELS frame notification support

The lpfc Fibre Channel (FC) driver now supports Fabric Performance Impact Notifications (FPINs) regarding link integrity, which help identify link level issues and allows the switch to choose a more reliable path.

New commands to debug LVM on-disk metadata

The pvck utility, which is available from the lvm2 package, now provides low-level commands to debug or rescue LVM on-disk metadata on physical volumes:

LVM RAID supports DM integrity to prevent data loss due to corrupted data on a device

It is now possible to add Device Mapper (DM) integrity to an LVM RAID configuration to prevent data loss. The integrity layer detects data corruption on a device and alerts the RAID layer to fix the corrupted data across the LVM RAID.

Resilient Storage (GFS2) supported on AWS, Azure, and Aliyun public clouds

Resilient Storage (GFS2) is now supported on three major public clouds, Amazon (AWS), Microsoft (Azure) and Alibaba (Aliyun) with the introduction of shared block device support on those platforms. As a result GFS2 is now a true hybrid cloud cluster filesystem with options to use both on premises and in the public cloud. For information on configuring shared block storage on Microsoft Azure and on AWS, see Deploying RHEL 8 on Microsoft Azure and Deploying RHEL 8 on Amazon Web Services. For information on configuring shared block storage on Alibaba Cloud, see Configuring Shared Block Storage for a Red Hat High Availability Cluster on Alibaba Cloud.

Userspace now supports the latest nfsdcld daemon

Userspace now supports the lastest nfsdcld daemon, which is the only namespace-aware client tracking method. This enhancement ensures client open or lock recovery from the containerized knfsd daemon without any data corruption.

nconnect now supports multiple concurrent connections

With this enhancement, you can use the nconnect functionality to create multiple concurrent connections to an NFS server, allowing for a different load balancing ability. Enable the nconnect functionality with the nconnect=X NFS mount option, where X is the number of concurrent connections to use. The current limit is 16.

nfsdcld daemon for client information tracking is now supported

With this enhancement, the nfsdcld daemon is now the default method in tracking per-client information on a stable storage. As a result, the NFS v4 running in containers allows the clients to reclaim the opens or locks after a server restart.

pacemaker rebased to version 2.0.4

The Pacemaker cluster resource manager has been upgraded to upstream version 2.0.4, which provides a number of bug fixes.

New priority-fencing-delay cluster property

Pacemaker now supports the new priority-fencing-delay cluster property, which allows you to configure a two-node cluster so that in a split-brain situation the node with the fewest resources running is the node that gets fenced.

New commands for managing multiple sets of resource and operation defaults

It is now possible to create, list, change and delete multiple sets of resource and operation defaults. When you create a set of default values, you can specify a rule that contains resource and op expressions. This allows you, for example, to configure a default resource value for all resources of a particular type. Commands that list existing default values now include multiple sets of defaults in their output.

Support for tagging cluster resources

It is now possible to tag cluster resources in a Pacemaker cluster with the pcs tag command. This feature allows you to administer a specified set of resources with a single command. You can also use the pcs tag command to remove or modify a resource tag, and to display the tag configuration.

Pacemaker now supports recovery by demoting a promoted resource rather than fully stopping it

It is now possible to configure a promotable resource in a Pacemaker cluster so that when a promote or monitor action fails for that resource, or the partition in which the resource is running loses quorum, the resource will be demoted but will not be fully stopped.

New SBD_SYNC_RESOURCE_STARTUP SBD configuration parameter to improve synchronization with Pacemaker

To better control synchronization between SBD and Pacemaker, the /etc/sysconfig/sbd file now supports the SBD_SYNC_RESOURCE_STARTUP parameter. When Pacemaker and SBD packages from RHEL 8.3 or later are installed and SBD is configured with SBD_SYNC_RESOURCE_STARTUP=true, SBD contacts the Pacemaker daemon for information about the daemon’s state.

A new module stream: ruby:2.7

RHEL 8.3 introduces Ruby 2.7.1 in a new ruby:2.7 module stream. This version provides a number of performance improvements, bug and security fixes, and new features over Ruby 2.6 distributed with RHEL 8.1.

A new module stream: nodejs:14

A new module stream, nodejs:14, is now available. Node.js 14, included in RHEL 8.3, provides numerous new features and bug and security fixes over Node.js 12 distributed in RHEL 8.1.

git rebased to version 2.27

The git packages have been upgraded to upstream version 2.27. Notable changes over the previously available version 2.18 include:

Changes in Python

RHEL 8.3 introduces the following changes to the python38:3.8 module stream:

A new module stream: php:7.4

RHEL 8.3 introduces PHP 7.4, which provides a number of bug fixes and enhancements over version 7.3.

A new module stream: nginx:1.18

The nginx 1.18 web and proxy server, which provides a number of bug fixes, security fixes, new features and enhancements over version 1.16, is now available. Notable changes include:

A new module stream: perl:5.30

RHEL 8.3 introduces Perl 5.30, which provides a number of bug fixes and enhancements over the previously released Perl 5.26. The new version also deprecates or removes certain language features. Notable changes with significant impact include:

A new module stream: perl-libwww-perl:6.34

RHEL 8.3 introduces a new perl-libwww-perl:6.34 module stream, which provides the perl-libwww-perl package for all versions of Perl available in RHEL 8. The non-modular perl-libwww-perl package, available since RHEL 8.0, which cannot be used with other Perl streams than 5.26, has been obsoleted by the new default perl-libwww-perl:6.34 stream.

A new module stream: perl-IO-Socket-SSL:2.066

A new perl-IO-Socket-SSL:2.066 module stream is now available. This module provides the perl-IO-Socket-SSL and perl-Net-SSLeay packages and it is compatible with all Perl streams available in RHEL 8.

The squid:4 module stream rebased to version 4.11

The Squid proxy server, provided by the squid:4 module stream, has been upgraded from version 4.4 to version 4.11. This release provides multiple bug and security fixes, and various enhancements, such as new configuration options.

Changes in the httpd:2.4 module stream

RHEL 8.3 introduces the following notable changes to the Apache HTTP Server, available through the httpd:2.4 module stream:

Support for logging to journald from the CustomLog directive in httpd

It is now possible to output access (transfer) logs to journald from the Apache HTTP Server by using a new option for the CustomLog directive.

.NET 5 is now available on RHEL

.NET 5 is available on Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and OpenShift Container Platform. .NET 5 includes new language versions: C# 9 and F# 5.0. Significant performance improvements were made in the base libraries, GC and JIT. .NET 5 has single file applications, which allows you to distribute .NET applications as a single executable, with all dependencies included. UBI8 images for .NET 5 are available from Red Hat container registry and can be used with OpenShift.

New GCC Toolset 10

GCC Toolset 10 is a compiler toolset that provides recent versions of development tools. It is available as an Application Stream in the form of a Software Collection in the AppStream repository.

Rust Toolset rebased to version 1.45.2

Rust Toolset has been updated to version 1.45.2. Notable changes include:

LLVM Toolset rebased to version 10.0.1

LLVM Toolset has been upgraded to version 10.0.1. With this update, the clang-libs packages no longer include individual component libraries. As a result, it is no longer possible to link applications against them. To link applications against the clang libraries, use the libclang-cpp.so package.

Go Toolset rebased to version 1.14.7

Go Toolset has been upgraded to version 1.14.7 Notable changes include:

SystemTap rebased to version 4.3

The SystemTap instrumentation tool has been updated to version 4.3, which provides multiple bug fixes and enhancements. Notable changes include:

Valgrind rebased to version 3.16.0

The Valgrind executable code analysis tool has been updated to version 3.16.0, which provides a number of bug fixes and enhancements over the previous version:

elfutils rebased to version 0.180

The elfutils package has been updated to version 0.180, which provides multiple bug fixes and enhancements. Notable changes include:

GDB now supports process record and replay on IBM z15

With this enhancement, the GNU Debugger (GDB) now supports process record and replay with most of the new instructions of the IBM z15 processor (previously known as arch13). Note that the following instructions are currently not supported: SORTL (sort lists), DFLTCC (deflate conversion call), KDSA (compute digital signature authentication).

Marvell ThunderX2 performance monitoring events have been updated in papi

With this enhancement, a number of performance events specific to ThunderX2, including uncore events, have been updated. As a result, developers can better investigate system performance on Marvell ThunderX2 systems.

The glibc math library is now optimized for IBM Z

With this enhancement, the libm math functions were optimized to improve performance on IBM Z machines. Notable changes include:

An additional libffi-specific temporary directory is available now

Previously on hardened systems, the system-wide temporary directories may not have had permissions suitable for use with the libffi library.

Improved performance of strstr() and strcasestr()

With this update, the performance of the strstr() and strcasestr() functions has been improved across several supported architectures. As a result, users now benefit from significantly better performance of all applications using string and memory manipulation routines.

glibc now handles loading of a truncated locale archive correctly

If the archive of system locales has been previously truncated, either due to a power outage during upgrade or a disk failure, a process could terminate unexpectedly when loading the archive. This enhancement adds additional consistency checks to the loading of the locale archive. As a result, processes are now able to detect archive truncation and fall back to either non-archive installed locales or the default POSIX locale.

GDB now supports debuginfod

With this enhancement, the GNU Debugger (GDB) can now download debug information packages from centralized servers on demand using the elfutils debuginfod client library.

pcp rebased to version 5.1.1-3

The pcp package has been upgraded to version 5.1.1-3. Notable changes include:

grafana rebased to version 6.7.3

The grafana package has been upgraded to version 6.7.3. Notable changes include:

grafana-pcp rebased to version 2.0.2

The grafana-pcp package has been upgraded to version 2.0.2. Notable changes include:

A new rhel8/pcp container image

The rhel8/pcp container image is now available in the Red Hat Container Registry. The image contains the Performance Co-Pilot (PCP) toolkit, which includes preinstalled pcp-zeroconf package and the OpenMetrics PMDA.

A new rhel8/grafana container image

The rhel8/grafana container image is now available in the Red Hat Container Registry. Grafana is an open source utility with metrics dashboard, and graph editor for the Graphite, Elasticsearch, OpenTSDB, Prometheus, InfluxDB, and PCP monitoring tool.

IdM backup utility now checks for required replica roles

The ipa-backup utility now checks if all of the services used in the IdM cluster, such as a Certificate Authority (CA), Domain Name System (DNS), and Key Recovery Agent (KRA) are installed on the replica where you are running the backup. If the replica does not have all these services installed, the ipa-backup utility exits with a warning, because backups taken on that host would not be sufficient for a full cluster restoration.

New password expiration notification tool

Expiring Password Notification (EPN), provided by the ipa-client-epn package, is a standalone tool you can use to build a list of Identity Management (IdM) users whose passwords are expiring soon.

JSS now provides a FIPS-compliant SSLContext

Previously, Tomcat used the SSLEngine directive from the Java Cryptography Architecture (JCA) SSLContext class. The default SunJSSE implementation is not compliant with the Federal Information Processing Standard (FIPS), therefore PKI now provides a FIPS-compliant implementation via JSS.

Checking the overall health of your public key infrastructure is now available

With this update, the public key infrastructure (PKI) Healthcheck tool reports the health of the PKI subsystem to the Identity Management (IdM) Healthcheck tool, which was introduced in RHEL 8.1. Executing the IdM Healthcheck invokes the PKI Healthcheck, which collects and returns the health report of the PKI subsystem.

Support for RSA PSS

With this enhancement, PKI now supports the RSA PSS (Probabilistic Signature Scheme) signing algorithm.

Directory Server exports the private key and certificate to a private name space when the service starts

Directory Server uses OpenLDAP libraries for outgoing connections, such as replication agreements. Because these libraries cannot access the network security services (NSS) database directly, Directory Server extracts the private key and certificates from the NSS database on instances with TLS encryption support to enable the OpenLDAP libraries to establish encrypted connections. Previously, Directory Server extracted the private key and certificates to the directory set in the nsslapd-certdir parameter in the cn=config entry (default: /etc/dirsrv/slapd-<instance_name>/). As a consequence, Directory Server stored the Server-Cert-Key.pem and Server-Cert.pem in this directory. With this enhancement, Directory Server extracts the private key and certificate to a private name space that systemd mounts to the /tmp/ directory. As a result, the security has been increased.

Directory Server can now turn an instance to read-only mode if the disk monitoring threshold is reached

This update adds the nsslapd-disk-monitoring-readonly-on-threshold parameter to the cn=config entry. If you enable this setting, Directory Server switches all databases to read-only if disk monitoring is enabled and the free disk space is lower than the value you configured in nsslapd-disk-monitoring-threshold. With nsslapd-disk-monitoring-readonly-on-threshold set to on, the databases cannot be modified until Directory Server successfully shuts down the instance. This can prevent data corruption.

samba rebased to version 4.12.3

The samba packages have been upgraded to upstream version 4.12.3, which provides a number of bug fixes and enhancements over the previous version:

cockpit-session-recording rebased to version 4

The cockpit-session-recording module has been rebased to version 4. This version provides following notable changes over the previous version:

krb5 rebased to version 1.18.2

The krb5 packages have been upgraded to upstream version 1.18.2. Notable fixes and enhancements include:

IdM now supports new Ansible management modules

This update introduces several ansible-freeipa modules for automating common Identity Management (IdM) tasks using Ansible playbooks:

IdM now supports a new Ansible system role for certificate management

Identity Management (IdM) supports a new Ansible system role for automating certificate management tasks. The new role includes the following benefits:

Identity Management now supports FIPS

With this enhancement, you can now use encryption types that are approved by the Federal Information Processing Standard (FIPS) with the authentication mechanisms in Identity Management (IdM). Note that a cross-forest trust between IdM and Active Directory is not FIPS compliant.

OpenDNSSEC in idm:DL1 rebased to version 2.1

The OpenDNSSEC component of the idm:DL1 module stream has been upgraded to the 2.1 version series, which is the current long term upstream support version. OpenDNSSEC is an open source project driving the adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. OpenDNSSEC 2.1 provides a number of bug fixes and enhancements over the previous version. For more information, read the upstream release notes: https://www.opendnssec.org/archive/releases/

IdM now supports the deprecated RC4 cipher suite with a new system-wide cryptographic subpolicy

This update introduces the new AD-SUPPORT cryptographic subpolicy that enables the Rivest Cipher 4 (RC4) cipher suite in Identity Management (IdM).

Adjusting to new Microsoft LDAP channel binding and LDAP signing requirements

With recent Microsoft updates, Active Directory (AD) flags the clients that do not use the default Windows settings for LDAP channel binding and LDAP signing. As a consequence, RHEL systems that use the System Security Services Daemon (SSSD) for direct or indirect integration with AD might trigger error Event IDs in AD upon successful Simple Authentication and Security Layer (SASL) operations that use the Generic Security Services Application Program Interface (GSSAPI).

SSSD, adcli, and realmd now support the deprecated RC4 cipher suite with a new system-wide cryptographic subpolicy

This update introduces the new AD-SUPPORT cryptographic subpolicy that enables the Rivest Cipher 4 (RC4) cipher suite for the following utilities:

authselect has a new minimal profile

The authselect utility has a new minimal profile. You can use this profile to serve only local users and groups directly from system files instead of using other authentication providers. Therefore, you can safely remove the SSSD, winbind, and fprintd packages and can use this profile on systems that require minimal installation to save disk and memory space.

SSSD now updates Samba’s secrets.tdb file when rotating a password

A new ad_update_samba_machine_account_password option in the sssd.conf file is now available in RHEL. You can use it to set SSSD to automatically update the Samba secrets.tdb file when rotating a machine’s domain password while using Samba.

SSSD now enforces AD GPOs by default

The default setting for the SSSD option ad_gpo_access_control is now enforcing. In RHEL 8, SSSD enforces access control rules based on Active Directory Group Policy Objects (GPOs) by default.

Directory Server now supports the pwdReset operation attribute

This enhancement adds support for the pwdReset operation attribute to Directory Server. When an administrator changes the password of a user, Directory Server sets pwdReset in the user’s entry to true. As a result, applications can use this attribute to identify if a password of a user has been reset by an administrator.

Directory Server now logs the work and operation time in RESULT entries

With this update, Directory Server now logs two additional time values in RESULT`entries in the `/var/log/dirsrv/slapd-<instance_name>/access file:

Single-application session is now available

You can now start GNOME in a single-application session, also known as kiosk mode. In this session, GNOME displays only a full-screen window of an application that you have configured.

tigervnc has been rebased to version 1.10.1

The tigervnc suite has been rebased to version 1.10.1. The update contains number of fixes and improvements. Most notably:

Support for new graphics cards

The following graphics cards are now fully supported:

Hardware acceleration with Nvidia Volta and Turing

The nouveau graphics driver now supports hardware acceleration with the Nvidia Volta and Turing GPU families. As a result, the desktop and applications that use 3D graphics now render efficiently on the GPU. Additionally, this frees the CPU for other tasks and improves the overall system responsiveness.

Reduced display tearing on XWayland

The XWayland display back end now enables the XPresent extension. Using XPresent, applications can efficiently update their window content, which reduces display tearing.

Intel Tiger Lake GPUs are now supported

This update adds support for the Intel Tiger Lake family of GPUs. This includes Intel UHD Graphics and Intel Xe GPUs found with the following CPU models: https://ark.intel.com/content/www/us/en/ark/products/codename/88759/tiger-lake.html.

Setting privileges from within the web console session

With this update the web console provides an option to switch between administrative access and limited access from inside of a user session. You can switch between the modes by clicking the Administrative access or Limited access indicator in your web console session.

Improvements to logs searching

With this update, the web console introduces a search box that supports several new ways of how the users can search among logs. The search box supports regular expression searching in log messages, specifying service or searching for entries with specific log fields.

Overview page shows more detailed Insights reports

With this update, when a machine is connected to Red Hat Insights, the Health card in the Overview page in the web console shows more detailed information about number of hits and their priority.

Terminal log role added to RHEL system roles

With this enhancement, a new Terminal log (TLOG) role has been added to RHEL system roles shipped with the rhel-system-roles package. Users can now use the tlog role to setup and configure session recording using Ansible.

RHEL Logging system role is now available for Ansible

With the Logging system role, you can deploy various logging configurations consistently on local and remote hosts. You can configure a RHEL host as a server to collect logs from many client systems.

rhel-system-roles-sap fully supported

The rhel-system-roles-sap package, previously available as a Technology Preview, is now fully supported. It provides Red Hat Enterprise Linux (RHEL) system roles for SAP, which can be used to automate the configuration of a RHEL system to run SAP workloads. These roles greatly reduce the time to configure a system to run SAP workloads by automatically applying the optimal settings that are based on best practices outlined in relevant SAP Notes. Access is limited to RHEL for SAP Solutions offerings. Please contact Red Hat Customer Support if you need assistance with your subscription.

The metrics RHEL system role is now available for Ansible.

With the metrics RHEL system role, you can configure, for local and remote hosts:

rhel-system-roles-sap upgraded

The rhel-system-roles-sap packages have been upgraded to upstream version 2.0.0, which provides multiple bug fixes and enhancements. Notable changes include:

The storage RHEL system role now supports file system management

With this enhancement, administrators can use the storage RHEL system role to:

Migrating a virtual machine to a host with incompatible TSC setting now fails faster

Previously, migrating a virtual machine to a host with incompatible Time Stamp Counter (TSC) setting failed late in the process. With this update, attempting such a migration generates an error before the migration process starts.

Virtualization support for 2nd generation AMD EPYC processors

With this update, virtualization on RHEL 8 adds support for the 2nd generation AMD EPYC processors, also known as EPYC Rome. As a result, virtual machines hosted on RHEL 8 can now use the EPYC-Rome CPU model and utilise new features that the processors provide.

New command: virsh iothreadset

This update introduces the virsh iothreadset command, which can be used to configure dynamic IOThread polling. This makes it possible to set up virtual machines with lower latencies for I/O-intensive workloads at the expense of greater CPU consumption for the IOThread. For specific options, see the virsh man page.

UMIP is now supported by KVM on 10th generation Intel Core processors

With this update, the User-mode Instruction Prevention (UMIP) feature is now supported by KVM for hosts running on 10th generation Intel Core processors, also known as Ice Lake Servers. The UMIP feature issues a general protection exception if certain instructions, such as sgdt, sidt, sldt, smsw, and str, are executed when the Current Privilege Level (CPL) is greater than 0. As a result, UMIP ensures system security by preventing unauthorized applications from accessing certain system-wide settings which can be used to initiate privilege escalation attacks.

The libvirt library now supports Memory Bandwidth Allocation

libvirt now supports Memory Bandwidth Allocation (MBA). With MBA, you can allocate parts of host memory bandwidth in vCPU threads by using the <memorytune> element in the <cputune> section.

RHEL 6 virtual machines now support the Q35 machine type

Virtual machines (VMs) hosted on RHEL 8 that use RHEL 6 as their guest OS can now use Q35, a more modern PCI Express-based machine type. This provides a variety of improvements in features and performance of virtual devices, and ensures that a wider range of modern devices are compatible with RHEL 6 VMs.

All logged QEMU events now have a time stamp. As a result, users can more easily troubleshoot their virtual machines using logs saved in the /var/log/libvirt/qemu/ directory.

QEMU logs now include time stamps for spice-server events

The bochs-display device is now supported

RHEL 8.3 and later introduce the Bochs display device, which is more secure than the currently used stdvga device. Note that all virtual machines (VMs) compatible with bochs-display will use it by default. This mainly includes VMs that use the UEFI interface.

Optimized MDS protection for virtual machines

With this update, a RHEL 8 host can inform its virtual machines (VMs) whether they are vulnerable to Microarchitectural Data Sampling (MDS). VMs that are not vulnerable do not use measures against MDS, which improves their performance.

Creating QCOW2 disk images on RBD now supported

With this update, it is possible to create QCOW2 disk images on RADOS Block Device (RBD) storage. As a result, virtual machines can use RBD servers for their storage back ends with QCOW2 images.

Maximum supported VFIO devices increased to 64

With this update, you can attach up to 64 PCI devices that use VFIO to a single virtual machine on a RHEL 8 host. This is up from 32 in RHEL 8.2 and prior.

discard and write-zeroes commands are now supported in QEMU/KVM

With this update, the discard and write-zeroes commands for virtio-blk are now supported in QEMU/KVM. As a result, virtual machines can use the virtio-blk device to discard unused sectors of an SSD, fill sectors with zeroes when they are emptied, or both. This can be used to increase SSD performance or to ensure that a drive is securely erased.

RHEL 8 now supports IBM POWER 9 XIVE

This update introduces support for the External Interrupt Virtualization Engine (XIVE) feature of IBM POWER9 to RHEL 8. As a result, virtual machines (VMs) running on a RHEL 8 hypervisor on an IBM POWER 9 system can use XIVE, which improves the performance of I/O-intensive VMs.

Control Group v2 support for virtual machines

With this update, the libvirt suite supports control groups v2. As a result, virtual machines hosted on RHEL 8 can take advantage of resource control capabilities of control group v2.

Paravirtualized IPIs are now supported for Windows virtual machines

With this update, the hv_ipi flag has been added to the supported hypervisor enlightenments for Windows virtual machines (VMs). This allows inter-processor interrupts (IPIs) to be sent via a hypercall. As a result, IPIs can be performed faster on VMs running a Windows OS.

Migrating virtual machines with enabled disk cache is now possible

This update makes the RHEL 8 KVM hypervisor compatible with disk cache live migration. As a result, it is now possible to live-migrate virtual machines with disk cache enabled.

macvtap interfaces can now be used by virtual machines in non-privileged sessions

It is now possible for virtual machines (VMs) to use a macvtap interface previously created by a privileged process. Notably, this enables VMs started by the non-privileged user session of libvirtd to use a macvtap interface.

Virtual machines can now use features of 10th generation Intel Core processors

The Icelake-Server and Icelake-Client CPU model names are now available for virtual machines (VMs). On hosts with 10th generation Intel Core processors, using Icelake-Server or Icelake-Client as the CPU type in the XML configuration of a VM makes new features of these CPUs exposed to the VM.

QEMU now supports LUKS encryption

With this update, it is possible to create virtual disks using Linux Unified Key Setup (LUKS) encryption. You can encrypt the disks when creating the storage volume by including the <encryption> field in the virtual machine’s (VM) XML configuration. You can also make the LUKS encrypted virtual disk completely transparent to the VM by including the <encryption> field in the disk’s domain definition in the XML configuration file.

Improved logs for nbdkit

The nbdkit service logging has been modified to be less verbose. As a result, nbdkit logs only potentially important messages, and the logs created during virt-v2v conversions are shorter and easier to parse.

Improved consistency for virtual machines SELinux security labels and permissions

With this update, the libvirt service can record SELinux security labels and permissions associated with files, and restore the labels after modifying the files. As a result, for example, using libguestfs utilities to modify a virtual machine (VM) disk image owned by a specific user no longer changes the image owner to root.

QEMU now uses the gcrypt library for XTS ciphers

With this update, the QEMU emulator has been changed to use the XTS cipher mode implementation provided by the gcrypt library. This improves the I/O performance of virtual machines whose host storage uses QEMU’s native luks encryption driver.

Windows Virtio drivers can now be updated using Windows Updates

With this update, a new standard SMBIOS string is initiated by default when QEMU starts. The parameters provided in the SMBIOS fields make it possible to generate IDs for the virtual hardware running on the virtual machine(VM). As a result, Windows Update can identify the virtual hardware and the RHEL hypervisor machine type, and update the Virtio drivers on VMs running Windows 10+, Windows Server 2016, and Windows Server 2019+.

New command: virsh guestinfo

The virsh guestinfo command has been introduced to RHEL 8.3. This makes it possible to report the following types of information about a virtual machine (VM):

VNNI for BFLOAT16 inputs are now supported by KVM

With this update, Vector Neural Network Instructions (VNNI) supporting BFLOAT16 inputs, also known as AVX512_BF16 instructions, are now supported by KVM for hosts running on the 3rd Gen Intel Xeon scalable processors, also known as Cooper Lake. As a result, guest software can now use the AVX512_BF16 instructions inside virtual machines, by enabling it in the virtual CPU configuration.

New command: virsh pool-capabilities

RHEL 8.3 introduces the virsh pool-capabilities command option. This command displays information that can be used for creating storage pools, as well as storage volumes within each pool, on your host. This includes:

Support for CPUID.1F in virtual machines with Intel Xeon Platinum 9200 series processors

With this update, virtual machines hosted on RHEL 8 can be configured with a virtual CPU topology of multiple dies, using the Extended Topology Enumeration leaf feature (CPUID.1F). This feature is supported by Intel Xeon Platinum 9200 series processors, previously known as Cascade Lake. As a result, it is now possible on hosts that use Intel Xeon Platinum 9200 series processors to create a vCPU topology that mirrors the physical CPU topology of the host.

Virtual machines can now use features of 3rd Generation Intel Xeon Scalable Processors

The Cooperlake CPU model name is now available for virtual machines (VMs). Using Cooperlake as the CPU type in the XML configuration of a VM makes new features from the 3rd Generation Intel Xeon Scalable Processors exposed to the VM, if the host uses this CPU.

Intel Optane persistent memory now supported by KVM

With this update, virtual machines hosted on RHEL 8 can benefit from the Intel Optane persistent memory technology, previously known as Intel Crystal Ridge. Intel Optane persistent memory storage devices provide data center-class persistent memory technology, which can significantly increase transaction throughput.

Virtual machines can now use Intel Processor Trace

With this update, virtual machines (VMs) hosted on RHEL 8 are able to use the Intel Processor Trace (PT) feature. When your host uses a CPU that supports Intel PT, you can use specialized Intel software to collect a variety of metrics about the performance of your VM’s CPU. Note that this also requires enabling the intel-pt feature in the XML configuration of the VM.

DASD devices can now be assigned to virtual machines on IBM Z

Direct-access storage devices (DASDs) provide a number of specific storage features. Using the vfio-ccw feature, you can assign DASDs as mediated devices to your virtual machines (VMs) on IBM Z hosts. This for example makes it possible for the VM to access a z/OS dataset, or to share the assigned DASDs with a z/OS machine.

IBM Secure Execution supported for IBM Z

When using IBM Z hardware to run your RHEL 8 host, you can improve the security of your virtual machines (VMs) by configuring IBM Secure Execution for the VMs. IBM Secure Execution, also known as Protected Virtualization, prevents the host system from accessing a VM’s state and memory contents.

cloud-utils-growpart rebased to 0.31

The cloud-utils-growpart package has been upgraded to version 0.31, which provides multiple bug fixes and enhancements. Notable changes include:

skopeo container image is now available

The registry.redhat.io/rhel8/skopeo container image is a containerized implementation of the skopeo package. The skopeo tool is a command-line utility that performs various operations on container images and image repositories. This container image allows you to inspect container images in a registry, to remove a container image from a registry, and to copy container images from one unauthenticated container registry to another. To pull the registry.redhat.io/rhel8/skopeo container image, you need an active Red Hat Enterprise Linux subscription.

buildah container image is now available

The registry.redhat.io/rhel8/buildah container image is a containerized implementation of the buildah package. The buildah tool facilitates building OCI container images. This container image allows you to build container images without the need to install the buildah package on your system. The use-case does not cover running this image in rootless mode as a non-root user. To pull the registry.redhat.io/rhel8/buildah container image, you need an active Red Hat Enterprise Linux subscription.

Podman v2.0 RESTful API is now available

The new REST based Podman 2.0 API replaces the old remote API based on the varlink library. The new API works in both a rootful and a rootless environment and provides a docker compatibility layer.

Installing Podman does not require container-selinux

With this enhancement, the installation of the container-selinux package is now optional during the container build. As a result, Podman has fewer dependencies on other packages.

RHEL 8 initial setup now works properly via SSH

Previously, the RHEL 8 initial setup interface did not display when logged in to the system using SSH. As a consequence, it was impossible to perform the initial setup on a RHEL 8 machine managed via SSH. This problem has been fixed, and RHEL 8 initial setup now works correctly when performed via SSH.

Installation failed when using the reboot --kexec command

Previously, the RHEL 8 installation failed when a Kickstart file that contained the reboot --kexec command was used.

America/New York time zone can now be set correctly

Previously, the interactive Anaconda installation process did not allow users to set the America/New York time zone when using a kickstart file. With this update, users can now set America/New York as the preferred time zone in the interactive installer if a time zone is not specified in the kickstart file.

SELinux contexts are now set correctly

Previously, when SELinux was in enforcing mode, incorrect SELinux contexts on some folders and files resulted in unexpected AVC denials when attempting to access these files after installation.

Automatic partitioning now creates a valid /boot partition

Previously, when installing RHEL on a system using automatic partitioning or using a kickstart file with preconfigured partitions, the installer created a partitioning scheme that could contain an invalid /boot partition. Consequently, the automatic installation process ended prematurely because the verification of the partitioning scheme failed. With this update, Anaconda creates a partitioning scheme that contains a valid /boot partition. As a result, the automatic installation completes as expected.

A GUI installation using the Binary DVD ISO image now completes successfully without CDN registration

Previously, when performing a GUI installation using the Binary DVD ISO image file, a race condition in the installer prevented the installation from proceeding until you registered the system using the Connect to Red Hat feature.

iSCSI or FCoE devices created in Kickstart and used in ignoredisk --only-use command no longer stop the installation process

Previously, when the iSCSI or FCoE devices created in Kickstart were used in the ignoredisk --only-use command, the installation program failed with an error similar to Disk "disk/by-id/scsi-360a9800042566643352b476d674a774a" given in ignoredisk command does not exist. This stopped the installation process.

System registration using CDN failed with the error message Name or service not known

When you attempted to register a system using the Content Delivery Network (CDN), the registration process failed with the error message Name or service not known.

dnf-automatic now updates only packages with correct GPG signatures

Previously, the dnf-automatic configuration file did not check GPG signatures of downloaded packages before performing an update. As a consequence, unsigned updates or updates signed by key which was not imported could be installed by dnf-automatic even though repository configuration requires GPG signature check (gpgcheck=1). With this update, the problem has been fixed, and dnf-automatic checks GPG signatures of downloaded packages before performing the update. As a result, only updates with correct GPG signatures are installed from repositories that require GPG signature check.

Trailing comma no longer causes entries removal in an append type option

Previously, adding a trailing comma (an empty entry at the end of the list) to an append type option (for example, exclude, excludepkgs, includepkgs) caused all entries in the option to be removed. Also, adding two commas (an empty entry) caused that only entries after the commas were used.

The ReaR disk layout no longer includes entries for Rancher 2 Longhorn iSCSI devices and file systems

This update removes entries for Rancher 2 Longhorn iSCSI devices and file systems from the disk layout created by ReaR.

Rescue image creation with a file larger than 4 GB is now enabled on IBM POWER, little endian

Previously, the ReaR utility could not create rescue images containing files larger than 4GB on IBM POWER, little endian architecture. With this update, the problem has been fixed, and it is now possible to create a rescue image with a file larger than 4 GB on IBM POWER, little endian.

SELinux no longer prevents systemd-journal-gatewayd to call newfstatat() on /dev/shm/ files used by corosync

Previously, SELinux policy did not contain a rule that allows the systemd-journal-gatewayd daemon to access files created by the corosync service. As a consequence, SELinux denied systemd-journal-gatewayd to call the newfstatat() function on shared memory files created by corosync. With this update, SELinux no longer prevents systemd-journal-gatewayd to call newfstatat() on shared memory files created by corosync.

Libreswan now works with seccomp=enabled on all configurations

Prior to this update, the set of allowed syscalls in the Libreswan SECCOMP support implementation did not match new usage of RHEL libraries. Consequently, when SECCOMP was enabled in the ipsec.conf file, the syscall filtering rejected even syscalls required for the proper functioning of the pluto daemon; the daemon was killed, and the ipsec service was restarted. With this update, all newly required syscalls have been allowed, and Libreswan now works with the seccomp=enabled option correctly.

SELinux no longer prevents auditd to halt or power off the system

Previously, the SELinux policy did not contain a rule that allows the Audit daemon to start a power_unit_file_t systemd unit. Consequently, auditd could not halt or power off the system even when configured to do so in cases such as no space left on a logging disk partition.

IPTABLES_SAVE_ON_STOP now works correctly

Previously, the IPTABLES_SAVE_ON_STOP feature of the iptables service did not work because files with saved IP tables content received incorrect SELinux context. This prevented the iptables script from changing permissions, and the script subsequently failed to save the changes. This update defines a proper context for the iptables.save and ip6tables.save files, and creates a filename transition rule. As a consequence, the IPTABLES_SAVE_ON_STOP feature of the iptables service works correctly.

NSCD databases can now use different modes

Domains in the nsswitch_domain attribute are allowed access to Name Service Cache Daemon (NSCD) services. Each NSCD database is configured in the nscd.conf file, and the shared property determines whether the database uses Shared memory or Socket mode. Previously, all NSCD databases had to use the same access mode, depending on the nscd_use_shm boolean value. Now, using Unix stream socket is always allowed, and therefore different NSCD databases can use different modes.

The oscap-ssh utility now works correctly when scanning a remote system with --sudo

When performing a Security Content Automation Protocol (SCAP) scan of a remote system using the oscap-ssh tool with the --sudo option, the oscap tool on the remote system saves scan result files and report files into a temporary directory as the root user. Previously, if the umask settings on the remote machine were changed, oscap-ssh might have been prevented access to these files. This update fixes the issue, and as a result, oscap saves the files as the target user, and oscap-ssh accesses the files normally.

OpenSCAP now handles remote file systems correctly

Previously, OpenSCAP did not reliably detect remote file systems if their mount specification did not start with two slashes. As a consequence, OpenSCAP handled some network-based file systems as local. With this update, OpenSCAP identifies file systems using the file-system type instead of the mount specification. As a result, OpenSCAP now handles remote file systems correctly.

OpenSCAP no longer removes blank lines from YAML multi-line strings

Previously, OpenSCAP removed blank lines from YAML multi-line strings within generated Ansible remediations from a datastream. This affected Ansible remediations and caused the openscap utility to fail the corresponding Open Vulnerability and Assessment Language (OVAL) checks, producing false positive results. The issue is now fixed and as a result, openscap no longer removes blank lines from YAML multi-line strings.

OpenSCAP can now scan systems with large numbers of files without running out of memory

Previously, when scanning systems with low RAM and large numbers of files, the OpenSCAP scanner sometimes caused the system to run out of memory. With this update, OpenSCAP scanner memory management has been improved. As a result, the scanner no longer runs out of memory on systems with low RAM when scanning large numbers of files, for example package groups Server with GUI and Workstation.

config.enabled now controls statements correctly

Previously, the rsyslog incorrectly evaluated the config.enabled directive during the configuration processing of a statement. As a consequence, the parameter not known errors were displayed for each statement except for the include() one. With this update, the configuration is processed for all statements equally. As a result, config.enabled now correctly disables or enables statements without displaying any error.

fapolicyd no longer prevents RHEL updates

When an update replaces the binary of a running application, the kernel modifies the application binary path in memory by appending the " (deleted)" suffix. Previously, the fapolicyd file access policy daemon treated such applications as untrusted, and prevented them from opening and executing any other files. As a consequence, the system was sometimes unable to boot after applying updates.

The e8 profile can now be used to remediate RHEL 8 systems with Server with GUI

Using the OpenSCAP Anaconda Add-on to harden the system on the Server With GUI package group with profiles that select rules from the Verify Integrity with RPM group no longer requires an extreme amount of RAM on the system. The cause of this problem was the OpenSCAP scanner. For more details, see Scanning large numbers of files with OpenSCAP causes systems to run out of memory. As a consequence, the hardening of the system using the RHEL 8 Essential Eight (e8) profile now works also with Server With GUI.

Automatic loading of iptables extension modules by the nft_compat module no longer hangs

Previously, when the nft_compat module loaded an extension module while an operation on network name spaces (netns) happened in parallel, a lock collision could occur if that extension registered a pernet subsystem during initialization. As a consequence, the kernel-called modprobe command hang. This could also be caused by other services, such as libvirtd, that also execute iptables commands. This problem has been fixed. As a result, loading iptables extension modules by the nft_compat module no longer hangs.

The firewalld service now removes ipsets when the service stops

Previously, stopping the firewalld service did not remove ipsets. This update fixes the problem. As a result, ipsets are no longer left in the system after firewalld stops.

firewalld no longer retains ipset entries after shutdown

Previously, shutting down firewalld did not remove ipset entries. Consequently, ipset entries remained active in the kernel even after stopping the firewalld service. With this fix, shutting down firewalld removes ipset entries as expected.

firewalld now restores ipset entries after reloading

Previously, firewalld did not retain runtime ipset entries after reloading. Consequently, users had to manually add the missing entries again. With this update, firewalld has been modified to restore ipset entries after reloading.

nftables and firewalld services are now mutually exclusive

Previously, it was possible to enable nftables and firewalld services at the same time. As a consequence, nftables was overriding firewalld rulesets. With this update, nftables and firewalld services are now mutually exclusive so that these cannot be enabled at the same time.

The huge_page_setup_helper.py script now works correctly

A patch that updated the huge_page_setup_helper.py script for Python 3 was accidentally removed. Consequently, after executing huge_page_setup_helper.py, the following error message appeared:

Systems with a large amount of persistent memory boot more quickly and without timeouts

Systems with a large amount of persistent memory took a long time to boot because the original source code allowed for just one initialization thread per node. For example, for a 4-node system there were 4 memory initialization threads. Consequently, if there were persistent memory file systems listed in the /etc/fstab file, the system could time out while waiting for devices to become available. With this update, the problem has been fixed because the source code now allows for multiple memory initialization threads within a single node. As a result, the systems boot more quickly and no timeouts appear in the described scenario.

The bcc scripts now successfully compile a BPF module

During the script code compilation to create a Berkeley Packet Filter (BPF) module, the bcc toolkit used kernel headers for data type definition. Some kernel headers needed the KBUILD_MODNAME macro to be defined. Consequently, those bcc scripts that did not add KBUILD_MODNAME, were likely to fail to compile a BPF module across various CPU architectures. The following bcc scripts were affected:

bcc-tools and bpftrace work properly on IBM Z

Previously, a feature backport introduced the ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE kernel option. However, the bcc-tools package and bpftrace tracing language package for IBM Z architectures did not have proper support for this option. Consequently, the bpf() system call failed with the Invalid argument exception and bpftrace failed with an error stating Error loading program when trying to load the BPF program. With this update, the ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE option is now removed. As a result, the problem no longer appears in the described scenario.

Boot process no longer fails due to lack of entropy

Previously, the boot process failed due to lack of entropy. A better mechanism is now used to allow the kernel to gather entropy early in the boot process, which does not depend on any hardware specific interrupts. This update fixes the problem by ensuring availability of sufficient entropy to secure random generation in early boot. As a result, the fix prevents kickstart timeout or slow boots and the boot process works as expected.

Repeated reboots using kexec now work as expected

Previously, during the kernel reboot on the Amazon EC2 Nitro platform, the remove module (rmmod) was not called during the shutdown() call of the kernel execution path. Consequently, repeated kernel reboots using the kexec system call led to a failure. With this update, the issue has been fixed by adding the PCI shutdown() handler that allows safe kernel execution. As a result, repeated reboots using kexec on Amazon EC2 Nitro platforms no longer fail.

Repeated reboots using vPMEM memory as dump target now works as expected

Previously, using Virtual Persistent Memory (vPMEM) namespaces as dump target for kdump or fadump caused the papr_scm module to unmap and remap the memory backed by vPMEM and re-add the memory to its linear map.

Attempting to add ICE driver NIC port to a mode 5 bonding master interface no longer fails

Previously, attempting to add the ICE driver NIC port to a mode 5 (balance-tlb) bonding master interface led to a failure with an error Master 'bond0', Slave 'ens1f0': Error: Enslave failed. Consequently, you experienced an intermittent failure to add the NIC port to the bonding master interface. This update fixes the issue and adding the interface no longer fails.

The cxgb4 driver no longer causes crash in the kdump kernel

Previously, the kdump kernel would crash while trying to save information in the vmcore file. Consequently, the cxgb4 driver prevented the kdump kernel from saving a core for later analysis. To work around this problem, add the novmcoredd parameter to the kdump kernel command line to allow saving core files.

When a GFS2 file system is used with the Filesystem agent the fast_stop option now defaults to no

Previously, when a GFS2 file system was used with the Filesystem agent, the fast_stop option defaulted to yes. This value could result in unnecessary fence events due to the length of time it can take a GFS2 file system to unmount. With this update, this option defaults to no. For all other file systems it continues to default to yes.

fence_compute and fence_evacuate agents now interpret insecure option in a more standard way

Previously, the fence_compute and fence_evacuate agents worked as if --insecure was specified by default. With this update, customers who do not use valid certificates for their compute or evacuate services must set insecure=true and use the --insecure option when running manually from the CLI. This is consistent with the behavior of all other agents.

Optimized CPU consumption by libdb

A previous update to the libdb database caused an excessive CPU consumption in the trickle thread. With this update, the CPU usage has been optimized.

The did_you_mean Ruby gem no longer contains a file with a non-commercial license

Previously, the did_you_mean gem available in the ruby:2.5 module stream contained a file with a non-commercial license. This update removes the affected file.

nginx can now load server certificates from hardware security tokens through the PKCS#11 URI

The ssl_certificate directive of the nginx web server supports loading TLS server certificates from hardware security tokens directly from PKCS#11 modules. Previously, it was impossible to load server certificates from hardware security tokens through the PKCS#11 URI.

The glibc dynamic loader no longer fails while loading a shared library that uses DT_FILTER and has a constructor

Prior to this update, a defect in the dynamic loader implementation of shared objects as filters caused the dynamic loader to fail while loading a shared library that uses a filter and has a constructor. With this release, the dynamic loader implementation of filters (DT_FILTER) has been fixed to correctly handle such shared libraries. As a result, the dynamic loader now works as expected in the mentioned scenario.

glibc can now remove pseudo-mounts from the getmntent() list

The kernel includes automount pseudo-entries in the tables exposed to userspace. Consequently, programs that use the getmntent() API see both regular mounts and these pseudo-mounts in the list. The pseudo-mounts do not correspond to real mounts, nor include valid information.

The movv1qi pattern no longer causes miscompilation in the auto-vectorized code on IBM Z

Prior to this update, wrong load instructions were emitted for the movv1qi pattern. As a consequence, when auto-vectorization was in effect, a miscompilation could occur on IBM Z systems. This update fixes the movv1qi pattern, and as a result, code compiles and runs correctly now.

PAPI_event_name_to_code() now works correctly in multiple threads

Prior to this update, the PAPI internal code did not handle thread coordination properly. As a consequence, when multiple threads used the PAPI_event_name_to_code() operation, a race condition occurred and the operation failed. This update enhances the handling of multiple threads in the PAPI internal code. As a result, multithreaded code using the PAPI_event_name_to_code() operation now works correctly.

Improved performance for the glibc math functions on IBM Power Systems

Previously, the glibc math functions performed unnecessary floating point status updates and system calls on IBM Power Systems, which negatively affected the performance. This update removes the unnecessary floating point status update, and improves the implementations of: ceil(), ceilf(), fegetmode(), fesetmode(), fesetenv(), fegetexcept(), feenableexcept(), fedisablexcept(), fegetround() and fesetround(). As a result, the performance of the math library is improved on IBM Power Systems.

Memory protection keys are now supported on IBM Power

On IBM Power Systems, the memory protection key interfaces pkey_set and pkey_get were previously stub functions, and consequently always failed. This update implements the interfaces, and as a result, the GNU C Library (glibc) now supports memory protection keys on IBM Power Systems.

papi-testsuite and papi-devel now install the required papi-libs package

Previously, the papi-testsuite and papi-devel RPM packages did not declare a dependency on the matching papi-libs package. Consequently, the tests failed to run, and developers did not have the required version of the papi shared library available for their applications.

Installing the lldb packages for multiple architectures no longer leads to file conflicts

Previously, the lldb packages installed architecture-dependent files in architecture-independent locations. As a consequence, installing both 32-bit and 64-bit versions of the packages led to file conflicts. This update packages the files in correct architecture-dependent locations. As a result, the installation of lldb in the described scenario completes successfully.

getaddrinfo now correctly handles a memory allocation failure

Previously, after a memory allocation failure, the getaddrinfo function of the GNU C Library glibc did not release the internal resolver context. As a consequence, getaddrinfo was not able to reload the /etc/resolv.conf file for the rest of the lifetime of the calling thread, resulting in a possible memory leak.

glibc avoids certain failures caused by IFUNC resolver ordering

Previously, the implementation of the librt and libpthread libraries of the GNU C Library glibc contained the indirect function (IFUNC) resolvers for the following functions: clock_gettime, clock_getcpuclockid, clock_nanosleep, clock_settime, vfork. In some cases, the IFUNC resolvers could execute before the librt and libpthread libraries were relocated. Consequently, applications would fail in the glibc dynamic loader during early program startup.

Assertion failures no longer occur during pthread_create

Previously, the glibc dynamic loader did not roll back changes to the internal Thread Local Storage (TLS) module ID counter. As a consequence, an assertion failure in the pthread_create function could occur after the dlopen function had failed in certain ways. With this fix, the glibc dynamic loader updates the TLS module ID counter at a later point in time, after certain failures can no longer happen. As a result, the assertion failures no longer occur.

glibc now installs correct dependencies for 32-bit applications using nss_db

Previously, the nss_db.x86_64 package did not declare dependencies on the nss_db.i686 package. Therefore automated installation did not install nss_db.i686 on the system, despite having a 32-bit environment glibc.i686 installed. As a consequence, 32-bit applications using nss_db failed to perform accurate user database lookups, while 64-bit applications in the same setup worked correctly.

glibc locale information updated with Odia language

The name of Indian state previously known as Orissa has changed to Odisha, and the name of its official language has changed from Oriya to Odia. With this update, the glibc locale information reflects the new name of the language.

LLVM sub packages now install arch-dependent files in arch-dependent locations

Previously, LLVM sub packages installed arch-dependent files in arch-independent locations. This resulted in conflicts when installing 32 and 64 bit versions of LLVM. With this update, package files are now correctly installed in arch-dependent locations, avoiding version conflicts.

Password and group lookups no longer fail in glibc

Previously, the nss_compat module of the glibc library overwrote the errno status with incorrect error codes during processing of password and group entries. Consequently, applications did not resize buffers as expected, causing password and group lookups to fail. This update fixes the problem, and the lookups now complete as expected.

SSSD no longer downloads every rule with a wildcard character by default

Previously, the ldap_sudo_include_regexp option was incorrectly set to true by default. As a consequence, when SSSD started running or after updating SSSD rules, SSSD downloaded every rule that contained a wildcard character (*) in the sudoHost attribute. This update fixes the bug, and the ldap_sudo_include_regexp option is now properly set to false by default. As a result, the described problem no longer occurs.

krb5 now only requests permitted encryption types

Previously, permitted encryption types specified in the permitted_enctypes variable in the /etc/krb5.conf file did not apply to the default encryption types if the default_tgs_enctypes or default_tkt_enctypes attributes were not set. Consequently, Kerberos clients were able to request deprecated cipher suites like RC4, which may cause other processes to fail. With this update, encryption types specified in the permitted_enctypes variable apply to the default encryption types as well, and only permitted encryption types are requested.

KDCs now correctly enforce password lifetime policy from LDAP backends

Previously, non-IPA Kerberos Distribution Centers (KDCs) did not ensure maximum password lifetimes because the Kerberos LDAP backend incorrectly enforced password policies. With this update, the Kerberos LDAP backend has been fixed, and password lifetimes behave as expected.

Password expiration notifications sent to AD clients using SSSD

Previously, Active Directory clients (non-IdM) using SSSD were not sent password expiration notices because of a recent change in the SSSD interface for acquiring Kerberos credentials.

Directory Server no longer leaks memory when using indirect COS definitions

Previously, after processing an indirect Class Of Service (COS) definition, Directory Server leaked memory for each search operation that used an indirect COS definition. With this update, Directory Server frees all internal COS structures associated with the database entry after it has been processed. As a result, the server no longer leaks memory when using indirect COS definitions.

Adding ID overrides of AD users now works in IdM Web UI

Previously, adding ID overrides of Active Directory (AD) users to Identity Management (IdM) groups in the Default Trust View for the purpose of granting access to management roles failed when using the IdM Web UI. This update fixes the bug. As a result, you can now use both the Web UI as well as the IdM command-line interface (CLI) in this scenario.

FreeRADIUS no longer generates certificates during package installation

Previously, FreeRADIUS generated certificates during package installation, resulting in the following issues:

FreeRADIUS now generates FIPS-compliant Diffie-Hellman parameters

Due to new FIPS requirements that do not allow openssl to generate Diffie-Hellman (dh) parameters via dhparam, the dh parameter generation has been removed from the FreeRADIUS bootstrap scripts and the file, rfc3526-group-18-8192.dhparam, is included with the FreeRADIUS packages for all systems, and thus enables FreeRADIUS to start in FIPS mode.

Updating Healthcheck now properly updates both ipa-healthcheck-core and ipa-healthcheck

Previously, entering yum update healthcheck did not update the ipa-healthcheck package but replaced it with the ipa-healthcheck-core package. As a consequence, the ipa-healthcheck command did not work after the update.

Laptops with hybrid Nvidia GPUs can now successfully resume from suspend

Previously, the nouveau graphics driver sometimes could not power on hybrid Nvidia GPUs on certain laptops from power-save mode. As a result, the laptops failed to resume from suspend.

Migrating virtual machines with the default CPU model now works more reliably

Previously, if a virtual machine (VM) was created without a specific CPU model, QEMU used a default model that was not visible to the libvirt service. As a consequence, it was possible to migrate the VM to a host that did not support the default CPU model of the VM, which sometimes caused crashes and incorrect behavior in the guest OS after the migration.

Notes on FIPS support with Podman

The Federal Information Processing Standard (FIPS) requires certified modules to be used. Previously, Podman correctly installed certified modules in containers by enabling the proper flags at startup. However, in this release, Podman does not properly set up the additional application helpers normally provided by the system in the form of the FIPS system-wide crypto-policy. Although setting the system-wide crypto-policy is not required by the certified modules it does improve the ability of applications to use crypto modules in compliant ways. To work around this problem, change your container to run the update-crypto-policies --set FIPS command before any other application code was executed. The update-crypto-policies --set FIPS command is no longer required with this fix.

Enabled the xt_u32 Netfilter module

The xt_u32 Netfilter module is now available in the kernel-modules-extra rpm. This module helps in packet forwarding based on the data that is inaccessible to other protocol-based packet filters and thus eases manual migration to nftables. However, xt_u32 Netfilter module is not supported by Red Hat.

nmstate available as a Technology Preview

Nmstate is a network API for hosts. The nmstate packages, available as a Technology Preview, provide a library and the nmstatectl command-line utility to manage host network settings in a declarative manner. The networking state is described by a pre-defined schema. Reporting of the current state and changes to the desired state both conform to the schema.

AF_XDP available as a Technology Preview

Address Family eXpress Data Path (AF_XDP) socket is designed for high-performance packet processing. It accompanies XDP and grants efficient redirection of programmatically selected packets to user space applications for further processing.

XDP available as a Technology Preview

The eXpress Data Path (XDP) feature, which is available as a Technology Preview, provides a means to attach extended Berkeley Packet Filter (eBPF) programs for high-performance packet processing at an early point in the kernel ingress data path, allowing efficient programmable packet analysis, filtering, and manipulation.

KTLS available as a Technology Preview

In Red Hat Enterprise Linux 8, Kernel Transport Layer Security (KTLS) is provided as a Technology Preview. KTLS handles TLS records using the symmetric encryption or decryption algorithms in the kernel for the AES-GCM cipher. KTLS also provides the interface for offloading TLS record encryption to Network Interface Controllers (NICs) that support this functionality.

XDP features that are available as Technology Preview

Red Hat provides the usage of the following eXpress Data Path (XDP) features as unsupported Technology Preview:

act_mpls module available as a Technology Preview

The act_mpls module is now available in the kernel-modules-extra rpm as a Technology Preview. The module allows the application of Multiprotocol Label Switching (MPLS) actions with Traffic Control (TC) filters, for example, push and pop MPLS label stack entries with TC filters. The module also allows the Label, Traffic Class, Bottom of Stack, and Time to Live fields to be set independently.

Multipath TCP is now available as a Technology Preview

Multipath TCP (MPTCP), an extension to TCP, is now available as a Technology Preview. MPTCP improves resource usage within the network and resilience to network failure. For example, with Multipath TCP on the RHEL server, smartphones with MPTCP v1 enabled can connect to an application running on the server and switch between Wi-Fi and cellular networks without interrupting the connection to the server.

The systemd-resolved service is now available as a Technology Preview

The systemd-resolved service provides name resolution to local applications. The service implements a caching and validating DNS stub resolver, an Link-Local Multicast Name Resolution (LLMNR), and Multicast DNS resolver and responder.

The kexec fast reboot feature is available as Technology Preview

The kexec fast reboot feature continues to be available as a Technology Preview. kexec fast reboot significantly speeds the boot process by allowing the kernel to boot directly into the second kernel without passing through the Basic Input/Output System (BIOS) first. To use this feature:

eBPF available as a Technology Preview

Extended Berkeley Packet Filter (eBPF) is an in-kernel virtual machine that allows code execution in the kernel space, in the restricted sandbox environment with access to a limited set of functions.

The igc driver available as a Technology Preview for RHEL 8

The igc Intel 2.5G Ethernet Linux wired LAN driver is now available on all architectures for RHEL 8 as a Technology Preview. The ethtool utility also supports igc wired LANs.

Soft-RoCE available as a Technology Preview

Remote Direct Memory Access (RDMA) over Converged Ethernet (RoCE) is a network protocol which implements RDMA over Ethernet. Soft-RoCE is the software implementation of RoCE which supports two protocol versions, RoCE v1 and RoCE v2. The Soft-RoCE driver, rdma_rxe, is available as an unsupported Technology Preview in RHEL 8.

NVMe/TCP is available as a Technology Preview

Accessing and sharing Nonvolatile Memory Express (NVMe) storage over TCP/IP networks (NVMe/TCP) and its corresponding nvme-tcp.ko and nvmet-tcp.ko kernel modules have been added as a Technology Preview.

File system DAX is now available for ext4 and XFS as a Technology Preview

In Red Hat Enterprise Linux 8, file system DAX is available as a Technology Preview. DAX provides a means for an application to directly map persistent memory into its address space. To use DAX, a system must have some form of persistent memory available, usually in the form of one or more Non-Volatile Dual In-line Memory Modules (NVDIMMs), and a file system that supports DAX must be created on the NVDIMM(s). Also, the file system must be mounted with the dax mount option. Then, an mmap of a file on the dax-mounted file system results in a direct mapping of storage into the application’s address space.

OverlayFS

OverlayFS is a type of union file system. It enables you to overlay one file system on top of another. Changes are recorded in the upper file system, while the lower file system remains unmodified. This allows multiple users to share a file-system image, such as a container or a DVD-ROM, where the base image is on read-only media.

Stratis is now available as a Technology Preview

Stratis is a new local storage manager. It provides managed file systems on top of pools of storage with additional features to the user.

IdM now supports setting up a Samba server on an IdM domain member as a Technology Preview

With this update, you can now set up a Samba server on an Identity Management (IdM) domain member. The new ipa-client-samba utility provided by the same-named package adds a Samba-specific Kerberos service principal to IdM and prepares the IdM client. For example, the utility creates the /etc/samba/smb.conf with the ID mapping configuration for the sss ID mapping back end. As a result, administrators can now set up Samba on an IdM domain member.

Local mode version of pcs cluster setup command available as a technology preview

By default, the pcs cluster setup command automatically synchronizes all configuration files to the cluster nodes. In Red Hat Enterprise Linux 8.3, the pcs cluster setup command provides the --corosync-conf option as a technology preview. Specifying this option switches the command to local mode. In this mode, pcs creates a corosync.conf file and saves it to a specified file on the local node only, without communicating with any other node. This allows you to create a corosync.conf file in a script and handle that file by means of the script.

Pacemaker podman bundles available as a Technology Preview

Pacemaker container bundles now run on the podman container platform, with the container bundle feature being available as a Technology Preview. There is one exception to this feature being Technology Preview: Red Hat fully supports the use of Pacemaker bundles for Red Hat Openstack.

Heuristics in corosync-qdevice available as a Technology Preview

Heuristics are a set of commands executed locally on startup, cluster membership change, successful connect to corosync-qnetd, and, optionally, on a periodic basis. When all commands finish successfully on time (their return error code is zero), heuristics have passed; otherwise, they have failed. The heuristics result is sent to corosync-qnetd where it is used in calculations to determine which partition should be quorate.

New fence-agents-heuristics-ping fence agent

As a Technology Preview, Pacemaker now supports the fence_heuristics_ping agent. This agent aims to open a class of experimental fence agents that do no actual fencing by themselves but instead exploit the behavior of fencing levels in a new way.

Identity Management JSON-RPC API available as Technology Preview

An API is available for Identity Management (IdM). To view the API, IdM also provides an API browser as Technology Preview.

DNSSEC available as Technology Preview in IdM

Identity Management (IdM) servers with integrated DNS now support DNS Security Extensions (DNSSEC), a set of extensions to DNS that enhance security of the DNS protocol. DNS zones hosted on IdM servers can be automatically signed using DNSSEC. The cryptographic keys are automatically generated and rotated.

GNOME for the 64-bit ARM architecture available as a Technology Preview

The GNOME desktop environment is now available for the 64-bit ARM architecture as a Technology Preview. This enables administrators to configure and manage servers from a graphical user interface (GUI) remotely, using the VNC session.

GNOME desktop on IBM Z is available as a Technology Preview

The GNOME desktop, including the Firefox web browser, is now available as a Technology Preview on the IBM Z architecture. You can now connect to a remote graphical session running GNOME using VNC to configure and manage your IBM Z servers.

VNC remote console available as a Technology Preview for the 64-bit ARM architecture

On the 64-bit ARM architecture, the Virtual Network Computing (VNC) remote console is available as a Technology Preview. Note that the rest of the graphics stack is currently unverified for the 64-bit ARM architecture.

Intel Tiger Lake graphics available as a Technology Preview

Intel Tiger Lake UP3 and UP4 Xe graphics are now available as a Technology Preview.

The postfix role of RHEL system roles available as a Technology Preview

Red Hat Enterprise Linux system roles provides a configuration interface for Red Hat Enterprise Linux subsystems, which makes system configuration easier through the inclusion of Ansible Roles. This interface enables managing system configurations across multiple versions of Red Hat Enterprise Linux, as well as adopting new major releases.

KVM virtualization is usable in RHEL 8 Hyper-V virtual machines

As a Technology Preview, nested KVM virtualization can now be used on the Microsoft Hyper-V hypervisor. As a result, you can create virtual machines on a RHEL 8 guest system running on a Hyper-V host.

AMD SEV for KVM virtual machines

As a Technology Preview, RHEL 8 introduces the Secure Encrypted Virtualization (SEV) feature for AMD EPYC host machines that use the KVM hypervisor. If enabled on a virtual machine (VM), SEV encrypts VM memory so that the host cannot access data on the VM. This increases the security of the VM if the host is successfully infected by malware.

Intel vGPU

As a Technology Preview, it is now possible to divide a physical Intel GPU device into multiple virtual devices referred to as mediated devices. These mediated devices can then be assigned to multiple virtual machines (VMs) as virtual GPUs. As a result, these VMs share the performance of a single physical Intel GPU.

Creating nested virtual machines

Nested KVM virtualization is provided as a Technology Preview for KVM virtual machines (VMs) running on AMD64 and IBM Z systems hosts with RHEL 8. With this feature, a RHEL 7 or RHEL 8 VM that runs on a physical RHEL 8 host can act as a hypervisor, and host its own VMs.

Select Intel network adapters now support SR-IOV in RHEL guests on Hyper-V

As a Technology Preview, Red Hat Enterprise Linux guest operating systems running on a Hyper-V hypervisor can now use the single-root I/O virtualization (SR-IOV) feature for Intel network adapters supported by the ixgbevf and iavf drivers. This feature is enabled when the following conditions are met:

podman container image is available as a Technology Preview

The registry.redhat.io/rhel8/podman container image is a containerized implementation of the podman package. The podman tool is used for managing containers and images, volumes mounted into those containers, and pods made from groups of containers. Podman is based on the libpod library for container lifecycle management. The libpod library provides APIs for managing containers, pods, container images, and volumes. This container image allows create, modify and run container images without the need to install the podman package on your system. The use-case does not cover running this image in rootless mode as a non-root user. To pull the registry.redhat.io/rhel8/podman container image, you need an active Red Hat Enterprise Linux subscription.

crun is available as a Technology Preview

The crun OCI runtime has been added to the container-rools:rhl8 module. The crun provides an access to run with cgoupsV2. The crun supports an annotation that allows the container to access the rootless users additional groups. This is useful for volume mounting in a directory that the user only have group access to, or the directory is setgid on it.

The podman-machine command is unsupported

The podman-machine command for managing virtual machines, is available only as a Technology Preview. Instead, run Podman directly from the command line.

Several Kickstart commands and options have been deprecated

Using the following commands and options in RHEL 8 Kickstart files will print a warning in the logs.

The --interactive option of the ignoredisk Kickstart command has been deprecated

Using the --interactive option in future releases of Red Hat Enterprise Linux will result in a fatal installation error. It is recommended that you modify your Kickstart file to remove the option.

lorax-composer back end for Image Builder is deprecated in RHEL 8

The previous back end lorax-composer for Image Builder is considered deprecated. It will only receive select fixes for the rest of the Red Hat Enterprise Linux 8 life cycle and will be omitted from future major releases.  Red Hat recommends that you uninstall lorax-composer the and install osbuild-composer back end instead.

rpmbuild --sign is deprecated

With this update, the rpmbuild --sign command has become deprecated. Using this command in future releases of Red Hat Enterprise Linux can result in an error. It is recommended that you use the rpmsign command instead.

Metalink support for curl has been disabled.

A flaw was found in curl functionality in the way it handles credentials and file hash mismatch for content downloaded using the Metalink. This flaw allows malicious actors controlling a hosting server to:

mailman is deprecated

With this update, the mailman packages have been marked as deprecated and will not be available in the future major releases of Red Hat Enterprise Linux.

NSS SEED ciphers are deprecated

The Mozilla Network Security Services (NSS) library will not support TLS cipher suites that use a SEED cipher in a future release. To ensure smooth transition of deployments that rely on SEED ciphers when NSS removes support, Red Hat recommends enabling support for other cipher suites.

TLS 1.0 and TLS 1.1 are deprecated

The TLS 1.0 and TLS 1.1 protocols are disabled in the DEFAULT system-wide cryptographic policy level. If your scenario, for example, a video conferencing application in the Firefox web browser, requires using the deprecated protocols, switch the system-wide cryptographic policy to the LEGACY level:

DSA is deprecated in RHEL 8

The Digital Signature Algorithm (DSA) is considered deprecated in Red Hat Enterprise Linux 8. Authentication mechanisms that depend on DSA keys do not work in the default configuration. Note that OpenSSH clients do not accept DSA host keys even in the LEGACY system-wide cryptographic policy level.

SSL2 Client Hello has been deprecated in NSS

The Transport Layer Security (TLS) protocol version 1.2 and earlier allow to start a negotiation with a Client Hello message formatted in a way that is backward compatible with the Secure Sockets Layer (SSL) protocol version 2. Support for this feature in the Network Security Services (NSS) library has been deprecated and it is disabled by default.

TPM 1.2 is deprecated

The Trusted Platform Module (TPM) secure cryptoprocessor standard version was updated to version 2.0 in 2016. TPM 2.0 provides many improvements over TPM 1.2, and it is not backward compatible with the previous version. TPM 1.2 is deprecated in RHEL 8, and it might be removed in the next major release.

Network scripts are deprecated in RHEL 8

Network scripts are deprecated in Red Hat Enterprise Linux 8 and they are no longer provided by default. The basic installation provides a new version of the ifup and ifdown scripts which call the NetworkManager service through the nmcli tool. In Red Hat Enterprise Linux 8, to run the ifup and the ifdown scripts, NetworkManager must be running.

Installing RHEL for Real Time 8 using diskless boot is now deprecated

Diskless booting allows multiple systems to share a root file system via the network. While convenient, diskless boot is prone to introducing network latency in realtime workloads. With a future minor update of RHEL for Real Time 8, the diskless booting feature will no longer be supported.

The qla3xxx driver is deprecated

The qla3xxx driver has been deprecated in RHEL 8. The driver will likely not be supported in future major releases of this product, and thus it is not recommended for new deployments.

The dl2k, dnet, ethoc, and dlci drivers are deprecated

The dl2k, dnet, ethoc, and dlci drivers have been deprecated in RHEL 8. The drivers will likely not be supported in future major releases of this product, and thus they are not recommended for new deployments.

The rdma_rxe Soft-RoCE driver is deprecated

Software Remote Direct Memory Access over Converged Ethernet (Soft-RoCE), also known as RXE, is a feature that emulates Remote Direct Memory Access (RDMA). In RHEL 8, the Soft-RoCE feature is available as an unsupported Technology Preview. However, due to stability issues, this feature has been deprecated and will be removed in RHEL 9.

The elevator kernel command line parameter is deprecated

The elevator kernel command line parameter was used in earlier RHEL releases to set the disk scheduler for all devices. In RHEL 8, the parameter is deprecated.

LVM mirror is deprecated

The LVM mirror segment type is now deprecated. Support for mirror will be removed in a future major release of RHEL.

peripety is deprecated

The peripety package is deprecated since RHEL 8.3.

NFSv3 over UDP has been disabled

The NFS server no longer opens or listens on a User Datagram Protocol (UDP) socket by default. This change affects only NFS version 3 because version 4 requires the Transmission Control Protocol (TCP).

cramfs has been deprecated

Due to lack of users, the cramfs kernel module is deprecated. squashfs is recommended as an alternative solution.

openssh-ldap has been deprecated

The openssh-ldap subpackage has been deprecated in Red Hat Enterprise Linux 8 and will be removed in RHEL 9. As the openssh-ldap subpackage is not maintained upstream, Red Hat recommends using SSSD and the sss_ssh_authorizedkeys helper, which integrate better with other IdM solutions and are more secure.

DES and 3DES encryption types have been removed

Due to security reasons, the Data Encryption Standard (DES) algorithm has been deprecated and disabled by default since RHEL 7. With the recent rebase of Kerberos packages, single-DES (DES) and triple-DES (3DES) encryption types have been removed from RHEL 8.

The SMB1 protocol is deprecated in Samba

Starting with Samba 4.11, the insecure Server Message Block version 1 (SMB1) protocol is deprecated and will be removed in a future release.

The libgnome-keyring library has been deprecated

The libgnome-keyring library has been deprecated in favor of the libsecret library, as libgnome-keyring is not maintained upstream, and does not follow the necessary cryptographic policies for RHEL. The new libsecret library is the replacement that follows the necessary security standards.

The AlternateTab extension has been removed

The gnome-shell-extension-alternate-tab package, which provides the AlternateTab GNOME Shell extension, has been removed.

AGP graphics cards are no longer supported

Graphics cards using the Accelerated Graphics Port (AGP) bus are not supported in Red Hat Enterprise Linux 8. Use the graphics cards with PCI-Express bus as the recommended replacement.

The web console no longer supports incomplete translations

The RHEL web console no longer provides translations for languages that have translations available for less than 50 % of the Console’s translatable strings. If the browser requests translation to such a language, the user interface will be in English instead.

The geoipupdate package has been deprecated

The geoipupdate package requires a third-party subscription and it also downloads proprietary content. Therefore, the geoipupdate package has been deprecated, and will be removed in the next major RHEL version.

SPICE has been deprecated

The SPICE remote display protocol has become deprecated. As a result, SPICE will remain supported in RHEL 8, but Red Hat recommends using alternate solutions for remote display streaming:

virt-manager has been deprecated

The Virtual Machine Manager application, also known as virt-manager, has been deprecated. The RHEL 8 web console, also known as Cockpit, is intended to become its replacement in a subsequent release. It is, therefore, recommended that you use the web console for managing virtualization in a GUI. Note, however, that some features available in virt-manager may not be yet available the RHEL 8 web console.

Virtual machine snapshots are not properly supported in RHEL 8

The current mechanism of creating virtual machine (VM) snapshots has been deprecated, as it is not working reliably. As a consequence, it is recommended not to use VM snapshots in RHEL 8.

The Cirrus VGA virtual GPU type has been deprecated

With a future major update of Red Hat Enterprise Linux, the Cirrus VGA GPU device will no longer be supported in KVM virtual machines. Therefore, Red Hat recommends using the stdvga or virtio-vga devices instead of Cirrus VGA.

Podman varlink-based REST API V1 has been deprecated

The Podman varlink-based REST API V1 has been deprecated upstream in favor of the new Podman REST API V2. This functionality will be removed in a later release of Red Hat Enterprise Linux 8.

The auth and authconfig Kickstart commands require the AppStream repository

The authselect-compat package is required by the auth and authconfig Kickstart commands during installation. Without this package, the installation fails if auth or authconfig are used. However, by design, the authselect-compat package is only available in the AppStream repository.

The reboot --kexec and inst.kexec commands do not provide a predictable system state

Performing a RHEL installation with the reboot --kexec Kickstart command or the inst.kexec kernel boot parameters do not provide the same predictable system state as a full reboot. As a consequence, switching to the installed system without rebooting can produce unpredictable results.

Network access is not enabled by default in the installation program

Several installation features require network access, for example, registration of a system using the Content Delivery Network (CDN), NTP server support, and network installation sources. However, network access is not enabled by default, and as a result, these features cannot be used until network access is enabled.

The new osbuild-composer back end does not replicate the blueprint state from lorax-composer on upgrades

Image Builder users that are upgrading from the lorax-composer back end to the new osbuild-composer back end, blueprints can disappear. As a result, once the upgrade is complete, the blueprints do not display automatically. To work around this problem, perform the following steps.

Self-signed HTTPS server cannot be used in Kickstart installation

Currently, the installer fails to install from a self-signed https server when the installation source is specified in the kickstart file and the --noverifyssl option is used:

GUI installation might fail if an attempt to unregister using the CDN is made before the repository refresh is completed

Since RHEL 8.2, when registering your system and attaching subscriptions using the Content Delivery Network (CDN), a refresh of the repository metadata is started by the GUI installation program. The refresh process is not part of the registration and subscription process, and as a consequence, the Unregister button is enabled in the Connect to Red Hat window. Depending on the network connection, the refresh process might take more than a minute to complete. If you click the Unregister button before the refresh process is completed, the GUI installation might fail as the unregister process removes the CDN repository files and the certificates required by the installation program to communicate with the CDN.

Registration fails for user accounts that belong to multiple organizations

Currently, when you attempt to register a system with a user account that belongs to multiple organizations, the registration process fails with the error message You must specify an organization for new units.

RHEL installer fails to start when InfiniBand network interfaces are configured using installer boot options

When you configure InfiniBand network interfaces at an early stage of RHEL installation using installer boot options (for example, to download installer image using PXE server), the installer fails to activate the network interfaces.

Anaconda installation fails when NVDIMM device namespace set to devdax mode.

Anaconda installation fails with a trackback after booting with NVDIMM device namespace set to devdax mode before the GUI installation.

Local Media installation source is not detected when booting the installation from a USB that is created using a third party tool

When booting the RHEL installation from a USB that is created using a third party tool, the installer fails to detect the Local Media installation source (only 'Red Hat CDN' is detected).

Anaconda now shows a dialog for ldl or unformatted DASD disks in text mode

Previously, during an installation in text mode, Anaconda failed to show a dialog for Linux disk layout (ldl) or unformatted Direct-Access Storage Device (DASD) disks. As a result, users were unable to utilize those disks for the installation.

Red Hat Insights client fails to register the operating system when using the graphical installer

Currently, the installation fails with an error at the end, which points to the Insights client.

syspurpose addons have no effect on the subscription-manager attach --auto output.

In Red Hat Enterprise Linux 8, four attributes of the syspurpose command-line tool have been added: role,usage, service_level_agreement and addons. Currently, only role, usage and service_level_agreement affect the output of running the subscription-manager attach --auto command. Users who attempt to set values to the addons argument will not observe any effect on the subscriptions that are auto-attached.

libmaxminddb-devel-debuginfo.rpm is removed when running dnf update

When performing the dnf update command, the binary mmdblookup tool is moved from the libmaxminddb-devel subpackage to the main libmaxmindb package. Consequently, the libmaxminddb-devel-debuginfo.rpm is removed, which might create a broken update path for this package. To work around this problem, remove the libmaxminddb-devel-debuginfo prior to the execution of the dnf update command.

Users can run sudo commands as locked users

In systems where sudoers permissions are defined with the ALL keyword, sudo users with permissions can run sudo commands as users whose accounts are locked. Consequently, locked and expired accounts can still be used to execute commands.

GnuTLS fails to resume current session with the NSS server

When resuming a TLS (Transport Layer Security) 1.3 session, the GnuTLS client waits 60 milliseconds plus an estimated round trip time for the server to send session resumption data. If the server does not send the resumption data within this time, the client creates a new session instead of resuming the current session. This incurs no serious adverse effects except for a minor performance impact on a regular session negotiation.

libselinux-python is available only through its module

The libselinux-python package contains only Python 2 bindings for developing SELinux applications and it is used for backward compatibility. For this reason, libselinux-python is no longer available in the default RHEL 8 repositories through the dnf install libselinux-python command.

udica processes UBI 8 containers only when started with --env container=podman

The Red Hat Universal Base Image 8 (UBI 8) containers set the container environment variable to the oci value instead of the podman value. This prevents the udica tool from analyzing a container JavaScript Object Notation (JSON) file.

Negative effects of the default logging setup on performance

The default logging environment setup might consume 4 GB of memory or even more and adjustments of rate-limit values are complex when systemd-journald is running with rsyslog.

File permissions of /etc/passwd- are not aligned with the CIS RHEL 8 Benchmark 1.0.0

Because of an issue with the CIS Benchmark, the remediation of the SCAP rule that ensures permissions on the /etc/passwd- backup file configures permissions to 0644. However, the CIS Red Hat Enterprise Linux 8 Benchmark 1.0.0 requires file permissions 0600 for that file. As a consequence, the file permissions of /etc/passwd- are not aligned with the benchmark after remediation.

SELINUX=disabled in /etc/selinux/config does not work properly

Disabling SELinux using the SELINUX=disabled option in the /etc/selinux/config results in a process in which the kernel boots with SELinux enabled and switches to disabled mode later in the boot process. This might cause memory leaks.

ssh-keyscan cannot retrieve RSA keys of servers in FIPS mode

The SHA-1 algorithm is disabled for RSA signatures in FIPS mode, which prevents the ssh-keyscan utility from retrieving RSA keys of servers operating in that mode.

OpenSSL incorrectly handles PKCS #11 tokens that does not support raw RSA or RSA-PSS signatures

The OpenSSL library does not detect key-related capabilities of PKCS #11 tokens. Consequently, establishing a TLS connection fails when a signature is created with a token that does not support raw RSA or RSA-PSS signatures.

OpenSSL in FIPS mode accepts only specific D-H parameters

In FIPS mode, Transport Security Layer (TLS) clients that use OpenSSL return a bad dh value error and abort TLS connections to servers that use manually generated parameters. This is because OpenSSL, when configured to work in compliance with FIPS 140-2, works only with D-H parameters compliant to NIST SP 800-56A rev3 Appendix D (groups 14, 15, 16, 17, and 18 defined in RFC 3526 and with groups defined in RFC 7919). Also, servers that use OpenSSL ignore all other parameters and instead select known parameters of similar size. To work around this problem, use only the compliant groups.

Removing the rpm-plugin-selinux package leads to removing all selinux-policy packages from the system

Removing the rpm-plugin-selinux package disables SELinux on the machine. It also removes all selinux-policy packages from the system. Repeated installation of the rpm-plugin-selinux package then installs the selinux-policy-minimum SELinux policy, even if the selinux-policy-targeted policy was previously present on the system. However, the repeated installation does not update the SELinux configuration file to account for the change in policy. As a consequence, SELinux is disabled even upon reinstallation of the rpm-plugin-selinux package.

systemd service cannot execute commands from arbitrary paths

The systemd service cannot execute commands from /home/user/bin arbitrary paths because the SELinux policy package does not include any such rule. Consequently, the custom services that are executed on non-system paths fail and eventually logs the Access Vector Cache (AVC) denial audit messages when SELinux denied access. To work around this problem, do one of the following:

rpm_verify_permissions fails in the CIS profile

The rpm_verify_permissions rule compares file permissions to package default permissions. However, the Center for Internet Security (CIS) profile, which is provided by the scap-security-guide packages, changes some file permissions to be more strict than default. As a consequence, verification of certain files using rpm_verify_permissions fails.

Kickstart uses org_fedora_oscap instead of com_redhat_oscap in RHEL 8

The Kickstart references the Open Security Content Automation Protocol (OSCAP) Anaconda add-on as org_fedora_oscap instead of com_redhat_oscap which might cause confusion. That is done to preserve backward compatibility with Red Hat Enterprise Linux 7.

Certain sets of interdependent rules in SSG can fail

Remediation of SCAP Security Guide (SSG) rules in a benchmark can fail due to undefined ordering of rules and their dependencies. If two or more rules need to be executed in a particular order, for example, when one rule installs a component and another rule configures the same component, they can run in the wrong order and remediation reports an error. To work around this problem, run the remediation twice, and the second run fixes the dependent rules.

OSCAP Anaconda Addon does not install all packages in text mode

The OSCAP Anaconda Addon plugin cannot modify the list of packages selected for installation by the system installer if the installation is running in text mode. Consequently, when a security policy profile is specified using Kickstart and the installation is running in text mode, any additional packages required by the security policy are not installed during installation.

OSCAP Anaconda Addon does not correctly handle customized profiles

The OSCAP Anaconda Addon plugin does not properly handle security profiles with customizations in separate files. Consequently, the customized profile is not available in the RHEL graphical installation even when you properly specify it in the corresponding Kickstart section.

OSPP-based profiles are incompatible with GUI package groups.

GNOME packages installed by the Server with GUI package group require the nfs-utils package that is not compliant with the Operating System Protection Profile (OSPP). As a consequence, selecting the Server with GUI package group during the installation of a system with OSPP or OSPP-based profiles, for example, Security Technical Implementation Guide (STIG), OpenSCAP displays a warning that the selected package group is not compatible with the security policy. If the OSPP-based profile is applied after the installation, the system is not bootable. To work around this problem, do not install the Server with GUI package group or any other groups that install GUI when using the OSPP profile and OSPP-based profiles. When you use the Server or Minimal Install package groups instead, the system installs without issues and works correctly.

Installation with the Server with GUI or Workstation software selections and CIS security profile is not possible

The CIS security profile is not compatible with the Server with GUI and Workstation software selections. As a consequence, a RHEL 8 installation with the Server with GUI software selection and CIS profile is not possible. An attempted installation using the CIS profile and either of these software selections will generate the error message:

Remediating service-related rules during kickstart installations might fail

During a kickstart installation, the OpenSCAP utility sometimes incorrectly shows that a service enable or disable state remediation is not needed. Consequently, OpenSCAP might set the services on the installed system to a non-compliant state. As a workaround, you can scan and remediate the system after the kickstart installation. This will fix the service-related issues.

Certain rsyslog priority strings do not work correctly

Support for the GnuTLS priority string for imtcp that allows fine-grained control over encryption is not complete. Consequently, the following priority strings do not work properly in rsyslog:

crypto-policies incorrectly allow Camellia ciphers

The RHEL 8 system-wide cryptographic policies should disable Camellia ciphers in all policy levels, as stated in the product documentation. However, the Kerberos protocol enables the ciphers by default.

The iptables utility now requests module loading for commands that update a chain regardless of the NLM_F_CREATE flag

Previously, when setting a chain’s policy, the iptables-nft utility generated a NEWCHAIN message but did not set the NLM_F_CREATE flag. As a consequence, the RHEL 8 kernel did not load any modules and the resulting update chain command failed if the associated kernel modules were not manually loaded. With this update, the iptables-nft utility now requests module loading for all commands that update a chain and users are able to set a chain’s policy using the iptables-nft utility without manually loading the associated modules.

Support for updating packet/byte counters in the kernel was changed incorrectly between RHEL 7 and RHEL 8

When referring to an ipset command with enabled counters from an iptables rule, which specifies additional constraints on matching ipset entries, the ipset counters are updated only if all the additional constraints match. This is also problematic with --packets-gt or --bytes-gt constraints.

Unloading XDP programs fails on Netronome network cards that use the nfp driver

The nfp driver for Netronome network cards contains a bug. Therefore, unloading eXpress Data Path (XDP) programs fails if you use such cards and load the XDP program using the IFLA_XDP_EXPECTED_FD feature with the XDP_FLAGS_REPLACE flag. For example, this bug affects XDP programs that are loaded using the libxdp library. Currently, there is no workaround available for the problem.

Anaconda does not have network access when using DHCP in the ip boot option

The initial RAM disk (initrd) uses NetworkManager to manage networking. The dracut NetworkManager module provided by the RHEL 8.3 ISO file incorrectly assumes that the first field of the ip option in the Anaconda boot options is always set. As a consequence, if you use DHCP and set ip=::::<host_name>::dhcp, NetworkManager does not retrieve an IP address, and the network is not available in Anaconda.

The tboot-1.9.12-2 utility causes a boot failure in RHEL 8

The tboot utility of version 1.9.12-2 causes some systems with Trusted Platform Module (TPM) 2.0 to fail to boot in legacy mode. As a consequence, the system halts once it attempts to boot from the tboot Grand Unified Bootloader (GRUB) entry. To workaround this problem, downgrade to tboot of version 1.9.10.

The kernel returns false positive warnings on IBM Z systems

In RHEL 8, IBM Z systems are missing a whitelist entry for the ZONE_DMA memory zone to allow user access. Consequently, the kernel returns false positive warnings such as:

The rngd service busy wait causes total CPU consumption in FIPS mode

A new kernel entropy source for FIPS mode has been added for kernels starting with version 4.18.0-193.10. Consequently, when in FIPS mode, the rngd service busy waits on the poll() system call for the /dev/random device, thereby causing consumption of 100% of CPU time. To work around this problem, stop and disable rngd by running:

softirq changes can cause the localhost interface to drop UDP packets when under heavy load

Changes in the Linux kernel’s software interrupt (softirq) handling are done to reduce denial of service (DOS) effects. Consequently, this leads to situations where the localhost interface drops User Datagram Protocol (UDP) packets under heavy load.

A vmcore capture fails after memory hot-plug or unplug operation

After performing the memory hot-plug or hot-unplug operation, the event comes after updating the device tree which contains memory layout information. Thereby the makedumpfile utility tries to access a non-existent physical address. The problem appears if all of the following conditions meet:

Using irqpoll causes vmcore generation failure

Due to an existing problem with the nvme driver on the 64-bit ARM architectures that run on the Amazon Web Services (AWS) cloud platforms, the vmcore generation fails when you provide the irqpoll kernel command line parameter to the first kernel. Consequently, no vmcore file is dumped in the /var/crash/ directory after a kernel crash. To work around this problem:

Debug kernel fails to boot in crash capture environment in RHEL 8

Due to memory-demanding nature of the debug kernel, a problem occurs when the debug kernel is in use and a kernel panic is triggered. As a consequence, the debug kernel is not able to boot as the capture kernel, and a stack trace is generated instead. To work around this problem, increase the crash kernel memory accordingly. As a result, the debug kernel successfully boots in the crash capture environment.

zlib may slow down a vmcore capture in some compression functions

The kdump configuration file uses the lzo compression format (makedumpfile -l) by default. When you modify the configuration file using the zlib compression format, (makedumpfile -c) it is likely to bring a better compression factor at the expense of slowing down the vmcore capture process. As a consequence, it takes the kdump upto four times longer to capture a vmcore with zlib, as compared to lzo.

The HP NMI watchdog does not always generate a crash dump

In certain cases, the hpwdt driver for the HP NMI watchdog is not able to claim a non-maskable interrupt (NMI) generated by the HPE watchdog timer because the NMI was instead consumed by the perfmon driver.

The tuned-adm profile powersave command causes the system to become unresponsive

Executing the tuned-adm profile powersave command leads to an unresponsive state of the Penguin Valkyrie 2000 2-socket systems with the older Thunderx (CN88xx) processors. Consequently, reboot the system to resume working. To work around this problem, avoid using the powersave profile if your system matches the mentioned specifications.

The default 7 4 1 7 printk value sometimes causes temporary system unresponsiveness

The default 7 4 1 7 printk value allows for better debugging of the kernel activity. However, when coupled with a serial console, this printk setting can cause intense I/O bursts that can lead to a RHEL system becoming temporarily unresponsive. To work around this problem, we have added a new optimize-serial-console TuneD profile, which reduces the default printk value to 4 4 1 7. Users can instrument their system as follows:

The kernel ACPI driver reports it has no access to a PCIe ECAM memory region

The Advanced Configuration and Power Interface (ACPI) table provided by firmware does not define a memory region on the PCI bus in the Current Resource Settings (_CRS) method for the PCI bus device. Consequently, the following warning message occurs during the system boot:

The OPEN MPI library may trigger run-time failures with default PML

In OPEN Message Passing Interface (OPEN MPI) implementation 4.0.x series, Unified Communication X (UCX) is the default point-to-point communicator (PML). The later versions of OPEN MPI 4.0.x series deprecated openib Byte Transfer Layer (BTL).

The /boot file system cannot be placed on LVM

You cannot place the /boot file system on an LVM logical volume. This limitation exists for the following reasons:

LVM no longer allows creating volume groups with mixed block sizes

LVM utilities such as vgcreate or vgextend no longer allow you to create volume groups (VGs) where the physical volumes (PVs) have different logical block sizes. LVM has adopted this change because file systems fail to mount if you extend the underlying logical volume (LV) with a PV of a different block size.

Limitations of LVM writecache

The writecache LVM caching method has the following limitations, which are not present in the cache method:

LVM mirror devices that store a LUKS volume sometimes become unresponsive

Mirrored LVM devices with a segment type of mirror that store a LUKS volume might become unresponsive under certain conditions. The unresponsive devices reject all I/O operations.

An NFS 4.0 patch can result in reduced performance under an open-heavy workload

Previously, a bug was fixed that, in some cases, could cause an NFS open operation to overlook the fact that a file had been removed or renamed on the server. However, the fix may cause slower performance with workloads that require many open operations. To work around this problem, it might help to use NFS version 4.1 or higher, which have been improved to grant delegations to clients in more cases, allowing clients to perform open operations locally, quickly, and safely.

getpwnam() might fail when called by a 32-bit application

When a user of NIS uses a 32-bit application that calls the getpwnam() function, the call fails if the nss_nis.i686 package is missing. To work around this problem, manually install the missing package by using the yum install nss_nis.i686 command.

Symbol conflicts between OpenLDAP libraries might cause crashes in httpd

When both the libldap and libldap_r libraries provided by OpenLDAP are loaded and used within a single process, symbol conflicts between these libraries might occur. Consequently, Apache httpd child processes using the PHP ldap extension might terminate unexpectedly if the mod_security or mod_auth_openidc modules are also loaded by the httpd configuration.

PAM plug-in does not work in MariaDB

MariaDB 10.3 provides the Pluggable Authentication Modules (PAM) plug-in version 1.0. The MariaDB PAM plug-in version 1.0 does not work in RHEL 8. To work around this problem, use the PAM plug-in version 2.0 provided by the mariadb:10.5 module stream, which is available with RHEL 8.4.

Installing KRA fails if all KRA members are hidden replicas

The ipa-kra-install utility fails on a cluster where the Key Recovery Authority (KRA) is already present, if the first KRA instance is installed on a hidden replica. Consequently, you cannot add further KRA instances to the cluster.

Using the cert-fix utility with the --agent-uid pkidbuser option breaks Certificate System

Using the cert-fix utility with the --agent-uid pkidbuser option corrupts the LDAP configuration of Certificate System. As a consequence, Certificate System might become unstable and manual steps are required to recover the system.

Certificates issued by PKI ACME Responder connected to PKI CA may fail OCSP validation

The default ACME certificate profile provided by PKI CA contains a sample OCSP URL that does not point to an actual OCSP service. As a consequence, if PKI ACME Responder is configured to use a PKI CA issuer, the certificates issued by the responder may fail OCSP validation.

FreeRADIUS silently truncates Tunnel-Passwords longer than 249 characters

If a Tunnel-Password is longer than 249 characters, the FreeRADIUS service silently truncates it. This may lead to unexpected password incompatibilities with other systems.

The /var/log/lastlog sparse file on IdM hosts can cause performance problems

During the IdM installation, a range of 200,000 UIDs from a total of 10,000 possible ranges is randomly selected and assigned. Selecting a random range in this way significantly reduces the probability of conflicting IDs in case you decide to merge two separate IdM domains in the future.

Potential risk when using the default value for ldap_id_use_start_tls option

When using ldap:// without TLS for identity lookups, it can pose a risk for an attack vector. Particularly a man-in-the-middle (MITM) attack which could allow an attacker to impersonate a user by altering, for example, the UID or GID of an object returned in an LDAP search.

Disabling flatpak repositories from Software Repositories is not possible

Currently, it is not possible to disable or remove flatpak repositories in the Software Repositories tool in the GNOME Software utility.

Drag-and-drop does not work between desktop and applications

Due to a bug in the gnome-shell-extensions package, the drag-and-drop functionality does not currently work between desktop and applications. Support for this feature will be added back in a future release.

Generation 2 RHEL 8 virtual machines sometimes fail to boot on Hyper-V Server 2016 hosts

When using RHEL 8 as the guest operating system on a virtual machine (VM) running on a Microsoft Hyper-V Server 2016 host, the VM in some cases fails to boot and returns to the GRUB boot menu. In addition, the following error is logged in the Hyper-V event log:

radeon fails to reset hardware correctly

The radeon kernel driver currently does not reset hardware in the kexec context correctly. Instead, radeon falls over, which causes the rest of the kdump service to fail.

Multiple HDR displays on a single MST topology may not power on

On systems using NVIDIA Turing GPUs with the nouveau driver, using a DisplayPort hub (such as a laptop dock) with multiple monitors which support HDR plugged into it may result in failure to turn on. This is due to the system erroneously thinking there is not enough bandwidth on the hub to support all of the displays.

Unable to run graphical applications using sudo command

When trying to run graphical applications as a user with elevated privileges, the application fails to open with an error message. The failure happens because Xwayland is restricted by the Xauthority file to use regular user credentials for authentication.

VNC Viewer displays wrong colors with the 16-bit color depth on IBM Z

The VNC Viewer application displays wrong colors when you connect to a VNC session on an IBM Z server with the 16-bit color depth.

Hardware acceleration is not supported on ARM

Built-in graphics drivers do not support hardware acceleration or the Vulkan API on the 64-bit ARM architecture.

The RHEL installer becomes unresponsive with NVIDIA Ampere

RHEL 8.3.0 does not support the NVIDIA Ampere GPUs. If you start the RHEL installation on a system that has an NVIDIA Ampere GPU, the installer becomes unresponsive. As a consequence, the installation cannot finish successfully.

Unprivileged users can access the Subscriptions page

If a non-administrator navigates to the Subscriptions page of the web console, the web console displays a generic error message Cockpit had an unexpected internal error.

oVirt input and the elasticsearch output functionalities are not supported in system roles Logging

The oVirt input and the elasticsearch output are not supported in system roles Logging although they are mentioned in the README file. There is no workaround available at the moment.

Displaying multiple monitors of virtual machines that use Wayland is not possible with QXL

Using the remote-viewer utility to display more than one monitor of a virtual machine (VM) that is using the Wayland display server causes the VM to become unresponsive and the Waiting for display status message to be displayed indefinitely.

virsh iface-\* commands do not work consistently

Currently, virsh iface-* commands, such as virsh iface-start and virsh iface-destroy, frequently fail due to configuration dependencies. Therefore, it is recommended not to use virsh iface-\* commands for configuring and managing host network connections. Instead, use the NetworkManager program and its related management applications.

Virtual machines sometimes fail to start when using many virtio-blk disks

Adding a large number of virtio-blk devices to a virtual machine (VM) may exhaust the number of interrupt vectors available in the platform. If this occurs, the VM’s guest OS fails to boot, and displays a dracut-initqueue[392]: Warning: Could not boot error.

Attaching LUN devices to virtual machines using virtio-blk does not work

The q35 machine type does not support transitional virtio 1.0 devices, and RHEL 8 therefore lacks support for features that were deprecated in virtio 1.0. In particular, it is not possible on a RHEL 8 host to send SCSI commands from virtio-blk devices. As a consequence, attaching a physical disk as a LUN device to a virtual machine fails when using the virtio-blk controller.

Virtual machines using Cooperlake cannot boot when TSX is disabled on the host

Virtual machines (VMs) that use the Cooperlake CPU model currently fail to boot when the TSX CPU flag is diabled on the host. Instead, the host displays the following error message:

Virtual machines sometimes cannot boot on Witherspoon hosts

Virtual machines (VMs) that use the pseries-rhel7.6.0-sxxm machine type in some cases fail to boot on Power9 S922LC for HPC hosts (also known as Witherspoon) that use the DD2.2 or DD2.3 CPU.

GPU problems on Azure NV6 instances

When running RHEL 8 as a guest operating system on a Microsoft Azure NV6 instance, resuming the virtual machine (VM) from hibernation sometimes causes the VM’s GPU to work incorrectly. When this occurs, the kernel logs the following message:

kdump sometimes does not start on Azure and Hyper-V

On RHEL 8 guest operating systems hosted on the Microsoft Azure or Hyper-V hypervisors, starting the kdump kernel in some cases fails when post-exec notifiers are enabled.

Setting static IP in a RHEL 8 virtual machine on a VMWare host does not work

Currently, when using RHEL 8 as a guest operating system of a virtual machine (VM) on a VMWare host, the DatasourceOVF function does not work correctly. As a consequence, if you use use the cloud-init utility to set the the VM’s network to static IP and then reboot the VM, the VM’s network will be changed to DHCP.

Core dumping RHEL 8 virtual machines with certain NICs to a remote machine on Azure takes longer than expected

Currently, using the kdump utility to save the core dump file of a RHEL 8 virtual machine (VM) on a Microsoft Azure hypervisor to a remote machine does not work correctly when the VM is using a NIC with enabled accelerated networking. As a consequence, the dump file is saved after approximately 200 seconds, instead of immediately. In addition, the following error message is logged on the console before the dump file is saved.

TX/RX packet counters do not increase after virtual machines resume from hibernation

The TX/RX packet counters stop increasing when a RHEL 8 virtual machine (VM), with a CX4 VF NIC, resumes from hibernation on Microsoft Azure. To keep the counters working, restart the VM. Note that, doing so will reset the counters.

RHEL 8 virtual machines fail to resume from hibernation on Azure

The GUID of the virtual function (VF), vmbus device, changes when a RHEL 8 virtual machine (VM), with SR-IOV enabled, is hibernated and deallocated on Microsoft Azure . As a result, when the VM is restarted, it fails to resume and crashes. As a workaround, hard reset the VM using the Azure serial console.

Migrating a POWER9 guest from a RHEL 7-ALT host to RHEL 8 fails

Currently, migrating a POWER9 virtual machine from a RHEL 7-ALT host system to RHEL 8 becomes unresponsive with a "Migration status: active" status.

redhat-support-tool does not work with the FUTURE crypto policy

Because a cryptographic key used by a certificate on the Customer Portal API does not meet the requirements by the FUTURE system-wide cryptographic policy, the redhat-support-tool utility does not work with this policy level at the moment.

UDICA is not expected to work with 1.0 stable stream

UDICA, the tool to generate SELinux policies for containers, is not expected to work with containers that are run via podman 1.0.x in the container-tools:1.0 module stream.

podman system connection add does not automatically set the default connection

The podman system connection add command does not automatically set the first connection to be the default connection. To set the default connection, you must manually run the command podman system connection default <connection_name>.