Considerations in adopting RHEL 9

TDX support is available a Technology Preview for RHEL on Azure

The Intel Trust Domain Extension (TDX) feature can as a Technology Preview now be used in RHEL 9.4 guest operating systems. If the host system supports TDX, you can deploy hardware-isolated RHEL 9 virtual machines (VMs), called trust domains (TDs). As a result, you will be able to create a CVM image with SecureBoot enabled on the Azure platform.

TDX support is available a Technology Preview for RHEL on GCP

The Intel Trust Domain Extension (TDX) feature can as a Technology Preview now be used in RHEL 9.4 guest operating systems. If the host system supports TDX, you can deploy hardware-isolated RHEL 9 virtual machines (VMs), called trust domains (TDs). With this enhancement, you can use the Intel Trust Domain Extension (TDX) feature in RHEL 9.4 on Google Cloud Platform.

The container-tools meta-package is now available

The container-tools RPM meta-package, which includes Podman, Buildah, Skopeo, CRIU, Udica, and all required libraries, is available in RHEL 9. The stable streams are not available on RHEL 9. To receive stable access to Podman, Buildah, Skopeo, and others, use the RHEL EUS subscription.

Improved control group performance

The previous version of control groups, cgroup version 1 (cgroup v1), caused performance problems with a variety of applications. The latest release of control groups, cgroup version 2 (cgroup v2) enables system administrators to limit resources for any application without causing performance problems.

Podman now supports secure short names

Short-name aliases for images can now be configured in the registries.conf file in the [aliases] table. The short-names modes are:

Default container registries in registries.conf

You can find the list of container registries in the /etc/containers/registries.conf file as a root user and in $HOME/.config/containers/registries.conf as a non-root user. By changing the registries.conf file, you can change the default system-wide search settings.

Default OCI runtime change

The crun OCI runtime is now available for the container-tools:rhel8 module. The crun container runtime supports an annotation that enables the container to access the rootless user’s additional groups. This is useful for container operations when volume mounting in a directory where setgid is set, or when the user only has group access.

Running RHEL 9 containers on a RHEL 7 host is not supported

Running RHEL 9 containers on a RHEL 7 host is not supported.

Default network stacks

Podman uses CNI as the default network stack in RHEL 8 and Netavark as the default network stack in fresh installs of RHEL 9.

The Podman v5.0 deprecations

In RHEL 9.5, the following is deprecated in Podman v5.0:

The runc container runtime has been deprecated

The runc container runtime is deprecated and will be removed in a future major release of RHEL. The default container runtime is crun.

All threading APIs now merged into libc.so.6

In RHEL 8, the system threading library, libpthread.so, was a distinct library. In RHEL 9, all threading APIs have been merged into the core C library libc.so.6. Moving threading into the core C library enables the library to support threads by default. With a single file the in-place upgrade process is also made smoother since the thread APIs and core C, POSIX and BSD APIs are all updated at the same time (no distinct libraries).

The libdl library now merged into libc.so.6

In RHEL 8, the libdl library was a distinct library. In RHEL 9, the libdl library has been merged into the core C library libc.so.6. This means that interposing the dlsym function is now much more difficult. Applications that need to control the way how symbol resolution works should switch to the auditor (LD_AUDIT) interfaces.

Name Service Switch service plugins for dns and files now merged into libc.so.6

In RHEL 8, the Name Service Switch (NSS) services for files and dns, which provides data to user and group identity management APIs, was a distinct plugin. In RHEL 9, the plugins have been merged into the core C library libc.so.6. Moving the files and dns service providers ensures that applications that need to cross a mount namespace boundary (for example, enter a container) can do so knowing that NSS files and dns access services are always loaded at process startup.

Red Hat build of OpenJDK 17 is the default Java implementation since RHEL 9.5

The default RHEL 9 Java implementation is being changed from OpenJDK 11, which has reached its End Of Life (EOL), to OpenJDK 17. After this update, the java-17-openjdk packages, which provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit, will also provide the java and java-devel packages. For more information, see the OpenJDK documentation.

.NET 7.0 is no longer supported

.NET 7.0 reached its End Of Life (EOL) in May 2024. Use .NET 8.0 or later instead. For details about usage, see .NET 8.0 documentation. For information about the length of support, see the Red Hat Enterprise Linux Application Streams Life Cycle.

GNOME updated to version 40

The GNOME environment is now updated from GNOME 3.28 to GNOME 40 with many new features.

X.org Server is now deprecated

The X.org display server is deprecated, and will be removed in a future major RHEL release. The default desktop session is now the Wayland session in most cases.

The Wayland session is now the default with NVIDIA drivers

When using the NVIDIA drivers, the desktop session now selects the Wayland display protocol by default, if the driver configuration supports Wayland. In previous RHEL releases, the NVIDIA drivers always disabled Wayland.

X.Org X11 video drivers have been replaced by modesetting

The following X.Org X11 video drivers have been removed and replaced by the generic modesetting driver:

PipeWire is now the default audio service

The PipeWire service now manages all audio output and input. PipeWire replaces the PulseAudio service in general use cases and the JACK service in professional use cases. The system now redirects audio from applications that use PulseAudio, JACK, or the ALSA framework into PipeWire.

GNOME Boxes have been removed

The GNOME Boxes application has been removed from RHEL 9. Boxes used the SPICE system to connect to virtual machines (VMs). In RHEL 9, SPICE is no longer available, and as a consequence, Boxes have also been removed.

Power profiles are available in GNOME

You can now switch between several power profiles in the Power panel of Settings in the GNOME environment. The power profiles optimize various system settings for the selected goal.

Lightweight, single-application environment

For graphical use cases that only present a single application, a lightweight user interface (UI) is now available.

Language support is now provided by langpacks

Support for various languages is now available from langpacks packages. You can customize the level of language support that you want to install using the following package names, where code is the short ISO code for the language, such as es for Spanish:

Motif has been deprecated

The Motif widget toolkit has been deprecated in RHEL, because development in the upstream Motif community is inactive.

Several bitmap fonts have been removed

The following bitmap font packages have been removed:

No Sign In button on the login screen

The login screen has been redesigned in this release. As a consequence, the login screen no longer includes a Sign In button, which was present in previous RHEL releases.

TigerVNC is deprecated

The TigerVNC remote desktop solution is now deprecated. It will be removed in a future major RHEL release and replaced by a different remote desktop solution.

Initial Application Streams versions in RHEL 9

RHEL 9 improves the Application Streams experience by providing initial Application Stream versions that can be installed as RPM packages using the traditional dnf install command.

Major differences in the Python ecosystem since RHEL 8

The unversioned python command

Differences between the perl and perl-interpreter packages

RHEL 9 provides both the perl and perl-interpreter packages. The perl package is suitable for development because it contains the full Perl upstream distribution in dependencies, including GCC. On production systems, use the perl-interpreter package, which contains the main /usr/bin/perl interpreter.

Notable changes to libdb

RHEL 8 and RHEL 9 currently provide Berkeley DB (libdb) version 5.3.28, which is distributed under the LGPLv2 license. The upstream Berkeley DB version 6 is available under the AGPLv3 license, which is more restrictive.

Tomcat available since RHEL 9.2

RHEL 9.2 introduces the Apache Tomcat server version 9. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0.

Support to file system customization for the simplified-installer and raw images

You can add file system customizations to a blueprint when building the the following image types:

Ability to add SQL backend for storing and querying FDO Owner Vouchers as Technology Preview

With this Technology Preview, you can select an SQL datastore in the FDO servers options, along with credentials and other parameters, to store the Owner Vouchers for the following FDO servers: You can add file system customizations to a blueprint when building the the following image types:

Ability to build FIPS enabled RHEL for Edge images

During the image provisioning, you can build FIPS enabled images for the following RHEL for Edge image types:

Support to build RHEL for Edge AMI images

You have support to build .ami images for RHEL for Edge, customize the blueprint with Ignition to inject the credentials into the image during boot, and upload the .ami image to AWS and boot an EC2 instance in AWS.

Support to build RHEL for Edge VMDK images

You can also build RHEL for RHEL for Edge VMDK images, customize the blueprint with Ignition to inject the credentials into the image during the initial boot, and load the image on vSphere and boot the image in a VM vSphere.

Support for RHEL for Edge minimal raw image that boots on 64-bit ARM architectures

The RHEL for Edge minimal raw image type now supports the 64-bit ARM architecture, and AMD and Intel 64-bit architectures.

New FIDO Device Onboarding Servers container images available

The following FIDO Device Onboarding Servers container images available in Red Hat Container Catalog:

RHEL for Edge Simplified images have support to the Ignition provisioning utility

You can customize your blueprints configuration with the Ignition provisioning utility to create your RHEL for Edge images. The Ignition injects the user configuration into the images at an early stage of the boot process. During the first boot into the system, the Ignition utility reads its configuration either from a remote URL or a file embedded in the Simplified Installer image and applies that configuration into the image.

The FDO customization in blueprints is now optional

You are no longer required to add the FDO customization section in blueprints to build a Simplified Installer image.

Support for automatic provisioning and onboarding RHEL for Edge images using FDO

You have support for automatic provisioning and onboarding RHEL for Edge images using the FDO (FIDO device onboarding) process. With this, you can build a RHEL for Edge Simplified Installer image, provision it to a RHEL for Edge image. Then, you can use the FDO process to automatically provision and onboard your Edge devices, exchange data with other devices and systems connected on the networks.

Support to rpm-ostree upgrades from RHEL 8 to RHEL 9

You can upgrade RHEL 8 systems to RHEL 9 using rpm-ostree rebase.

Support to auto-rollbacks

The health checks run during the boot process and can determine if the nodes are functioning properly. If the health checks fail, a counter tracks the number of attempts and the node uses rpm-ostree to rollback the update. Podman automatically rollbacks the container if a new application version exits when the update fails.

Support to build a RHEL for Edge Simplified Installer image

You can use RHEL image builder to build a RHEL for Edge Simplified Installer image. It enables an unattended installation to a device, and provisioning the image to a RHEL for Edge image.

Support to build a RHEL for Edge Raw image

You can also build RHEL for RHEL for Edge Raw image. These are compressed raw images, which consist of a file that contains a partition layout with an existing deployed OSTree commit in it. The RHEL for Edge Raw Images can be used to flash on a hard disk drive or boot on a virtual machine.

The RHEL 9 for Edge minimal installation is much smaller

The RHEL 9 for Edge minimal installation is much smaller, when compared with RHEL 8:

Supported RHEL for Edge image types

With RHEL for Edge, you can compose customized RHEL (rpm-ostree) images using RHEL image builder, and then remotely install and manage the images on Edge servers.

Supported RHEL for Edge image names

Previously, the image types were prefixed by rhel-. This prefix was removed, but the previous image names, such as rhel-edge-container and rhel-edge-installer still work as aliases to the new names. These names are considered deprecated and may be removed completely in future versions. The following RHEL for Edge image names are supported in RHEL 9:

The XFS filesystem now supports bigtime and inobtcount features

The XFS filesystem now supports two new on-disk features, each of which is enabled by default by mkfs.xfs in RHEL 9. These two new features are:

The exFAT filesystem is now supported in RHEL 9

The exFAT filesystem is now supported in RHEL 9. This is a filesystem designed for external USB storage and interoperability and data exchange with other operating systems. The filesystem is not intended as a general-purpose, performant, or scalable Linux filesystem. An exFAT filesystem may be created by installing the exfatprogs package and using the mkfs.exfat utility.

ext4 filesystem now supports timestamps beyond the year 2038

The ext4 filesystem is now supporting timestamps beyond the year 2038. This feature is fully automatic and does not require any user action to leverage it. The only requirement is that the inode size is larger than 128 bytes, which it is by default.

New nfsv4-client-utils package

New package nfsv4-client-utils, which contains a minimal set of the demons and tool required to support only NFSv4 has been added. This is a replacement for the standard nfs-utils package.

GFS2 file systems are now created with format version 1802

GFS2 file systems in RHEL 9 are created with format version 1802. This enables the following features:

Options in Samba utilities have been renamed and removed for a consistent user experience

The Samba utilities have been improved to provide a consistent command-line interface. These improvements include renamed and removed options. Therefore, to avoid problems after the update, review your scripts that use Samba utilities, and update them, if necessary.

cramfs module has been removed

Due to lack of users, the cramfs kernel module is removed. squashfs is recommended as an alternative solution.

Mandatory file locking support has been removed from RHEL 9

Mandatory file locking is no longer supported in RHEL 9 and later versions. The mand mount option is ignored by this kernel and its use generates a warning in the system log.

NFSv2 is no longer supported

RHEL 9 NFS client and server no longer support NFSv2.

Stratis storage manager is now available

Stratis is a local storage manager. It provides managed file systems on top of pools of storage with additional features to the user:

DAX mount option and reflink are now compatible

Reflinked files are now generally compatible with DAX mode. The file system DAX mount option -o dax=always is compatible with reflink-enabled file systems. Files that were reflinked can be set to DAX mode using inode flags. For more information see the xfs(5) man page on your system.

NVMe-FC Boot from SAN is now fully supported

The Non-volatile Memory Express (NVMe) over Fibre Channel (NVMe/FC) Boot, which was introduced in Red Hat Enterprise Linux 9.2 as a Technology Preview, is now fully supported. Some NVMe/FC host bus adapters support a NVMe/FC boot capability. For more information on programming a Host Bus Adapter (HBA) to enable NVMe/FC boot capability, see the NVMe/FC host bus adapter manufacturer’s documentation.

Converting a standard LV to a thin LV by using lvconvert is now possible

By specifying a standard logical volume (LV) as a thin pool data volume, you can now convert a standard LV to a thin LV by using the lvconvert command. With this update, you can convert existing LVs to use the thin provisioning facility.

Integrity targets now generate Audit events

The integrity target now generates Audit events. You can use these Audit events for logging of additional security-relevant event types.

dm-verity now supports forward error correction

The dm-verity target now supports forward error correction (FEC). With FEC, you can use pre-generated error correction data to recover from corrupted blocks.

NVMe native multipathing is now enabled by default

Non-volatile Memory Express (NVMe) native multipathing is enabled by default in Red Hat Enterprise Linux 9 and is the recommended multipathing solution. You can now configure multipathing on NVMe without using the DM Multipath framework. NVMe native multipathing provides higher performance.

VDO Management software has been removed

The python-based VDO Management software is no longer available in RHEL 9. Instead of this software, use the LVM-VDO implementation for managing VDO volumes.

Multiple write policies from VDO has been removed

VDO no longer has multiple write policies. VDO now uses the async write policy exclusively. The 'sync' and 'async-unsafe' write policies have been removed.

Stratis storage manager is now available

Stratis is a local storage manager. It provides managed file systems on top of pools of storage with additional features to the user:

pcs commands that support the clufter tool have been removed

The pcs commands that support the clufter tool for analyzing cluster configuration formats have been removed. The following commands have been removed:

pcs suppport for OCF Resource Agent API 1.1 standard

The pcs command-line interface now supports OCF 1.1 resource and STONITH agents. As part of the implementation of this support, any agent’s metadata must comply with the OCF schema, whether the agent is an OCF 1.0 or OCF 1.1 agent. If an agent’s metadata does not comply with the OCF schema, pcs considers the agent invalid and will not create or update a resource of the agent unless the --force option is specified. The pcsd Web UI and pcs commands for listing agents now omit agents with invalid metadata from the listing.

New pcs parsing requires meta keyword when specifying clone meta attributes

To ensure consistency in the pcs command format, configuring clone meta attributes with the pcs resource clone, pcs resource promotable, and pcs resource create commands without specifying the meta keyword is now deprecated.

A new passwordless authentication method is available in SSSD

As of RHEL 9.4, you can enable and configure passwordless authentication in SSSD to use a biometric device that is compatible with the FIDO2 specification, for example a YubiKey. You must register the FIDO2 token in advance and store this registration information in the user account in RHEL IdM, Active Directory, or an LDAP store. RHEL implements FIDO2 compatibility with the libfido2 library, which currently only supports USB-based tokens.

Identity Management API is now fully supported

As of RHEL 9.3, the Identity Management (IdM) API is a fully supported feature.

Identity Management installation packages have been demodularized

Previously in RHEL 8, IdM packages were distributed as modules, which required you to enable a stream and install the profile that corresponds to your desired installation. IdM installation packages have been demodularized in RHEL 9, so you can use the following dnf commands to install IdM server packages:

The SSSD implicit files provider domain is disabled by default

The SSSD implicit files provider domain, which retrieves user information from local files such as /etc/shadow and group information from /etc/groups, is now disabled by default.

New realm configuration template for KDC enabling FIPS 140-3-compliant key encryption

This update provides a new, EXAMPLE.COM, example realm configuration in the /var/kerberos/krb5kdc/kdc.conf file. It brings two changes:

Improved SSSD multi-threaded performance

Previously, SSSD serialized parallel requests from multi-threaded applications, such as Red Hat Directory Server and Identity Management. Starting with RHEL 9.1, all SSSD client libraries, such as nss and pam, do not serialize requests, therefore allowing requests from multiple threads to be executed in parallel for better performance.

ansible-freeipa now additionally provides the roles and modules as an Ansible collection in the ansible-freeipa-collection subpackage

To use the new collection:

IdM-to-IdM migration is now available as a Technology Preview

In RHEL 9.5, you can use the new ipa-migrate utility, which Red Hat provides as an unsupported Technology Preview, to migrate all IdM-specific data, such as SUDO rules, HBAC, DNA ranges, hosts, services, and more, to another IdM server. This can be useful, for example, when moving IdM from a development or staging environment into a production one or when migrating IdM data between two production servers.

Users without SIDs cannot log in to IdM after an upgrade

After upgrading your Identity Management (IdM) replica to RHEL 9.2, the IdM Kerberos Distribution Centre (KDC) might fail to issue ticket-granting tickets (TGTs) to users who do not have Security Identifiers (SIDs) assigned to their accounts. Consequently, the users cannot log in to their accounts.

Adding a RHEL 9 replica in FIPS mode to an IdM deployment in FIPS mode that was initialized with RHEL 8.6 or earlier fails

The default RHEL 9 FIPS cryptographic policy aiming to comply with FIPS 140-3 does not allow the use of the AES HMAC-SHA1 encryption types' key derivation function as defined by RFC3961, section 5.1.

ansible-freeipa is now available in the AppStream repository with all dependencies

Previously in RHEL 8.5 and earlier, before installing the ansible-freeipa package, you first had to enable the Ansible repository and install the ansible package. In RHEL 9, you can install ansible-freeipa without any preliminary steps. Installing ansible-freeipa automatically installs ansible-core as a dependency. Both packages are available in the rhel-9-for-x86_64-appstream-rpms repository.

Clustered Samba packages are now available from the Resilient Storage and Gluster Samba Repository

The ctdb clustered Samba packages are now available from the Resilient Storage and Gluster Samba Repository. Previously in RHEL 8, clustered Samba packages were available from the BaseOS repository.

The nss-pam-ldapd package has been removed

The nss-pam-ldapd package has been removed from RHEL. Red Hat recommends migrating to SSSD and its ldap provider, which fully replaces the functionality of the nslcd service. SSSD has features that specifically address the needs of nss-pam-ldapd users, such as:

NIS packages have been removed

The following Network Information Service (NIS) components have been removed from RHEL:

The openssh-ldap package has been removed

As the openssh-ldap subpackage is not maintained upstream, it has been removed from RHEL. Red Hat recommends using SSSD and the sss_ssh_authorizedkeys helper, which integrate better with other IdM solutions and are more secure.

The custodia package has been removed

The custodia package has been integrated into Red Hat Identity Management in RHEL 9 and is no longer shipped as a separate service.

The gssntlmssp package has been removed

As Windows New Technology LAN Manager (NTLM) is considered insecure, the gssntlmssp package has been removed.

The nsslapd-conntablesize configuration parameter has been removed from 389-ds-base

The nsslapd-conntablesize configuration parameter has been removed from the 389-ds-base package in RHEL 9.3. Previously, the nsslapd-conntablesize configuration attribute specified the size of the connection table that managed established connections. With the introduction of the multi-listener feature, which improves the management of established connections, Directory Server now calculates the size of the connection table dynamically. This also resolves issues, when the connection table size was set too low and it affected the number of connections the server was able to support. Starting with RHEL 9.3, use only nsslapd-maxdescriptors and nsslapd-reservedescriptors attributes to manage the number of TCP/IP connections Directory Server can support.

Limited support for FreeRADIUS

In RHEL 9, the following external authentication modules are not supported as part of the FreeRADIUS offering:

Support for Berkeley DB dynamic back end has been removed

With this release, the Berkeley DB (libdb) dynamic back end is no longer supported. The named-sdb build is no longer provided. You can use the DLZ loadable plugins for each back end, for example, sqlite3 or mysql. Those plugins are not built or shipped and have to be built from the source.

The mod_php module provided with PHP for use with the Apache HTTP Server has been removed

The mod_php module provided with PHP for use with the Apache HTTP Server is no longer available in RHEL 9.

The BIND 9.18 is now supported in RHEL

BIND 9.18 has been added in RHEL 9.5 in the new bind9.18 package. The notable feature enhancements include the following:

Anaconda activates network automatically for interactive installations

Anaconda now activates the network automatically when performing interactive installation, without requiring users to manually activate it in the network spoke. This update does not change the installation experience for Kickstart installations and installations using the ip= boot option.

New options to Lock root account and Allow root SSH login with password

RHEL 9 adds following new options to the root password configuration screen:

Licensing, system, and user setting configuration screens have been disabled post standard installation

Previously, RHEL users configured Licensing, System (Subscription manager), and User Settings prior to gnome-initial-setup and login screens. Starting with RHEL 9, the initial setup screens have been disabled by default to improve user experience. If you must run the initial setup for user creation or license display, install the following packages based on the requirements.

The rhsm command for machine provisioning through Kickstart for Satellite is now available

The rhsm command replaces the %post scripts for machine provisioning on RHEL 9. The rhsm command helps with all provisioning tasks such as registering the system, attaching RHEL subscriptions, and installing from a Satellite instance.

New Kickstart command - timesource

The new timesource Kickstart command is optional and it helps to set NTP, NTS servers, and NTP pools that provide time data. It also helps to control enabling or disabling the NTP services on the system. The --ntpservers option from the timezone command has been deprecated and has been replaced with this new command.

Support for Anaconda boot arguments without inst. prefix is no longer available

Anaconda boot arguments without the inst. prefix have been deprecated since RHEL 7. Support for these boot arguments has been removed in RHEL 9. To continue using these options, use the inst. prefix

Removed Kickstart commands and options

The following Kickstart commands and options have been removed from RHEL 9. Using them in Kickstart files causes an error.

Removed boot options

The following boot options have been removed from Red Hat Enterprise Linux:

Support to additional Edge image type creation

RHEL image builder now supports building RHEL for Edge for AWS edge-ami and Vmware VSphere edge-vsphere.

Disk image partition table unification

Disk images created by using the RHEL image builder tool, such as qcow2,ami, vhd, vsphere, and gce, now have a separate boot with 1 GiB of space.

Support to additional Edge image type creation

Starting with 9.4, RHEL image builder supports OpenSCAP customizations in the blueprint by adding a tailoring file for scap security profile. You can add customized tailoring options for a profile to the osbuild-composer blueprint customizations by using the following options:

AWS EC2 images now support both BIOS and UEFI boot

This update extends the AWS EC2 AMD or Intel 64-bit architecture .ami images created by RHEL image builder to support UEFI boot, in addition to the legacy BIOS boot.

Support to build VMware VSphere (OVA)

RHEL image builder can build VMware VSphere Open Virtual Appliance (OVA) files that you can deploy more easily to VMware vSphere by using the vSphere GUI client.

A new and improved way to create blueprints and images in the RHEL image builder web console

With the new unified version of the image builder tool, you can much more easily create blueprints and images. Notable enhancements include the following:

Ability to create images with support to different partitioning modes

With RHEL image builder, you can build VMware VSphere Open Virtual Appliance (OVA) files. You can deploy such files to VMware vSphere by using the vSphere GUI client .

Filesystem customization policy changes in image builder

The following policy changes are in place when using the RHEL image builder filesystem customization in blueprints:

RHEL image builder supports creating customized files and directories in the /etc directory

With the new`[[customizations.files]]` and the [[customizations.directories]] blueprint customizations, you can create customized files and directories in the /etc image directory. Currently, these customizations are only available in the /etc directory. You can use the customizations for all available image types, except image types that deploy OSTree commits, such as:

.vhd images built with RHEL image builder now have support for 64-bit ARM

You can now build .vhd images using image builder and upload them to the Microsoft Azure cloud.

RHEL image builder supports customized file system partitions on LVM

With support for customized file system partitions on LVM, if you add any file system customization to your system, the file systems are converted to an LVM partition.

RHEL image builder now supports file system configuration

As of Red Hat Enterprise Linux 9.0, Image Builder provides support for users to specify a custom filesystem configuration in blueprints to create images with a specific disk layout, instead of using the default layout configuration.

RHEL image builder can create bootable ISO Installer images

You can use RHEL image builder GUI and CLI to create bootable ISO Installer images. These images consist of a tar file that contains a root file system which you can use to install directly to a bare metal server.

The kexec-tools package now supports the default crashkernel memory reservation values for RHEL 9

The kexec-tools package now maintains the default crashkernel memory reservation values. The kdump service uses the default value to reserve the crashkernel memory for each kernel. This implementation also improves memory allocation for kdump when a system has less than 4GB of available memory.

The TPM 1.2 secure cryptoprocessor is no longer supported on RHEL 9

The Trusted Platform Module (TPM) secure cryptoprocessor version 1.2 has been removed and is no longer supported on RHEL 9 and later versions. TPM 2.0 replaces TPM 1.2 and provides many improvements over TPM 1.2. TPM 2.0 is not backward compatible.

Dynamic preemptive scheduling enabled on ARM, AMD, and Intel 64-bit architectures

Using Dynamic Scheduling, you can change the preemption mode of the kernel at boot or runtime instead of compile time. With dynamic preemptive handling, you can override the default preemption model to improve scheduling latency.

A new command line interface has been added to the tuna tool

The tuna tool now provides a command line interface with more standardized menu of commands and options that is easier to use and maintain. The new command line interface is based on the argparse parsing module. With this enhancement, you can perform the following tasks:

The runtime verification mechanism available for real-time kernel

Runtime verification is a lightweight and rigorous method to check the behavioral equivalence between system events and its formal specifications. Runtime verification has monitors integrated in the kernel that attach to tracepoints. If a state deviates from defined specifications, the runtime verification program activates reactors to inform or enable a reaction such as capturing the event in the log file or a system shutdown to avoid failure propagation in an extreme case.

CONFIG_RT_GROUP_SCHED is disabled in RHEL 9

In RHEL 8, the default control group was cgroups v1, and you could specify CPU bandwidth for realtime tasks on a per cgroup basis by using control files, for example, /sys/fs/cgroup/cpu,cpuacct/cpu.rt_period_us and /sys/fs/cgroup/cpu,cpuacct/cpu.rt_runtime_us. However, in RHEL 9, the CONFIG_RT_GROUP_SCHED kernel configuration option is disabled because cgroups v2 is the default control group and the equivalent control files do not exist for the cgroups v2 CPU controller. Note that the /proc/sys/kernel/sched_rt_runtime_us and /proc/sys/kernel/sched_rt_period_us global settings are still available, and you can use them with the stalld background process to prevent CPU time starvation.

The 64k page size kernel

In addition to the RHEL 9 for ARM kernel which supports 4k pages, Red Hat now offers an optional kernel package that supports 64k pages: kernel-64k.

cgroup-v2 enabled by default in RHEL 9

The control groups version 2 (cgroup-v2) feature implements a single hierarchy model that simplifies the management of control groups. Also, it ensures that a process can only be a member of a single control group at a time. Deep integration with systemd improves the end-user experience when configuring resource control on a RHEL system.

Kernel changes potentially affecting third party kernel modules

Linux distributions with a kernel version prior to 5.9 supported exporting GPL functions as non-GPL functions. As a result, users could link proprietary functions to GPL kernel functions through the shim mechanism. With this release, the RHEL kernel incorporates upstream changes that enhance the ability of RHEL to enforce GPL by rebuffing shim.

Core scheduling is supported in RHEL 9

With the core scheduling functionality users can prevent tasks that should not trust each other from sharing the same CPU core. Likewise, users can define groups of tasks that can share a CPU core.

The kernelopts environment variable has been removed in RHEL 9

In RHEL 8, the kernel command-line parameters for systems using the GRUB2 bootloader were defined in the kernelopts environment variable. This variable was stored in the /boot/grub2/grubenv file for each kernel boot entry. However, storing the kernel command-line parameters using kernelopts was not robust. Therefore, Red Hat removed kernelopts and the kernel command-line parameters are now stored in the Boot Loader Specification (BLS) snippet, instead of in the /boot/loader/entries/<KERNEL_BOOT_ENTRY>.conf file.

Red Hat protects kernel symbols only for minor releases

Red Hat guarantees that a kernel module will continue to load in all future updates within an Extended Update Support (EUS) release, only if you compile the kernel module using protected kernel symbols. There is no kernel Application Binary Interface (ABI) guarantee between minor releases of RHEL 9.

Boot loader menu hidden by default

Starting with RHEL 9.1, the GRUB boot loader is now configured to hide the boot menu by default if RHEL is the only installed operating system and if the previous boot succeeded. This results in a smoother boot experience on such systems.

Boot loader configuration files are unified across CPU architectures

Configuration files for the GRUB boot loader are now stored in the /boot/grub2/ directory on all supported CPU architectures. The /boot/efi/EFI/redhat/grub.cfg file, which GRUB previously used as the main configuration file on UEFI systems, now simply loads the /boot/grub2/grub.cfg file.

RHEL no longer boots on 32-bit UEFI

Support for the 32-bit UEFI firmware was removed from the GRUB and shim boot loaders. As a consequence, RHEL 9 requires a 64-bit UEFI, and can no longer boot on 64-bit systems that use a 32-bit UEFI.

WireGuard VPN is available as a Technology Preview

WireGuard, which Red Hat provides as an unsupported Technology Preview, is a high-performance VPN solution that runs in the Linux kernel. It uses modern cryptography and is easier to configure than other VPN solutions. Additionally, the small code-basis of WireGuard reduces the surface for attacks and, therefore, improves the security.

The PRP and HSR protocols are available as a Technology Preview

Starting with RHEL 9.3, the hsr kernel module is available as an unsupported Technology Preview. The module provides the following protocols:

Segment Routing over IPv6 (SRv6) is available as a Technology Preview

The RHEL 9.3 kernel provides Segment Routing over IPv6 (SRv6) as an unsupported Technology Preview. You can use this functionality to optimize traffic flows in edge computing or to improve network programmability in data centers. However, the most significant use case is the end-to-end (E2E) network slicing in 5G deployment scenarios. In that area, the SRv6 protocol provides you with the programmable custom network slices and resource reservations to address network requirements for specific applications or services. At the same time, the solution can be deployed on a single-purpose appliance, and it satisfies the need for a smaller computational footprint.

NetworkManager and the Nmstate API support MACsec hardware offload

You can use both NetworkManager and the Nmstate API to enable MACsec hardware offload if the hardware supports this feature. As a result, you can offload MACsec operations, such as encryption, from the CPU to the network interface card.

Network teams are deprecated

The teamd service and the libteam library are deprecated in Red Hat Enterprise Linux 9 and will be removed in the next major release. As a replacement, configure a bond instead of a network team.

NetworkManager stores new network configurations in a key file format

Previously, NetworkManager stored new network configurations to /etc/sysconfig/network-scripts/ in the ifcfg format. Starting with RHEL 9.0, RHEL stores new network configurations at /etc/NetworkManager/system-connections/ in a key file format. The connections for which the configurations are stored to /etc/sysconfig/network-scripts/ in the old format still work uninterrupted. Modifications in existing profiles continue updating the older files.

The WEP Wi-Fi connection method has been removed

The insecure wired equivalent privacy (WEP) Wi-Fi connection method has been removed from RHEL 9. For secure Wi-Fi connections, use the Wi-Fi Protected Access 3 (WPA3) or WPA2 connection methods.

dhclient in NetworkManager is now deprecated

Instead of the default internal DHCP library, NetworkManager in RHEL 9 can be configured to use a DHCP client from the dhclient package. The option to use dhclient is now deprecated and results in a warning displayed at the NetworkManager startup. We recommend that you switch to the internal DHCP library. In RHEL 10, dhclient is no longer available and the applications configured to use dhclient now use the internal DHCP library instead.

The mptcpd service is available

With this update the mptcpd service is available for usage. It is a user space based MPTCP path manager with integrated mptcpize tool.

The ipset and iptables-nft packages have been deprecated

The ipset and iptables-nft packages have been deprecated in RHEL. The iptables-nft package contains different tools such as iptables, ip6tables, ebtables and arptables. These tools will no longer receive new features and using them for new deployments is not recommended. As a replacement, it is recommended to use the nft command line tool provided by the nftables package. Existing setups should migrate to nft when possible.

The unsupported xt_u32 Netfilter module has been removed

RHEL 8 contained the unsupported xt_u32 module, which enabled iptables users to match arbitrary 32 bits in the packet header or payload. This module has been removed from RHEL 9. As a replacement, use the nftables packet filtering framework. If no native match exists in nftables, use the raw payload matching feature of nftables. For details, see the raw payload expression section in the nft(8) man page on your system.

The ibdev2netdev script has been removed from RHEL 9

ibdev2netdev was a helper utility that was able to display all the associations between network devices and Remote Direct Memory Access (RDMA) adapter ports. Previously, Red Hat was including ibdev2netdev in the rdma-core package. From Red Hat Enterprise Linux 9, ibdev2netdev has been removed and replaced by the rdmatool utility. Now, the iproute package includes rdmatool.

RHEL 9 does not contain the legacy network scripts

RHEL 9 does not contain the network-scripts package that provided the deprecated legacy network scripts in RHEL 8. To configure network connections in RHEL 9, use NetworkManager. For details, see the Configuring and managing networking documentation.

The unsupported xt_u32 Netfilter module has been removed

RHEL 8 contained the unsupported xt_u32 module, which enabled iptables users to match arbitrary 32 bits in the packet header or payload. This module has been removed from RHEL 9. As a replacement, use the nftables packet filtering framework. If no native match exists in nftables, use the raw payload matching feature of nftables. For details, see the raw payload expression section in the nft(8) man page on your system.

Data Encryption Standard (DES) algorithm is not available for net-snmp communication in Red Hat Enterprise Linux 9

In previous versions of RHEL, DES was used as an encryption algorithm for secure communication between net-snmp clients and servers. In RHEL 9, the DES algorithm isn’t supported by the OpenSSL library. The algorithm is marked as insecure and hence the DES support for net-snmp has been removed.

Performance Co-Pilot rebased to version 6.0

Starting in RHEL 9.2, Performance Co-Pilot (PCP) has been updated to version 6.0. Notable improvements include:

The sadf(1) tool now generates PCP archives from native sadc(1) archives

Starting in RHEL 9, the sadf(1) tool provided by the sysstat package can generate PCP archives from native sadc(1) archives.

New PCP PMDA - pmdabpf

RHEL 9 is distributed with the pcp-pmda-bpf package, which provides the pmdabpf Performance Co-Pilot (PCP) Performance Metric Domain Agent (PMDA).

CIS and DISA STIG profiles provided as DRAFT

The profiles based on benchmarks from the Center for Internet Security (CIS) and Defence Industry Security Association Security Technical Implementation Guides (DISA STIG) are provided as DRAFT because the issuing authorities have not yet published an official benchmark for RHEL 9. In addition, the OSSP profile is in DRAFT because it is being implemented.

OpenSCAP no longer supports SHA-1 and MD5

Due to removal of SHA-1 and MD5 hash functions in Red Hat Enterprise Linux 9, support for OVAL filehash_test has been removed from OpenSCAP. Also, support for SHA-1 and MD5 hash functions has been removed from OVAL filehash58_test implementation in OpenSCAP. As a result, OpenSCAP evaluates rules in SCAP content that use the OVAL filehash_test as notchecked. In addition, OpenSCAP returns notchecked also when evaluating OVAL filehash58_test with the hash_type element within filehash58_object set to SHA-1 or MD5.

OpenSCAP uses the data stream file instead of the XCCDF file

The SCAP source data stream file (ssg-rhel9-ds.xml) contains all the data that in previous versions of RHEL were contained in the XCCDF file (ssg-rhel9-xccdf.xml). The SCAP source data stream is a container file that includes all the components (XCCDF, OVAL, CPE) needed to perform a compliance scan. Using the SCAP source data stream instead of XCCDF has been recommended since RHEL 7. In previous versions of RHEL, the data in the XCCDF file and SCAP source data stream was duplicated. In RHEL 9, this duplication is removed to reduce the RPM package size. If your scenario requires using separate files instead of the data stream, you can split the data stream file by using this command: # oscap ds sds-split /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml output_directory.

Continuing SHA-1 deprecation

In RHEL 9, SHA-1 usage for signatures is restricted in the DEFAULT system-wide cryptographic policy. Except for HMAC, SHA-1 is no longer allowed in TLS, DTLS, SSH, IKEv2, DNSSEC, and Kerberos protocols. Individual applications not controlled by the RHEL system-wide crypto policies are also moving away from using SHA-1 hashes in RHEL 9.

Algorithms disabled in all policy levels

The following algorithms are disabled in the LEGACY, DEFAULT and FUTURE crypto policies provided with RHEL 9:

Changes to TLS

In RHEL 9, TLS configuration is performed using the system-wide cryptographic policies mechanism. TLS versions below 1.2 are not supported anymore. DEFAULT, FUTURE and LEGACY cryptographic policies allow only TLS 1.2 and 1.3. See Using system-wide cryptographic policies for more information.

The Extended Master Secret TLS Extension is now enforced on FIPS-enabled systems

With the release of the RHSA-2023:3722 advisory, the TLS Extended Master Secret (EMS) extension (RFC 7627) is mandatory for TLS 1.2 connections on FIPS-enabled RHEL 9 systems. This is in accordance with FIPS-140-3 requirements. TLS 1.3 is not affected.

SCP not supported in RHEL 9

The secure copy protocol (SCP) protocol is no longer supported because it is difficult to secure. It has already caused security issues, for example CVE-2020-15778. In RHEL 9, SCP is replaced by the SSH File Transfer Protocol (SFTP) by default.

Interoperability of FIPS:OSPP hosts impacted due to CNSA 1.0

The OSPP subpolicy has been aligned with Commercial National Security Algorithm (CNSA) 1.0. This affects the interoperability of hosts that use the FIPS:OSPP policy-subpolicy combination, with the following major aspects:

OpenSSH root password login disabled by default

The default configuration of OpenSSH in RHEL 9 disallows users to log in as root with a password to prevent attackers from gaining access through brute-force attacks on passwords.

OpenSSH further enforces SHA-2

As part of the effort to migrate further from the less secure SHA-1 message digest for cryptographic purposes, the following changes were made in OpenSSH:

GnuTLS requires EMS with TLS 1.2 in FIPS mode

To comply with the FIPS-140-3 standard, GnuTLS servers and clients require the Extended Master Secret (EMS) extension (RFC 7627) for all TLS 1.2 connections negotiated in FIPS mode. If your scenario requires preserving compatibility with older servers and clients that do not support EMS and you cannot use TLS 1.3, you can apply the NO-ENFORCE-EMS system-wide cryptographic subpolicy:

GnuTLS no longer supports TPM 1.2

The GnuTLS library no longer supports the Trusted Platform Module (TPM) 1.2 technology. Your applications using TPM through the GnuTLS API must support TPM 2.0.

GnuTLS support for GOST has been removed

In RHEL 8, the GOST ciphers have been disabled through the system-wide cryptographic policies. In RHEL 9, support for these ciphers has been removed from the GnuTLS library.

cyrus-sasl now uses GDBM instead of Berkeley DB

The cyrus-sasl package is now built without the libdb dependency, and the sasldb plugin uses the GDBM database format instead of Berkeley DB. To migrate your existing Simple Authentication and Security Layer (SASL) databases stored in the old Berkeley DB format, use the cyrusbdb2current tool with the following syntax:

NSS now enforce EMS in FIPS mode

The Network Security Services (NSS) libraries now contain the TLS-REQUIRE-EMS policy to require the Extended Master Secret (EMS) extension (RFC 7627) for all TLS 1.2 connections as mandated by the FIPS 140-3 standard. NSS use the new policy when the system-wide cryptographic policies are set to FIPS.

NSS no longer support DBM and pk12util defaults changed

The Network Security Services (NSS) libraries no longer support the DBM file format for the trust database. In RHEL 8, the SQLite file format became the default format, and the existing DBM databases were opened on read-only mode and automatically converted to SQLite. Before you upgrade to RHEL 9, update all trust databases from DBM to SQLite.

NSS pk12util no longer uses DES-3 and SHA-1 by default

The pk12util tool now uses the AES and SHA-256 algorithms instead of DES-3 and SHA-1 by default when exporting private keys.

NSS no longer support RSA keys shorter than 1023 bits

The update of the Network Security Services (NSS) libraries changes the minimum key size for all RSA operations from 128 to 1023 bits. This means that NSS no longer perform the following functions:

OpenSSL ENGINE extension API is not supported in FIPS mode

The legacy extension system to OpenSSL, the ENGINE API, is not compatible with the new provider API. Therefore, applications that depend on functionality provided by OpenSSL engines, such as the openssl-pkcs11 and openssl-ibmca modules, cannot be used in FIPS mode.

FIPS mode in OpenSSL must be enabled to work correctly

If you are using non-default values in the openssl.cnf configuration file with FIPS mode enabled, and especially when using a third-party FIPS provider, add fips=yes to the openssl.cnf file.

OpenSSL does not accept explicit curve parameters in FIPS mode

Elliptic curve cryptography parameters, private keys, public keys, and certificates that specified explicit curve parameters no longer work in FIPS mode. Specifying the curve parameters using ASN.1 object identifiers, which use one of the FIPS-approved curves, still works in FIPS mode.

OpenSSL no longer creates X.509 v1 certificates

With the OpenSSL TLS toolkit 3.2.1 introduced in RHEL 9.5, you can no longer create certificates in the X.509 version 1 format using the openssl CA tool. The X.509 v1 format does not meet current web requirements.

Libreswan now requests ESN by default

In Libreswan, the default value for the configuration option esn= has changed from no to either. This means that when initiating connections, Libreswan requests the use of Extended Serial Number (ESN) by default. In particular, when hardware offload is used, this new behavior prevents certain network interface cards (NIC) from establishing IPsec connection if they do not support ESN. To disable ESN, set esn= to no and the replay_window= option to a value of 32 or lower. For example:

Support for disabling SELinux through /etc/selinux/config has been removed

With the RHEL 9.0 release, support for disabling SELinux through the SELINUX=disabled option in the /etc/selinux/config file has been removed from the kernel. When you disable SELinux only through /etc/selinux/config, the system starts with SELinux enabled but with no policy loaded, and SELinux security hooks remain registered in the kernel. This means that SELinux disabled by using /etc/selinux/config still requires some system resources, and you should instead disable SELinux by using the kernel command line in all performance-sensitive scenarios.

Additional services confined in the SELinux policy

The RHEL 9.3 release added additional rules to the SELinux policy that confine the following systemd services:

The glusterd SELinux module moved to a separate glusterfs-selinux package

With this update, the glusterd SELinux module is maintained in the separate glusterfs-selinux package. The module is therefore no longer part of the selinux-policy package. For any actions that concern the glusterd module, install and use the glusterfs-selinux package.

Data Encryption Standard (DES) algorithm is not available for net-snmp communication in Red Hat Enterprise Linux 9

In previous versions of RHEL, DES was used as an encryption algorithm for secure communication between net-snmp clients and servers. In RHEL 9, the DES algorithm isn’t supported by the OpenSSL library. The algorithm is marked as insecure and the DES support for net-snmp has therefore been removed.

The ABRT tool has been removed

The Automatic Bug Reporting Tool (ABRT) for detecting and reporting application crashes is not available in RHEL 9.

The hidepid=n mount option is not supported in RHEL 9 systemd

The mount option hidepid=n, which controls who can access information in /proc/[pid] directories, is not compatible with systemd infrastructure provided in RHEL 9.

The dump utility from the dump package has been removed

The dump utility used for backup of file systems has been deprecated in Red Hat Enterprise Linux 8 and is not available in RHEL 9.

RHEL 9 does not contain ReaR crontab

The /etc/cron.d/rear crontab in the rear package, which runs rear mkrescue after the disk layout changes, has been removed in RHEL 9.

Support for the raw command-line tool has been removed

With this release, the raw (/usr/bin/raw) command-line tool has been removed from the util-linux package, because Linux kernel does not support raw devices since version 5.14.

cgroupsv1 is deprecated in RHEL 9

cgroups is a kernel subsystem used for process tracking, system resource allocation and partitioning. Systemd service manager supports booting in the cgroups v1 mode and in cgroups v2 mode. In Red Hat Enterprise Linux 9, the default mode is v2. In the next major release, systemd will not support booting in the cgroups v1 mode and only cgroups v2 mode will be available.

The lsb-release binary is not available in RHEL 9

The information in the /etc/os-release file was previously available by calling the lsb-release binary. This binary was included in the redhat-lsb package, which was removed in RHEL 9. Now, you can display information about the operating system, such as the distribution, version, code name, and associated metadata, by reading the /etc/os-release file. This file is provided by Red Hat and any changes to it are overwritten with each update of the redhat-release package. The format of the file is KEY=VALUE, and you can safely source the data for a shell script.

Package management with DNF/YUM

In Red Hat Enterprise Linux 9, software installation is ensured by DNF. Red Hat continues to support the usage of the yum term for consistency with previous major versions of RHEL. If you type dnf instead of yum, the command works as expected because both are aliases for compatibility.

Notable RPM features and changes

Red Hat Enterprise Linux 9 is distributed with RPM version 4.16. This version introduces many enhancements over its previous versions.

Merged system purpose commands under the subscription-manager syspurpose command

Previously, there were two different commands to set system purpose attributes; syspurpose and subscription-manager. To unify all the system purpose attributes under one module, all the addons, role, service-level, and usage commands from subscription-manager have been moved to the new submodule, subscription-manager syspurpose.

virt-who now uses /etc/virt-who.conf for global options instead of /etc/sysconfig/virt-who

In RHEL 9, the global options for the virt-who utility on your system are stored in the /etc/virt-who.conf file. Therefore, the /etc/sysconfig/virt-who file is not being used any more, and has been removed.

RHEL system roles support

Support for the following roles are available:

Support for Ansible Engine 2.9 is no longer available in RHEL 9

Ansible Engine 2.9 is no longer available in Red Hat Enterprise Linux 9. Playbooks that previously ran on Ansible Engine 2.9 might generate error messages related to missing plugins or modules. If your use case for Ansible falls outside of the limited scope of support for Ansible Core provided in RHEL, contact Red Hat to discuss the available offerings.

RHEL system roles now uses Ansible Core

As of the RHEL 9 General Availability release, Ansible Core is provided with a limited scope of support to enable RHEL supported automation use cases. Ansible Core is available in the AppStream repository for RHEL. For details on the scope of support, refer to Scope of support for the Ansible Core package included in the RHEL 9 AppStream.

The deprecated --token option of the subscription-manager register command will stop working at the end of November 2024

The default entitlement server, subscription.rhsm.redhat.com, will no longer be allowing token-based authentication from the end of November 2024. As a result, the deprecated --token=<TOKEN> option of the subscription-manager register command will no longer be a supported authentication method. As a consequence, if you use subscription-manager register --token=<TOKEN>, the registration will fail with the following error message:

RHEL system roles can be used to manage multiple different versions of RHEL

You can use RHEL system roles as a consistent interface to manage different versions of RHEL. This can help to ease the transition between major versions of RHEL.

RHEL 8 moves to Maintenance Support phase

After the RHEL 8.10 release, RHEL 8 moved to the Maintenance Support phase and will no longer receive new features. As a result, starting with RHEL 9.5, new features will only be available in RHEL 9. Therefore, to get access to the latest enhancements use RHEL 9 for your RHEL system role control nodes.

KVM virtualization is no longer supported on IBM POWER

Red Hat Kernel-based Virtual Machine (KVM) for RHEL 9.0 and later is not supported on IBM POWER hardware.

KVM virtualization fully supported on 64-bit ARM architecture

In RHEL 9.4 and later, creating KVM virtual machines on systems that use 64-bit ARM (also known as AArch64) CPUs is fully supported. Note, however, that certain virtualization features and functionalities that are available on AMD64 and Intel 64 systems might work differently or be unsupported on 64-bit ARM systems.

VM machine types based on RHEL 7.5 and earlier are unsupported

In RHEL 9, virtual machines (VMs) no longer support machine types based on RHEL 7.5 and earlier. These also include pc-i440fx-rhel7.5.0 and earlier machine types, which were default in earlier major versions of RHEL. As a consequence, attempting to start a VM with such machine types on a RHEL 9 host fails with an unsupported configuration error. If you encounter this problem after upgrading your host to RHEL 9, see the Red Hat KnowledgeBase.

Modular libvirt daemons

In RHEL 9, the libvirt library uses modular daemons that handle individual virtualization driver sets on your host. For example, the virtqemud daemon handles QEMU drivers. This makes it possible to fine-grain a variety of tasks that involve virtualization drivers, such as resource load optimization and monitoring.

External snapshots for virtual machines

RHEL 9.4 and later supports the external snapshot mechanism for virtual machines (VMs), which replaces the previously deprecated internal snapshot mechanism. As a result, you can create, delete, and revert to VM snapshots that are fully supported. External snapshots work more reliably both in the command-line interface and in the RHEL web console. This also applies to snapshots of running VMs, known as live snapshots.

virsh iface-* commands are now unsupported

The virsh iface-* commands, such as virsh iface-start and virsh iface-destroy, are no longer supported in RHEL 9. Due to the removal of the netcf package, the majority of them do not work. To create and modify network interfaces, use NetworkManager utilities, such as nmcli.

QEMU no longer includes the SGA option ROM

In RHEL 9, the Serial Graphics Adapter (SGA) option ROM has been replaced by an equivalent functionality in SeaBIOS. However, if your virtual machine (VM) configuration uses the following XML fragament, this change will not affect your VM functionality.

TPM passthrough has been removed

It is no longer possible to assign a physical Trusted Platform Module (TPM) device using the passthrough back end to a VM on RHEL 9. Note that this was an unsupported feature in RHEL 8. Instead, use the vTPM functionality, which uses the emulator back end, and is fully supported.

Other unsupported devices

QEMU no longer supports the following virtual devices:

Intel vGPU removed

The packages required for the Intel vGPU feature were removed in RHEL 9.3.

SPICE has become unsupported

In RHEL 9, the SPICE remote display protocol is no longer supported. QXL, the graphics device used by SPICE, has also become unsupported. On a RHEL 9 host, VMs configured to use SPICE or QXL fail to start and instead display an unsupported configuration error.

Remote root login disabled on new installations of RHEL 9.2 and later

Due to security reasons, on new installations of RHEL 9.2 and newer, it is not possible to connect to the web console from a remote machine as a root user.