Chapter 4. New features

New boot menu entry for fips=1 added to ISO installations

With this update, the DVD and Boot ISO image installations provide a new boot menu entry for setting the fips=1 kernel boot option. This simplifies the process, as enabling FIPS mode during the RHEL installation ensures that the system generates all keys with FIPS-approved algorithms and continuous monitoring tests in place. By using this boot option, you start the installation with the fips=1 kernel parameter and you can target the system’s compliance with Federal Information Processing Standards (FIPS) 140 requirements.

The blueprint file customization now supports a URI field for referencing files from external sources

This update adds the URI field support to the blueprint file customization structure. As a result, you can reference and source files from external locations rather than only those included directly in the blueprint, providing more flexible customization of the build system and a more adaptable build experience.

RHEL image builder supports a new image type vagrant-libvirt for vagrant

With this update, RHEL image builder supports the libvirt hypervisor, and you can easily run RHEL virtual machines by using Vagrant. This enhancement provides pre-configured images to ensure a consistent and streamlined setup. It also grants sudo privileges to the vagrant user within the Vagrant box, making it easier to manage and execute administrative tasks. These enhancements deliver a more efficient and seamless experience when working with RHEL virtual machines in Vagrant environments.

RHEL Image Builder GUI supports modularized content discovery

Starting from RHEL 9.7, RHEL Image Builder Graphical User Interface (GUI) supports modularized content discovery. This capability introduces the following enhancements:

RHEL Image Builder now supports WSL2 images

You can now use the RHEL image builder to create Windows Subsystem for Linux (WSL2). The image type is available in the wsl format, and to consume the image, deploy it by double-clicking the generated file.

A new rhel9/bootc-image-builder container image is generally available in RHEL

The rhel9/bootc-image-builder container image for image mode for RHEL includes a minimal version of image builder that converts bootable container images, for example rhel-bootc, to different disk image formats, such as QCOW2, AMI, VMDK, ISO, and others.

The bootc-image-builder tool is generally available in RHEL

The bootc-image-builder tool, now generally available in RHEL, works as a container to easily create and deploy compatible disk images from the bootc container inputs. After running your container image with bootc-image-builder, you can generate images for the architecture that you need. Then, you can deploy the resulting image on VMs, clouds, or servers. You can easily update the images with the bootc, instead of having to regenerate the content with bootc-image-builder every time a new update is required.

composefs read-only file system supports bootc/ostree and podman projects

The composefs read-only file system is generally intended only to be used by the bootc/ostree and podman projects at the current time. With composefs, you can use these projects to create and use read-only images, share file data between images, and validate images at runtime. As a result, you have a fully verified file-system tree mounted, with opportunistic fine-grained sharing of identical files.

NSS rebased to 3.112

The NSS cryptographic toolkit packages have been rebased to upstream version 3.112, which provides many improvements and fixes. Most notably, the following:

RHEL 9.7 crypto-policies supports post-quantum cryptography

With this update of the system-wide cryptographic policies, you can enable support for post-quantum cryptography (PQC) through the new PQ subpolicy. The most notable changes in RHEL 9.7 crypto-policies include:

OpenSSL rebased to 3.5

OpenSSL is rebased to upstream version 3.5. This version provides important fixes and enhancements, most notably the following:

OpenSSL supports sslkeylogfile

OpenSSL supports the sslkeylogfile format for TLS. As a result, you can log all secrets produced by SSL connections by setting the SSLKEYLOGFILE environment variable.

Hybrid ML-KEM cryptography works in FIPS mode

With this release, Hybrid Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) post-quantum cryptographic algorithms are supported in FIPS mode of RHEL. OpenSSL is able to fetch the Elliptic Curve Diffie-Hellman (ECDH) part of the new hybrid post-quantum groups from the FIPS provider when the system is running in FIPS mode. As a result, the OpenSSL library uses FIPS-compliant cryptography for the ECDH part of the hybrid post-quantum key exchanges. When you set the system to the FIPS:PQ cryptographic policy, the hybrid post-quantum groups are enabled and used by default by OpenSSL servers and clients.

crypto-policies support Ed25519 in NSS

With this update to the system-wide cryptographic policies, support for the SHA-512 variant of the Edwards-curve Digital Signature Algorithm (EdDSA), Ed25519, is available for Network Security Services (NSS). As a result, crypto-policies enable Ed25519 in DEFAULT, LEGACY, and FUTURE policies for NSS by default.

New package: rust-rpm-sequoia

RHEL 9.7 introduces the rust-rpm-sequoia package to support quantum-resistant signatures in RPM packages through the multisig DNF plug-in. This addition enables you to verify OpenPGP v6 signatures in RPM packages signed with post-quantum cryptographic (PQC) algorithms.

SCAP Security Guide rebased to 0.1.78

For additional information, see the SCAP Security Guide release notes.

The SELinux policy adds rules and type for the qgs daemon

The qgs daemon was added to RHEL with the linux-sgx package, which supports TDX confidential virtualization. The qgs daemon communicates with QEMU over a UNIX domain socket when the guest OS requests attestation of the virtual machine (VM). To make this possible, the SELinux policy adds a new qgs_t type, access rules, and permissions.

Three RHEL services removed from SELinux permissive mode

The following SELinux domains for RHEL services have been removed from SELinux permissive mode:

tuned-ppd confined in the SELinux policy

RHEL 9.7 adds additional rules to the SELinux policy that confine the tuned-ppd service. Before this update, the service ran with the unconfined_service_t SELinux label, which violated the CIS Server Level 2 benchmark "Ensure No Daemons are Unconfined by SELinux" rule. With this update, the service is no longer unconfined and runs successfully in SELinux enforcing mode.

Keylime rebased to version 7.12.1

The Keylime packages have been rebased to upstream version 7.12.1. The most important fixes and enhancements include:

SELinux assigns a particular type to /dev/diag

With this update, the diagnostic_device_t type is assigned to the /dev/diag device in the SELinux policy. As a result, SELinux can properly control access to the device.

OpenSSL PKCS #11 provider adds support for Ex=RSA ciphers

This update of the OpenSSL PKCS #11 provider enables the use of PKCS #11 tokens with OpenSSL without relying on deprecated functionality. This alternative resolves the unsupported RSA padding mode issue, ensuring seamless use of Ex=RSA ciphers with hardware security modules (HSMs) on RHEL 9. This results in eliminating TLS handshake failures and providing secure communication when establishing TLS 1.2 connections with OpenSSL and PKCS #11 tokens.

New package: fips-provider-next

The fips-provider-next package provides the next version of the FIPS provider that is submitted to the National Institute of Standards and Technology (NIST) for validation. The package is not installed by default because the openssl-fips-provider package is the validated OpenSSL FIPS provider. To switch from ‎openssl-fips-provider to ‎fips-provider-next:

Rsyslog imuxsock provides the new ratelimit.discarded counter

With this update, the imuxsock Rsyslog module includes a new counter, ratelimit.discarded, which tracks the number of messages dropped due to rate-limiting on the Unix socket. This enhancement provides administrators with visibility into message loss due to rate-limiting, enabling them to fine-tune their rate-limiting settings and prevent critical logs from being discarded.

Rsyslog imfile provides the new deleteStateOnFileMove option

With this update, the new deleteStateOnFileMove parameter has been added to the imfile module, available as both a module-level and a per-action option. This enhancement addresses the issue of orphaned state files accumulating in the spool/ directory when monitored log files are rotated or moved. By enabling this parameter, you can automatically clean up these obsolete files when log files are moved, preventing disk space from being wasted and simplifying management.

Simplified status for systems registered to SCA-enabled organizations

Before this update, when registered to a Simple Content Access (SCA) enabled organization, the subscription-manager status command reported Overall Status: Disabled and System Purpose Status: Disabled. Because this status was confusing and often misinterpreted as an error, the status report has been simplified. Now the Overall Status reports either Registered or Not registered and System Purpose Status has been eliminated.

dnf4 can be used to run DNF commands

With this update, you can enter either dnf or dnf4 to run DNF commands.

DNF can verify RPMv6 signatures on RPM packages

Quantum-safe cryptography guarantees integrity and origin of software. However, in quantum computing, standard asymmetric cryptography algorithms, such as RSA, are no longer relevant. With this update, you can use the new multisig DNF plugin to verify RPMv6 signatures on RPM packages, in addition to standard RPMv4 signatures. RPMv6 signatures can be based on quantum-safe algorithms, such as ML-DSA.

createrepo_c supports zstd

This enhancement adds support for the Zstandard (zstd) compression algorithm for createrepo_c commands. As a result, createrepo_c can read and generate metadata compressed with zstd.

dnf marks transient transactions in DNF history

The dnf history info command shows whether a transaction was persistent or transient. As a result, it is easier to keep track of package changes, especially on systems with many transient packages.

RPM records a checksum of the original package during installation

With this update, RPM records the SHA256 and SHA512 digests of the entire .rpm package during its installation. You can then retrieve these digests from the RPM database to verify that the installed package corresponds to a specific .rpm file. As a result, you can improve the integrity of your RHEL system by retrospectively verifying that the installed package set matches, bit-by-bit, a known set of .rpm packages, such as the ones available in a DNF repository.

RPM supports spec-local file attributes and dependency generators

File attributes and their dependency generators are usually shipped in separate packages that you must install prior to building a package that uses these attributes. However, you might need a file attribute to take effect during the build of the package that ships this attribute. You might also need the file attribute just for building the package, without shipping the attribute at all.

New $releasever_major and $releasever_minor variables

The new $releasever_major and $releasever_minor variables are available to better support the Extra Packages for Enterprise Linux (EPEL) repository and other repositories that distribute content per major version of RHEL instead of per minor version. These variables are automatically derived from the $releasever variable or the system-release(releasever_major) and system-release(releasever_minor) virtual provides. As a result, you can use $releasever_major and $releasever_minor to create repository configuration files that work across multiple major or minor versions of RHEL.

openCryptoki provided in version 3.25.0

The openCryptoki packages are provided in version 3.25.0. Support has been added for the following:

GIMP rebased to 3.0.4

The GNU Image Manipulation Program (GIMP) has been rebased to stable upstream version 3.0.4 in RHEL 9.7.

RHEL is now equipped with dyninst version 13.0.0

The dyninst framework is rebased to upstream version 13.0.0 This version offers the following list of enhancements:

RHEL is now equipped with SystemTap version 5.3

SystemTap is rebased to version 5.3, and its multithreaded parsing capability now improves startup performance by reducing initialization time by several seconds.

elfutils is now rebased to version 0.193

elfutils 0.193 is now available in RHEL 9.7. The notable changes in this update include:

valgrind has been upgraded to upstream version 3.25.1

The upgrade from version 3.24.0 (RHEL 9.6) to the upstream version 3.25.1 (RHEL 9.7) provides the following notable enhancements:

valgrind package split into subpackages for flexible installation

Before this update, the ‎valgrind package included all components in a single package. As a consequence, you had to install features that you did not need.

Valkey 8 is now available

Valkey 8, an advanced key-value store, is now available in RHEL. It functions as a data structure server, allowing keys to store various data types, for example:

fs.protected_regular and fs.protected_fifos sysctls parameters are enabled by default

Previously, in the RHEL 9 kernel the fs.protected_regular and fs.protected_fifos sysctls parameters were added to make some data spoofing attacks harder. Now, these parameters are enabled by default which improves the security for installations. To disable these sysctls parameters, add the following lines in the /etc/sysctl.d/60-protected.conf file:

The BrowseOptionsUpdate directive is now available in RHEL

The BrowseOptionsUpdate directive determines the source and update frequency of default printing options. It specifies whether the system retrieves options from a local system or a remote printing server, and if it updates them at service startup, at certain intervals, or not at all.

RHEL 10 provides gpsd in version 3.26.1

In RHEL 10, the gpsd tools package is provided in version 3.26.1. This version offers improved support for u-blox receivers.

Nmstate can assign settings to network interfaces based on PCI addresses

With this enhancement, you can use Nmstate to set up network interfaces based on their PCI address instead of a device name. Use this feature to ensure consistent configuration across nodes in a cluster. For further details, see Configuring an Ethernet connection with a dynamic IP address by using nmstatectl with a device path and Configuring an Ethernet connection with a static IP address by using nmstatectl with a device path.

Bond configurations in Nmstate support optimization settings

With this enhancement, the Nmstate API supports the following bond options:

nmtui now supports configuring the loopback interface

NetworkManager already supports configuring the loopback interface by using the nmcli utility. This enhancement adds the same functionality to the nmtui application. As a result, you can configure IP addresses and routes on the loopback interface.

The NetworkManager-libreswan plugin supports using the Libreswan default values

With this enhancement, you can set the no-nm-default property in Libreswan VPN connection profiles to true to use Libreswan’s instead of NetworkManager’s default values. This ensures the compatibility with configurations defined for native Libreswan. As a result, you can now, for example, configure subnet-to-subnet tunnels.

NetworkManager now supports fixed subnet IDs for downstream interfaces when using IPv6 prefix delegation

With this enhancement, you can now specify a fixed subnet ID for downstream interfaces in NetworkManager when you use IPv6 prefix delegation. In previous releases, when you rebooted the system, the subnet ID for these interfaces could change. With a fixed subnet ID, IPv6 addresses assigned to devices in the downstream network do not change when you reboot the RHEL host.

An NBFT parser was added to nm-initrd-generator

NVMe Boot Firmware Table (NBFT) is a standard method for firmware to pass network and storage configuration from the pre-boot environment directly to the operating system by using an ACPI table. The nm-initrd-generator utility now uses this parser to automatically detect and apply this configuration, and creates the necessary connections without manual setup. This implementation replaces the 95nvmf module in dracut and relies on systemd automation for a more streamlined and robust boot sequence.

Nmstate now supports configuring FEC settings for network interfaces

With this enhancement, you can now use Nmstate to apply Forward Error Correction (FEC) modes, such as RS-FEC, Base-R and Disabled to interfaces. These settings are crucial for improving data transmission reliability by detecting and correcting errors without retransmission. As a result, you can now use Nmstate to apply FEC settings instead of manually configuring them or using platform-specific tools.

Nmstate now supports the mtu and quickack route options

With this enhancement, you can use Nmstate to set the mtu and quickack route options. These settings are important for optimizing the network performance if the maximum transmission unit is different from the default and for tuning the TCP acknowledgment behavior. As a result, you now have more precise control over network traffic behavior.

The mlx5 driver now supports symmetric OR-XOR RSS hash

With this enhancement, the default transform (xfrm) for Receive Side Scaling (RSS) is now symmetric-or-xor.

ModemManager rebased to version 1.22

The ModemManager packages have been upgraded to upstream version 1.22. This version includes bug fixes and support for additional devices.

Nmstate now supports egress and ingress priority mapping for VLAN interfaces

NetworkManager already supports configuring traffic priority mapping for VLAN interfaces. With this enhancement, the Nmstate library can also handle both egress and ingress priority quality of service (QoS) mapping rules. As a result, you can use Nmstate to create VLANs and define bidirectional priority mapping, helping manage traffic more precisely and efficiently.

Nmstate now supports configuring routes by using a MAC address instead of an interface name

With Nmstate, you can create a network connection by assigning it to the MAC address of an interface. With this enhancement, you can use the profile name instead of the interface name in the next-hop-interface parameter in the routing configuration. With this feature, you can create static routes without knowing the interface name.

New network packet drop reasons and MIB counters

The kernel’s networking stack now provides more detailed reasons when it drops network packets. This enhancement also adds two new Management Information Base (MIB) counters: LINUX_MIB_PAWS_TW_REJECTED and LINUX_MIB_PAWS_OLD_ACK. As a result, debugging and diagnosing network problems, is now easier.

The fwctl subsystem has been added to the kernel

If the kernel lock-down feature is enabled, the kernel does not allow access to resource0 files in the /sys/ directory and PCI config spaces for security reasons. The fwctl kernel subsystem manages communication with the firmware in software-defined devices, such as the mlx5 network interface controller. This subsystem establishes a standardized and secure Remote Procedure Call (RPC) interface, that enables user-space applications to interact with device firmware for diagnostics, configuration, and updates. In addition to the new subsystem, the mstflint utility now also uses the fwctl subsystem, and the utility functions fully in these secure environments.

The ice driver now supports reducing the MSI-X vector usage for a PF to free vectors for associated VF

With this enhancement, you can now reduce the Message Signaled Interrupts eXtended (MSI-X) vectors allocated to a physical function (PF) to ensure that a sufficient number of vectors are available for associated virtual functions (VFs). For details, see Reducing the MSI-X vector usage for a physical function to free vectors for associated virtual functions.

iproute rebased to version 6.14.0

The iproute package has been updated to upstream version 6.14.0.

Kernel version in RHEL 9.7

Red Hat Enterprise Linux 9.7 is distributed with the kernel version 5.14.0-611.5.1.

Added support for virtio devices

Before this update, virtio devices inside of KVM guests were all listed as type generic-ccw. With this enhancement, you can easily identify which device type is connected at which device number by using the lszdev command:

kpatch-dnf plugin is updated with improved kernel management

Before this update, the ‎kpatch-dnf plugin did not align kernel upgrades with kpatch support. As a consequence, administrators might install or upgrade to kernels that were not supported by kpatch, thereby increasing the risk of running unsupported kernels and reducing system stability.

Arm SPE support extended to Neoverse-V2 and Cortex CPUs in the kernel

The Arm SPE feature support in kernel has been extended to include Neoverse-V2 and Cortex CPUs. As a result, users can now access Arm SPE capabilities for improved observability and analysis when running workloads on Neoverse-V2 and Cortex CPUs.

Intel Arrow Lake U RAPL energy events support in kernel

Before this update, the Intel Arrow Lake U microarchitecture did not support RAPL (Running Average Power Limit) energy performance counters in the kernel package. As a result, users could not monitor or measure energy consumption for Arrow Lake U systems using standard perf tooling.

Added support for core energy counters in ‎kernel

The kernel supports per-core energy measurement on AMD CPUs. The Power Management Unit (PMU) exposes the ‎power_core PMU and the ‎energy-core event so that you can monitor energy consumption for each CPU core. This enhancement aligns with AMD per‑core energy counter capabilities.

Perf support for Intel Clearwater Forest core counters

Before this update, you could not monitor hardware events on Intel Clearwater Forest CPUs by using perf core counters. With this update, the perf package recognizes the Clearwater Forest Performance Monitoring Unit (PMU). It provides named core events, including Topdown Level 1 metrics, such as front‑end bound, back‑end bound, retiring, and slots. Perf also uses architectural process event‑based sampling (PEBS) on this microarchitecture to provide low‑overhead sampling of selected events. As a result, you can collect core counter data and perform Top-down analyses on Clearwater Forest systems.

Adaptive PEBS enables counter snapshotting support in perf on Intel Panther Lake

Before this update, the Linux kernel’s perf tool relied on software-based sample reads to collect performance event data, which introduced minor timing gaps and additional overhead when reading counters after an event overflow. With this update, adaptive PEBS counter snapshotting is available on Intel Panther Lake CPUs. This hardware feature enables the kernel to capture programmable counters, fixed-function counters, and performance metrics directly in the PEBS record using the PEBS format version 6.

Intel Trace Hub supports Intel Panther Lake

This update adds Intel Trace Hub device IDs for the Panther Lake platforms (P, H, and U). The systems based on Panther Lake can use Intel Trace Hub features for debugging and tracing.

Perf uncore event support for Intel Clearwater Forest

Before this update, uncore event monitoring was not available for Intel Clearwater Forest microarchitecture. With this update, the perf package supports uncore event monitoring on Clearwater Forest systems. As a result, you can perform advanced performance analysis and debugging on supported hardware.

Intel Arrow Lake H microarchitecture support added to ‎⁠intel_th⁠

Before this update, Intel Trace Hub did not recognize Arrow Lake H NPK device IDs, which limited trace and debugging capabilities for systems that use this hardware. With this update, the ‎⁠intel_th⁠ package supports the Intel Arrow Lake H microarchitecture in Intel Trace Hub. As a result, you have enhanced tracing and debugging features on Arrow Lake H platforms.

PerfMon support enabled for Intel Arrow Lake H in kernel

With this update, the kernel package provides PerfMon support for Core, Uncore, Cstate, and MSR features on the Intel Arrow Lake H microarchitecture. As a result, you can monitor and analyze performance metrics specific to Arrow Lake H systems by using the perf tool.

Enhanced pstore functionality in virtual and cloud environments

The pstore kernel feature, which saves crash and panic information persistently, is now easier to use in virtualized environments and cloud platforms. With this release, you can enable the use of EFI variables for pstore without the efi_pstore.pstore_disable=0 kernel parameter while the system is running:

The default measurement module for rteval is now rtla timerlat for better tracing of problem latencies

With this enhancement, you should be able to easily identify the source of problem latencies. The desired cyclictest measurement module can be chosen using the rteval.config file.

KVM modules are integrated into the Realtime Kernel package

This update removes the generation of KVM module packages for the Realtime Kernel in RHEL, aligning with the decision to make the Realtime Kernel a deployment option for base RHEL. This change streamlines the deployment process, integrating KVM modules directly into the Realtime Kernel package and eliminating the separate kernel-rt-kvm package. As a result, users will experience a more seamless and efficient setup when deploying the Realtime Kernel on RHEL, improving the overall user experience.

kernel supports Shadow Stack (SHSTK) Ring 3 kernel

Before this update, the kernel package did not support Shadow Stack (SHSTK) in Ring 3 for x86_64 architectures. As a consequence, user-space applications could be vulnerable to control flow hijacking attacks.

python-drgn rebased to version 0.0.31

python-drgn has been rebased to version 0.0.31. This update introduces several enhancements and new features:

crash rebased to 9.0.0

The crash package, which provides a kernel analysis utility for live systems and various types of dump files, has been rebased to upstream version 9.0.0. This version provides a number of fixes and enhancements, most notably the following:

Support for per-core energy tracking (RAPL perf events) for AMD CPUs

With this enhancement, the addition of the core RAPL counter support is added. As a result, the AMD systems can measure the core-level power information in addition to the package-level power information.

Default configuration now disables jitter entropy source in rng-tools

The jitter entropy source is now disabled by default in rng-tools. Modern CPUs typically provide a hardware entropy source, and most virtual machines offer the /dev/hwrng device as an entropy source from the virtual host. In these environments, the jitter entropy source consumes unnecessary CPU cycles. For older hardware without a hardware entropy source, you can explicitly enable the jitter entropy source in /etc/sysconfig/rngd.

NVMf-FC kdump is now supported on the IBM Power

NVMf-FC kdump now supports the IBM Power system for running kexec-tools. This allows the capture of system memory dumps over a fiber channel network using the NVMe storage devices for high-speed and low-latency access to storage for crash dump data.

Secure boot on aarch64 enabled through Microsoft-signed shim

The ‎shim package for the 64-bit ARM architecture is signed by Microsoft to enable secure boot by default on platforms that trust the Microsoft UEFI CA. This aligns the ARM boot path with x86 and removes the need to add custom ‎PK, ‎KEK, or ‎db entries.

multipathd supports file-based sockets

With this update, the multipathd daemon listens for commands on a file-based socket /run/multipathd.socket in addition to the abstract namespace socket. You can communicate with the host’s multipathd daemon from within a container by using a bind mount for the new socket file.

Automatic RAID checks are enabled by default

With this update, the raid-check service is enabled by default. This ensures that raid-check.service runs automatically at scheduled intervals after the system boots, performing periodic RAID consistency checks without requiring manual intervention.

LVM RAID repairs volumes after multiple simultaneous device failures

With this enhancement, you can use the lvconvert --repair /dev/VG-name/LV-name command to reintegrate missing RAID devices back into a striped RAID (raid4, raid5, and raid6). This repair process works even when the number of temporarily missing devices exceeds the fault tolerance of the RAID level, allowing for recovery once the devices reappear. Note that you must unmount and deactivate the volume and the file system on top before repairing them.

New resource agent for managing etcd in Podman containers is available

Before this update, Red Hat High Availability did not provide a resource agent for managing etcd running in Podman containers.

The Filesystem resource agent supports the aznfs file system type

Before this update, to manage an Azure Network File System file share in a cluster, you had to configure the Filesystem resource agent with fstype=nfs. This method did not support Azure-specific features, such as Encryption in Transit.

Oracle Database 23ai is supported as a cluster resource

Before this update, the Oracle database resource agent was not tested for use with the Oracle Database 23ai release. Therefore, this version was not supported as a highly available resource within a Pacemaker cluster.

The fence_sbd agent can automatically detect the SBD device

Before this update, when configuring a fence_sbd resource, you were required to explicitly specify the SBD device path by using the devices parameter.

Watchdog device listing provides more detailed information

Before this update, when listing available watchdog devices, the output only displayed the device path, such as /dev/watchdog0. This made it difficult for administrators to distinguish between multiple devices on the same system.

pcs warns users before removing the last fencing device

Before this update, pcs allowed users to disable or remove the last fencing device from a cluster without a warning. This could inadvertently leave the cluster in an unsupported state without any STONITH or SBD fencing configured.

The pcs node attribute and pcs node utilization commands now support multiple output formats

Previously, the pcs node attribute and pcs node utilization commands displayed their output only in a human-readable plain text format. This format was not suitable for machine parsing or for easily replicating the configuration.

The pcs alert config command now supports multiple output formats

Previously, the pcs alert config command displayed its output only in a human-readable plain text format. This format was not suitable for machine parsing or for easily replicating the configuration.

pcs automatically validates the CIB for potential issues

Previously, the pcs utility did not automatically run advanced validation checks on the Cluster Information Base (CIB). As a consequence, certain cluster misconfigurations could remain undetected during routine operations.

pcs provides more detailed error messages for failed CIB updates

Previously, when a CIB update failed when using the pcs cluster edit or pcs cluster cib-push commands, the error message provided by Pacemaker was generic. It did not explain the specific reason for the failure, which made troubleshooting the invalid configuration difficult.

A new pcs command is available for renaming a cluster

Previously, it was not possible to change the name of an existing cluster using pcs commands. Administrators had to perform a series of manual steps, which were complex and could lead to errors.

New fence agent for Nutanix AHV virtualization is now available

Previously, Red Hat High Availability Add-On did not provide a dedicated fence agent for Nutanix Acropolis Hypervisor (AHV) environments.

The pcs resource meta command is improved to support bundles and prevent guest node misconfiguration

Previously, the pcs resource meta command did not support managing meta attributes for bundle resources. Additionally, the command did not prevent users from incorrectly modifying the connection parameters of a guest node, which could lead to a misconfigured resource.

The IPaddr2 resource agent now detects network link failures

Before this update, the IPaddr2 resource agent did not monitor the link state of the network interface. As a consequence, an IPaddr2 resource continued to report success on a node even if the underlying interface was in a DOWN or LOWERLAYERDOWN state, preventing the cluster from recovering the resource on another node.

The fence_aws agent supports immediate power-off

Previously, when the fence_aws agent performed an off or reboot action, it triggered a graceful shutdown of the instance. This introduced a delay in the fencing process, as the node was not powered off immediately.

The PostGIS extension is available for PostgreSQL 16

This enhancement adds the PostGIS extension to PostgreSQL 16. With this extension, PostgreSQL supports geographic objects, enabling spatial queries and analysis for Geographic Information System (GIS) applications, such as mapping, geolocation, and distance calculations within a relational database.

glibc now supports ‎sched_setattr and ‎sched_getattr for advanced scheduler options

Previously, ‎glibc provided access to only a limited set of Linux scheduler options through functions defined in ‎<sched.h>. This limitation required applications to use direct system calls or Linux kernel headers to access advanced scheduling features.

glibc pthread_gettid_np function added to libc_nonshared.a

Previously, there was no direct method to obtain the Linux task or thread ID (TID) from a glibc ‎pthread_t handle. The newly implemented ‎pthread_gettid_np function, declared in ‎<pthread.h> when ‎_GNU_SOURCE is defined, now allows applications that require TID, such as those using ‎sched_setattr, to retrieve the TID value directly from a ‎pthread_t handle.

glibc fortification support added for inet_ntop and inet_pton

Previously, the ‎glibc APIs ‎inet_ntop and ‎inet_pton did not include Source Fortification support, so the compiler was unable to catch some buffer errors before running the program.

GDB now supports IBM’s z17 CPU architecture

The ‎gdb package is enhanced to support binaries that use new hardware instructions introduced with IBM’s z17 CPU architecture. This update enables developers and system administrators to debug applications compiled for the latest IBM Z hardware on RHEL 9.7.

GCC Toolset 15 is now available

With this update, ‎gcc-toolset-15 is now available in RHEL 9.7. The toolset includes the latest supported versions of GCC and related utilities, enabling developers to build, test, and deploy applications using up-to-date compiler technology.

ELFv2 ABI support for ‎-fpatchable-function-entry on ppc64le

Previously, the ‎-fpatchable-function-entry option in ‎gcc did not support the ELFv2 ABI on the ppc64le architecture, which caused NOP instructions to be generated in incorrect locations for that ABI. This issue prevented the correct use of the option when targeting ELFv2.

llvm-toolset rebased to LLVM 20

The ‎llvm-toolset is updated to LLVM 20, delivering improved code generation, performance optimizations, and expanded language front‑end and library support across C, C++, and Rust workflows. This rebase aligns dependent components in RHEL, including rebuilds for ‎rust, ‎annobin, ‎bcc, ‎bpftrace, ‎qt5-qttools, and ‎mesa. The build is validated with ‎llvm-20.1.8-3.el9.

Improved _r_debug extension support for debugging applications with multiple dynamic linker namespaces

The ‎glibc package now includes the backported the _r_debug extension to support multiple namespaces. Previously, when attaching to running processes or analyzing core dumps, debuggers such as GDB could not display all loaded shared objects if the application used multiple namespaces with ‎dlmopen or audit modules.

Improved Exception Handling Performance in ‎glibc

Before this update, exception handling in large applications was slow, impacting performance, particularly in environments with a high volume of users or frequent exceptions. This was due to the time spent in the __dl_iterate_phdr function, called from _Unwind_Find_FDE.

Hardening of glibc qsort behavior on memory allocation failure

When a memory allocation fails, the qsort and‎ qsort_r functions of the glibc package use a heapsort fallback. This change improves handling of invalid comparison functions and makes performance more predictable if a memory allocation fails.

gdb is rebased to version 16.3

This update of gdb to version 16.3 in RHEL 9.7 provides the following notable enhancements:

AMD GPU pmda is now enabled for global GPU data collection

Before this update, the AMD GPU PMDA (a Performance Co-Pilot metrics agent) was not available in RHEL because the kernel lacked certain features required for full support.

Initial support for IBM Z z17 added to ‎glibc

The dynamic loader in ‎glibc is enhanced to support detecting IBM z17 CPUs or their specific features. As a result, any IBM z17-optimized libraries installed in the ‎/usr/lib64/glibc-hwcap/z17/ directory are loaded automatically on z17 systems. This update improves hardware compatibility and performance for IBM Z z17 platforms.

Rust Toolset rebased to version 1.88.0

RHEL 9.7 is distributed with Rust Toolset in version 1.88.0. This update includes the following notable enhancements:

tzdata includes the NEWS file

With this update, the tzdata package includes its NEWS file with each release to provide precise descriptions of timezone data changes. As a result, you can review the changes in detail. Users can review the included NEWS file to understand what changed in the update.

Metrics role now supports Apache Spark metric collection and export

Previously, users could not directly collect or export Apache Spark metrics using the metrics role. With this update, the ‎rhel-system-roles package adds support to gather and update metrics from Apache Spark. Two new boolean parameters are introduced:

ipa-healthcheck now warns about expiring certificates

With this update, the ipa-healthcheck tool now evaluates user-provided HTTP, DS, and PKINIT certificates for expiration and provides warnings 28 days prior to their expiration date. This is to prevent certificate expirations going potentially unnoticed, which can lead to downtime.

ansible-freeipa rebased to 1.15.1

The ansible-freeipa package, which provides modules and roles to manage Red Hat Identity Management (IdM) environments, has been rebased from version 1.13.2 to 1.15.1. The update includes the following enhancement:

IdM now supports UIDs up to Linux maximum UID limit for legacy systems compatibility

With this update, you can now use User and Group IDs up to 4,294,967,293, or 2^32-1. This aligns IdM’s maximum with the Linux UID limit and can be useful in rare cases where the standard IdM range, up to 2,147,483,647, is insufficient. Specifically, it enables IdM deployment alongside legacy systems that require the full 32-bit POSIX ID space.

Healthcheck warns if krbLastSuccessfulAuth is enabled

Enabling the krbLastSuccessfulAuth setting in the ipaConfigString attribute can lead to performance issues if large numbers of users are authenticating at the same time. Therefore, it is disabled by default. With this update, Healthcheck displays a message if krbLastSuccessfulAuth is enabled, warning about the possible performance problems.

IdM-to-IdM migration now available

IdM-to-IdM migration, previously available as a Technology Preview, is now fully supported with this release. You can use the ipa-migrate command to migrate all IdM-specific data, such as SUDO rules, HBAC, DNA ranges, hosts, services, and more, from one IdM server to another. This can be useful, for example, when moving IdM from a development or staging environment into a production one.

samba rebased to version 4.22.4

The samba package has been updated to upstream version 4.22.4. This version provides bug fixes and enhancements, most notably the following:

389-ds-base rebased to version 2.7.0

The 389-ds-base package has been updated to version 2.7.0.

dsctl healthcheck now warns about creating a substring index on the membership attribute

An entry that contains a membership attribute is usually a group with many members. When changing the value set, substring index is very expensive even for a minor change like deleting a single member. Now, when you add the substring index type, dsctl healthcheck warns about possible high cost of substring index on membership attributes and displays the following error message:

Custom matching rules in the Attribute Uniqueness plug-in to search uniqueness attributes

With this update, in Attribute Uniqueness plug-in configuration, you can specify a matching rule for the attribute you want to enforce uniqueness on. For example, when you want to override the attribute’s syntax from case exact or case ignore.

cockpit-session-recording rebased to 20-1.el9

The cockpit-session-recording package, which records user sessions that are conducted through the Cockpit web interface, is rebased to upstream version 20-1.el9. The package has been migrated to PatternFly 6 user interface system design.

ACME server adds support for the ES256 signature algorithm

Previously, the Automatic Certificate Management Environment (ACME) server did not support the ES256 signature algorithm for JSON Web Key (JWK) validation. This lack of support prevented certain clients, such as the Caddy web server, from successfully obtaining certificates.

HSM is now fully supported in IdM

Hardware Security Modules (HSM) are now fully supported in Identity Management (IdM). You can store your key pairs and certificates for your IdM Cerificate Authority (CA) and Key Recovery Authority (KRA) on an HSM. This adds physical security to the private key material.

OpenGL and Vulkan are supported by default in Toolbox containers based on UBI

OpenGL and Vulkan now work by default inside Toolbox containers created from updated UBI-based toolbox images, matching the behavior on RHEL Workstation hosts. This includes only the free software drivers provided by Mesa, not proprietary ones like NVIDIA.

Low Disk Space notifications include a mount point in the web console

The Low Disk Space notifications include the mount point when multiple volumes have the same name. This enhancement reduces ambiguity about which specific file system requires more space.

cockpit rebased to version 344

The cockpit packages have been rebased to version 344, which provides many improvements and fixes compared to version 334 in RHEL 9.6, most notably:

new subpackage: cockpit-ws-selinux

The SELinux policy for the cockpit_ws processes is provided in a separate subpackage cockpit-ws-selinux. This prevents the RHEL web console from failing when run on a system without SELinux installed, because the package manager installs the selinux_policy packages as dependencies. See the cockpit_ws_selinux(8) man page on your system for more information.

The ad_integration RHEL system role can control the SSSD domain section naming and consolidate duplicates

With this update, users can control the name of the section used in the SSSD config file for the domain or realm-specific settings, as managed by the ad_dyndns_update and ad_integration_sssd_custom_settings parameters. By default, the ad_integration role uses the lower case of the ad_integration_realm variable. However if users want to use the actual case of ad_integration_realm, users can use a new option ad_integration_sssd_realm_preserve_case = true to preserve the case of the realm. This may leave the SSSD config file with multiple sections for the realm. Use the new ad_integration_sssd_remove_duplicate_sections setting to consolidate all of the settings from the multiple sections into the chosen section. As a result, the ad_integration system role can manage domain and realm sections in the SSSD config file correctly.

The journald RHEL system role can monitor disk space

With this update, you can configure the SystemKeepFree option in the journald.conf journal service to set a maximum size for the system journal. This improves overall system stability and performance. As a result, you can use the journald_system_keep_free variable to configure size limit. The value is specified in megabytes. There is no default value - by default, it will use the journald default value.

metrics role supports enabling additional PCP domains

With this update, the rhel-system-roles package introduces the metrics_optional_domains variable in the metrics RHEL system role. Users can specify a list of additional PCP domains to be activated, in addition to those that are automatically managed by the metrics role. As a result, users can enable the domains they require for their specific use cases, improving flexibility in data collection and monitoring.

Introduced a variable MaxRetention to configure the maximum retention parameter for journald

With this update, users can configure the maximum retention parameter for journald, enabling time-based deletion of journal files. This enhancement provides flexibility in managing log data according to specific data retention policies, allowing both time-based log deletion and size-based deletion. It helps with compliance with data retention requirements and improves overall system performance by preventing excessive log storage.

The podman role generates all TOML compliant configuration file

Before this update, the current Jinja-based formatter did not support many TOML features, including tables and inline tables, which were required to configure all aspects of podman. With this enhancement, all features of TOML are supported by using a true TOML formatter instead of a simple Jinja template. As a result, the podman role can generate any TOML compliant configuration file that podman can use.

The firewall RHEL system role now supports including other services

With this enhancement, you can include other services when you use the firewall RHEL system role to create firewalld service definitions. For example, you can create a service webserver that includes the http and https services. If you then enable the webserver service, firewalld open the ports defined in http and https services. For further details, see Creating a custom firewalld service by using the firewall RHEL system role.

Ability to configure the default kernel in rhel-system-roles

Previously, users could not specify which kernel should be set as the default during system boot. This limitation prevented administrators from easily managing the default kernel selection during automation.

Metrics role now supports Apache Spark metric collection and export

Previously, users could not directly collect or export Apache Spark metrics using the metrics role. With this update, the ‎rhel-system-roles package adds support to gather and export metrics from Apache Spark. Two new boolean parameters are introduced:

Enables IPv4-only operation for the chronyd service when using the rhel-system-roles.timesync role

With this update, users can customize the chronyd configuration when IPv6 is disabled on a node. The enhancement provides two options: add a setting to the timesync role to disable IPv6, or pass a parameter to set the OPTIONS value for chronyd. These options enable IPv4-only operation for the chronyd service when using the rhel-system-roles.timesync role. This improves time synchronization accuracy and stability for environments where IPv6 is disabled.

virtio-mem is available on IBM Z

With this update, virtio-mem, a paravirtualized memory device, can be used on IBM Z hardware. By using virtio-mem, you can dynamically add or remove host memory in virtual machines.

New command for IBM Z hosts: virsh hypervisor-cpu-models

This update introduces the virsh hypervisor-cpu-models command. You can use this command on the IBM Z architecture to display which CPU models your hypervisor recognizes.

Performance-enhanced PCI translation for IBM Z guests

With this update, virtual machines (VMs) on IBM Z hosts can use identity-mapped direct memory access (DMA) for PCI devices. This feature significantly improves the performance of PCI device passthrough. Note that to use the feature, your system must be configured as follows:

New features for virtual machines on 64-bit ARM hosts

The following features are now supported for virtual machines on RHEL hosts that use the 64-bit ARM architecture(aarch64):

OTel collector on RHEL supports TPM device

The OpenTelemetry (OTel) Collector on RHEL supports the Trusted Platform Module (TPM) device. With this feature, OTel Collector can read transport layer security (TLS) certificates from the TPM device.

Enhanced automatic registration for eligible RHEL images

With this update, RHEL instances based on eligible images from eligible marketplaces automatically receive content and updates from Red Hat content delivery network (CDN) instead of the Red Hat Update Infrastructure (RHUI). The RHUI repositories are turned off by default.

New package: azure-vm-utils

This update adds the azure-vm-utils package, which provides a collection of utilities and udev rules to optimize the experience of using RHEL 9 as a guest operating system on Microsoft Azure.

RHEL is available on Azure confidential VMs

You can create and run RHEL confidential virtual machines (CVMs) on Microsoft Azure by using RHEL CVM images. The images support full disk encryption through the Confidential OS disk encryption feature in Azure.

Enhanced automatic registration for eligible RHEL images

When purchasing certain eligible cloud marketplace subscriptions for RHEL 9.6 or later and for RHEL 10.0 or later, an improved version of the auto-registration function is available.

sos now collects the Satellite metrics file for improved support diagnostics

The foreman-installer plugin of sos now collects the satellite_metrics.yml file located at /var/lib/foreman-maintain/ directory. It provides insight into which features of Satellite are in use and in what scale.

A new rhel9/valkey-8 container image is generally available in RHEL

The newly available rhel9/valkey-8 container image allows atomic operations and supports various data types like strings, hashes, lists, sets, and sorted sets. The image offers high performance because of its in-memory dataset, which can be persisted to disk or by appending commands to a log.

Improved support for reproducible container builds

Reproducible builds ensure that a given set of inputs consistently generates the same output. This enhancement addresses several factors that previously complicated reproducibility in container image builds. While using -source-date-epoch and -rewrite-timestamp improves the reproducibility of builds and better aligns with common practices like setting and looking for $SOURCE_DATE_EPOCH, it cannot guarantee complete reproducibility.

New artifact endpoints for Podman RESTFUL API

Podman RESTFUL API includes new artifact endpoints, enabling programmatic management of OCI artifacts. This enhancement simplifies integration of OCI artifact operations into existing systems and scripts.

The Container Tools packages have been updated

The updated Container Tools RPM meta-package, which contains the Podman, Buildah, Skopeo, crun, and runc tools, is available. The Buildah package has been updated to version v1.41.0, and Skopeo has been updated to version 1.20.0.

The ADD and COPY instructions now support the --link option

Buildah and Podman now support the --link flag for ADD and COPY instructions in Containerfiles, which causes the new content to be added as its own layer in the built image.

New container images are available

The new container images are listed in the Red Hat Ecosystem Catalog:

RHEL image mode supports creating root-level directories and symlinks at runtime

With this release, you can use RHEL image mode to create root-level directories and symbolic links after system deployment, then return the filesystem to read-only mode. As a result, you can use a single base image across multiple deployment environments with different file system requirements.

bootc-image-builder uses the local container storage by default

With this release, the bootc-image-builder tool operates in local mode by default, which means it no longer pulls container images from remote registries. To build disk images, you must pre-load the base bootc container image in the local container registry of the system before building disk images. If you have existing workflows that relied on automatic image pulling, you must update them. This change improves security by reducing external network dependencies during the build process.

The command-line assistant supports image mode for RHEL

With this enhancement, you can customize your Containerfile to include the command-line-assistant package, create a disk image from a container image, and boot a system with that image. As a result, the system image has the command-line assistant preinstalled, and you can use it after you register your system with subscription-manager.

The command-line assistant context limit increased to 32KB input

Before this update, the command-line assistant had a 2KB input context limit, causing it to fail when input exceeded this limit. As a consequence, user experience was limited, preventing thorough log analysis due to the 2KB input context limit. With this release, the command-line assistant input context limit has been increased from 2KB to 32KB. As a result, the command-line assistant now supports larger input contexts, enabling better log analysis and potential issue detection.

The command-line assistant for RHEL Lightspeed has better error handling and exit codes

With this enhancement, the command-line assistant brings better error handling and exit codes, such as:

Command-line assistant -w option displays current output

Before this update, when you tried to use the -w option without the current enable-capture mode, the command-line assistant incorrectly displayed output from an earlier session. With this update, the terminal capture log file is actively verified before outputting from the -w option. As a result, the mentioned problem is fixed, and the displayed output is accurate.