Chapter 7. Bug fixes

Before this release, Kickstart installations failed with an "unknown disk" error when the ignoredisk command appeared before iscsi or zfcp commands in the Kickstart file. This error occurred because the installer attempted to resolve device specifications in the ignoredisk command before the iscsi or zfcp commands completed the attachment of the specified devices. With this update, the installer correctly resolves device specifications for iSCSI and zFCP targets regardless of command order.

As a result, installations proceed successfully without a requirement for a specific command sequence.

Jira:RHEL-13837

Before this update, the SELinux policy omitted rules that permit FIDO Device Onboard (FDO) domains to communicate with SQL databases, SSSD services, Kerberos keytabs, and manage local storage paths. Consequently, the fdo-manufacturing-server.service, fdo-owner-onboarding-server.service, and fdo-rendezvous-server.service systemd services failed to start when configured to store credentials and ownership vouchers in PostgreSQL databases or SQLite files in the /var/lib/fdo/ directory.

With this update, the selinux-policy package adds the required access rules. As a result, the FDO services start successfully and connect to PostgreSQL and SQLite databases.

Jira:RHEL-28814^[1]

Before this update, the keylime-policy command failed to close file handles during the analysis of remote RPM repositories, which caused file descriptor leaks. Consequently, when you used the --remote-rpm-repo option to generate a runtime policy, keylime-policy failed with a Too many open files error.

With this update, the command properly closes file handles for all repository metadata and package files and does not exceed the system file descriptor limit. As a result, keylime-policy successfully generates runtime policies from remote RPM repositories.

Jira:RHEL-114482

Before this update, the mlock() and munlock() functions in OpenSC incorrectly assumed memory alignment, which was incompatible with the custom memory allocators used by Chromium-based browsers. As a result, Chromium-based browsers crashed when loading OpenSC. With this update, OpenSC uses the mmap() function to ensure proper memory alignment, which prevents these crashes.

Jira:RHEL-149712

Before this update, the ssh client ignored errors that occurred during default option initialization. Consequently, if you configured the mlkem768x25519-sha256 key exchange algorithm in FIPS mode, ssh ignored the setup error and established a connection with default key exchange algorithms instead. With this update, ssh fails when an error occurs during default option initialization.

As a result, connection attempts that specify mlkem768x25519-sha256 in FIPS mode fail as expected and the ssh client refuses the connection.

Jira:RHEL-155161

Before this update, the omelasticsearch module in rsyslog did not correctly parse IPv6 server addresses. As a consequence, rsyslog failed to connect to Elasticsearch servers by using IPv6. With this update, the module correctly parses these addresses. As a result, rsyslog can send logs to Elasticsearch servers by using IPv6.

Jira:RHEL-169492

Before this update, the rsyslog imfile module in inotify mode did not schedule cleanup checks after the file deletion delay elapsed. As a consequence, deleted monitored log files remained open, preventing disk space from being reclaimed until the rsyslog service was restarted or unrelated filesystem activity triggered cleanup. With this update, the imfile module schedules a cleanup check after the deletion delay in inotify mode. As a result, deleted monitored files are released promptly, and disk space is reclaimed.

Jira:RHEL-171897^[1]

Before this update, upgrading AIDE from version 0.16 to 0.19.2 introduced incompatible configuration and database formats. This caused existing installations to become unreadable and AIDE commands to fail. With this update, the aide-migrate-config utility automatically migrates the configuration and rebuilds the database during the upgrade. As a result, AIDE upgrades between minor RHEL releases are simplified, although complex custom configurations might require manual review of deprecated options.

Jira:RHEL-178317^[1]

Before this update, the keylime_verifier service started one worker process per CPU core, and each worker maintained its own database connection pool. Consequently, on systems with a large number of CPU cores, the total number of connections exceeded the database limit.

With this update, keylime_verifier limits the default number of worker processes, and you can configure the maximum value. As a result, keylime_verifier starts successfully without exceeding database connection limits.

Jira:RHEL-182042^[1]

Before this update, the tls.tlscfgcmd directive did not enforce TLS group restrictions for outgoing reliable event logging protocol (RELP) connections (omrelp instances) that used the OpenSSL backend. The client advertised the full default group list regardless of the configured restrictions. With this update, rsyslog applies the configured group restrictions when establishing outgoing RELP connections. Administrators can now restrict connections to only post-quantum cryptography (PQC) algorithms.

Jira:RHEL-192631^[1]

Before this update, the SSH daemon (sshd) could incorrectly refuse new connections even if the MaxStartups limit was not reached. With this update, sshd correctly tracks the number of unauthenticated connections when connections are closed. As a result, MaxStartups enforces connection limits as expected.

Jira:RHEL-216650^[1]

Before this update, when no input was provided to Authenticated Encryption with Associated Data (AEAD) encryption or decryption operations, the operations were treated as no-ops. As a consequence, AEAD encryption and decryption did not generate or verify tags for zero-length input. With this update, the tag is sent to the kernel even when no input is provided for AEAD algorithms. As a result, AEAD encryption and decryption generates and verifies tags even with zero-length input.

Jira:RHEL-225232^[1]

Before this update, running the dnf clean packages command concurrently with another DNF process could remove packages required by this process. As a consequence, the concurrent process could fail. With this update, a locking mechanism prevents dnf clean packages from running concurrently with other processes. As a result, concurrent DNF processes are serialized, ensuring both processes succeed.

Jira:RHEL-83124

Previously, when you executed the top command with the -u <user> parameter, where the user was different from the one running the command, all processes disappeared when the M key was pressed to sort the processes by memory. With this update, the top command displays at least one process when you sort the processes by memory.

Jira:RHEL-46760

Before this update, faulty cryptographic patches in vsftpd applied hardcoded values on multiple occasions. As a consequence, vsftpd did not fully comply with the system-wide cryptographic configuration. With this update, vsftpd in Red Hat Enterprise Linux (RHEL) 9 includes the correct cryptographic patches from RHEL 10. As a result, the following changes apply:

Jira:RHEL-182329

Before this update, the ice network driver did not properly handle power management transitions during suspend and hibernate operations on systems equipped with Intel E810 network interface cards (NICs). As a consequence, kernel tasks became blocked indefinitely, causing the system to become unresponsive when entering suspend or hibernate states.

With this update, the ice driver has been updated to correctly manage power state transitions for Intel E810 network interfaces during suspend and hibernate.

As a result, suspend and hibernate operations complete successfully on systems with Intel E810 NICs without hung tasks or system unresponsiveness.

Jira:RHEL-99101^[1]

Before this update, the Tuna utility terminated unexpectedly with an unhandled PermissionError ($EPERM$) when it encountered a process if it lacked permission to set CPU affinity. This issue occurred due to security modules, dropped capabilities, or namespace restrictions, commonly seen with process ID (PID) 1 (systemd) when running with restricted privileges. With this release, Tuna logs a warning for $EPERM$ errors and continues to process other PIDs. As a result, Tuna successfully completes CPU isolation even if permission restrictions prevent it from modifying certain processes.

Jira:RHEL-174229

Before this update, unsynced writes to memory-mapped files on GFS2 file systems caused data loss. Additionally, direct I/O writes and fiemap ioctls involving a buffer memory-mapped to the same file failed. With this update, GFS2 handles memory-mapped buffers correctly that prevents data loss and resolves the write failures.

Jira:RHEL-127164^[1]

Before this update, xfsrestore processed subtrees outside the requested directory tree during post-processing. This caused an assertion error and aborted the restore because a previous restore level had not created the parent directories. With this update, xfsrestore processes only the selected subtrees during post-processing. As a result, cumulative subtree restores complete successfully.

Jira:RHEL-179063^[1]

Before this update, the pcs utility sorted the list of resources within resource sets when displaying constraint configurations. As a consequence, the configuration output was displayed incorrectly, because resource sets have a strictly defined operational order in the Cluster Information Base (CIB).

With this update, pcs no longer alters the sorting of resources within sets when rendering constraint configurations.

As a result, the constraint configuration output accurately displays resources in their correct, CIB-defined order.

Jira:RHEL-176478^[1]

Due to changes in how Pacemaker handles the status section of an updated Cluster Information Base (CIB), the pcs stonith update-scsi-devices command restarted cluster resources unexpectedly when updating SCSI devices.

With this update, pcs stonith update-scsi-devices checks for the cibadmin --update-status option before executing. If the option is missing, pcs exits with an error without applying changes. If the option is present, pcs uses --update-status to update the devices cleanly.

As a result, updating SCSI devices on fence_scsi or fence_mpath STONITH devices no longer triggers unnecessary Pacemaker resource restarts.

Jira:RHEL-215405^[1]

Before this update, the glibc stub resolver treated a search path entry of "." in /etc/resolv.conf as an additional domain suffix. When querying a DNS domain, the resolver tried both the original domain name and the domain with "." appended to it. As a consequence, every search for a non-existent domain generated two identical queries instead of one, which doubled the load on DNS servers unnecessarily.

With this release, the glibc DNS stub resolver no longer appends "." to queries when the search path already contains it. As a result, queries for non-existent DNS domains are no longer duplicated, reducing DNS server load.

Jira:RHEL-153057^[1]

Before this update, Directory Server could use an obsolete entrydn index configuration retained after an upgrade even when entryrdn indexing was enabled. As a consequence, affected instances could return inconsistent search results or fail index tasks. With this update, Directory Server ignores obsolete entrydn indexes when entryrdn is enabled, and the Directory Server healthcheck tool reports leftover configurations and index files. As a result, searches use the active index configuration, and administrators can identify obsolete configuration that requires cleanup.

Jira:RHEL-88942^[1]

Before this update, 389-ds-base accepted values for the nsslapd-changelogmaxage attribute that lacked a time unit suffix (for example, 10 instead of 10d). As a consequence, the changelog expired incorrectly, causing replication to halt and preventing changes from propagating to peer replicas. With this update, the replication changelog trimming configuration correctly validates the time unit in nsslapd-changelogmaxage. As a result, replication continues to work correctly after configuring the changelog maximum age.

Jira:RHEL-165978

Before this update, the Directory Server Retro Changelog plugin unnecessarily cached distinguished names (DNs) for changelog entries. As a consequence, memory usage grew unexpectedly as the cache increased in size. With this update, the changelog backend no longer caches DNs. As a result, processing changes with the Retro Changelog plugin avoids this unnecessary memory growth.

Jira:RHEL-166004

Before this update, when deferred MemberOf updates were enabled on a Berkeley DB (BDB) backend, the Directory Server worker thread could stop before a Lightweight Directory Access Protocol (LDAP) modify operation queued its deferred task. As a consequence, the operation waited for a task that could no longer run, and server shutdown hung until the service timeout expired. With this update, Directory Server synchronizes deferred tasks with worker termination during shutdown. As a result, the server shuts down cleanly when deferred MemberOf updates are in progress.

Jira:RHEL-168908

Before this update, Directory Server built the suffix tree by matching a sub-suffix’s parent only to a configured suffix. As a consequence, the web console omitted sub-suffixes whose parent was a regular directory entry within another suffix. With this update, suffix-tree generation locates the closest ancestor suffix for these entries. As a result, the web console displays nested sub-suffixes in the suffix tree.

Jira:RHEL-168964^[1]

Before this update, Directory Server incorrectly extended index key prefixes while indexing attribute values in the Lightning Memory-Mapped Database (LMDB) backend. As a consequence, index keys could exceed the maximum key size, particularly for entries with many long indexed values, causing database initialization during import or replication to fail with an MDB_BAD_VALSIZE error. With this update, Directory Server corrects the index key handling. As a result, database initialization succeeds for affected data sets.

Jira:RHEL-168972^[1]

Before this update, when running net ads join --server=<domain_controller> in a FIPS-enabled Samba environment with multiple Active Directory (AD) domain controllers and AD replication lag, Samba wrote all domain controllers to the Kerberos configuration file instead of restricting it to the specified server. As a consequence, the kinit step during the join could contact a domain controller to which the new computer account had not yet replicated, failing with NT_STATUS_LOGON_FAILURE. Because FIPS mode does not allow NTLMSSP as an authentication fallback, there was no alternative authentication path. With this update, Samba restricts the Kerberos configuration to the domain controller specified by the --server option. As a result, net ads join --server succeeds reliably in FIPS environments with multiple domain controllers and AD replication lag.

Jira:RHEL-169666^[1]

Before this update, samba used the O_PATH flag for certain file access operations, which failed to trigger the kernel automount mechanism. As a consequence, when a Samba share contained automounted directories (such as ZFS snapshot directories that mount on access), Samba displayed them as empty instead of triggering the mount. With this update, the file access behavior has been corrected in the samba package. As a result, clients accessing automounted paths through a Samba share see the expected directory contents.

Jira:RHEL-169727^[1]

Before this update, Directory Server incorrectly normalized escaped spaces within distinguished name (DN) attribute values. As a consequence, a Lightweight Directory Access Protocol (LDAP) bind using a DN such as cn=Barbara\20Jensen,ou=People,dc=example,dc=com failed with an invalid credentials error even when the credentials were correct. With this update, Directory Server normalizes escaped interior spaces correctly. As a result, users can authenticate with DNs that contain escaped interior spaces.

Jira:RHEL-170270^[1]

Before this update, the Distributed Numeric Assignment (DNA) plug-in created shared configuration entries with port 0 when the server started in isolated mode, for example during an Identity Management upgrade. As a consequence, other servers could attempt to request numeric ID ranges from an unreachable server, causing connection errors and delays. With this update, the DNA plug-in skips creating and periodically updating shared configuration entries while the server is isolated. As a result, an isolated server does not advertise a new shared configuration entry with an unusable port for DNA range requests.

Jira:RHEL-170275^[1]

Before this update, the LMDB backend assumed that the Directory Server suffix entry was always assigned database entry number 1. On a newly created replica with an empty database, the Replication Update Vector (RUV) occupied entry number 1 instead, conflicting with this assumption. As a consequence, online reinitialization from such a replica caused the receiving server to terminate unexpectedly. With this update, when a replica is created on an empty database, the RUV is assigned entry number 2, reserving entry number 1 for the suffix entry. As a result, online reinitialization completes successfully.

Jira:RHEL-170477^[1]

Before this update, the Directory Server dsctl <instance_name> healthcheck command checked MemberOf plug-in indexes without accounting for the configured entry scope. As a consequence, the command reported DSMOLE0001 errors and recommended unnecessary indexes on backends outside the plug-in scope, such as the ipaca backend in Identity Management deployments. With this update, the check evaluates only backends within the MemberOf plug-in entry scope. As a result, administrators receive index recommendations for the backends to which the plug-in applies.

Jira:RHEL-170480^[1]

Before this update, the server always retrieved the passwordbadwords list from the global password policy, ignoring local policy settings. As a consequence, passwords containing locally forbidden words were accepted. With this update, the server reads the passwordbadwords attribute from the applicable local password policy. As a result, forbidden words configured in local password policies are enforced during password changes.

Jira:RHEL-170651^[1]

Before this update, Directory Server used a polling loop to wait for deferred MemberOf updates on Berkeley DB (BDB) backends. As a consequence, modifying or deleting large groups could exhaust worker threads and block other Lightweight Directory Access Protocol (LDAP) write operations and replication updates. With this update, Directory Server notifies waiting threads when deferred MemberOf updates finish, replacing the polling loop. As a result, large group changes no longer block LDAP writes and replication updates because of polling-related worker exhaustion.

Jira:RHEL-173699

Before this update, the configuration example in the sssd_krb5_localauth_plugin manual page omitted the disable = an2ln directive. This caused confusion about the configuration snippet SSSD automatically creates in Active Directory or IdM environments.

With this update, the sssd_krb5_localauth_plugin manual page example includes the disable = an2ln line. As a result, the documentation accurately reflects the Kerberos local authorization plugin configuration snippet generated by SSSD.

Jira:RHEL-173742

Before this update, when SSSD ran multiple child processes in parallel, a single child termination signal invoked signal handlers for all active child process contexts. Consequently, handlers for other active processes failed to find a status change and logged critical errors, which generated unnecessary backtraces in SSSD log files.

With this update, the log level for non-matching child signal handlers is reduced to a trace level. As a result, SSSD no longer logs false critical errors or backtraces when multiple child processes run concurrently.

Jira:RHEL-173743^[1]

The System Security Services Daemon (SSSD) detects and ignores foreign security principal (FSP) entries when resolving members of an Active Directory (AD) group. This prevents FSP entries from causing group lookups to fail. As a result, the getent group command returns the group and its resolvable members without requiring administrators to set ldap_ignore_unreadable_references = true.

Jira:RHEL-173744

Before this update, Directory Server handled an interrupted online reindex task by deleting the database files for the affected backend. As a consequence, stopping the server during online reindexing with the Lightning Memory-Mapped Database (LMDB) backend caused complete data loss. With this update, Directory Server preserves the database files when reindexing fails and logs a critical message about potentially incomplete indexes. As a result, directory entries remain intact after an interrupted online reindex.

After an interrupted reindex, rebuild the indexes offline before using the affected backend.

Jira:RHEL-183896^[1]

Before this update, the Directory Server supplier could spend an excessive amount of time preparing a sorted list of entries for online replication initialization. As a consequence, initialization could fail after the supplier sent only one entry. With this update, the supplier builds the entry list by traversing the directory tree in depth-first order, which removes the need to sort the entries. As a result, the supplier prepares the entry list without the delay caused by sorting.

Jira:RHEL-212097^[1]

Before this update, the ipa-migrate tool attempted to import replication conflict entries from the source Identity Management (IdM) deployment. As a consequence, migration failed with an invalid distinguished name (DN) syntax error when the source data contained such entries. With this update, ipa-migrate skips replication conflict entries during import. As a result, these entries do not interrupt migration.

Jira:RHEL-212443

Before this update, the ipa-migrate tool omitted Identity Management (IdM) locations when migrating data to another IdM deployment. As a consequence, administrators had to recreate locations manually, and Domain Name System (DNS) entries associated with those locations did not work correctly. With this update, ipa-migrate migrates IdM locations. As a result, location-based DNS works in the target deployment without any manual location recreation.

Jira:RHEL-212444

Before this update, Directory Server range searches on Berkeley DB (BDB) backends lacked retries for transient lock conflicts and could stop when a concurrent write removed the starting index key. As a consequence, searches on indexed attributes such as entryUSN could fail or return incorrect empty results, delaying client synchronization of updated entries. With this update, Directory Server retries transient lock conflicts and resumes range searches from the next available key when the starting key disappears. As a result, affected range searches recover from transient contention and no longer return incorrect empty results because of concurrent index key removal.

Jira:RHEL-216717^[1]

Before this update, replication total initialization with the Lightning Memory-Mapped Database (LMDB) backend synchronized the database to storage after every transaction. As a consequence, import throughput decreased as the database grew, especially on high-latency storage. With this update, the new nsslapd-mdb-online-import-nosync configuration parameter controls whether the online bulk import uses the MDB_NOSYNC flag to skip per-transaction synchronization. As a result, enabling the nsslapd-mdb-online-import-nosync parameter reduces synchronization overhead during replication total initialization.

The parameter is disabled by default. When enabled, the bulk import synchronizes the database before the instance returns online.

Jira:RHEL-216936^[1]

Before this update, the Directory Server MemberOf plug-in checked the configured entry scope without retrieving the updated entry when processing deferred group membership changes on Berkeley DB (BDB) backends. As a consequence, the plug-in skipped updates to memberOf attributes, causing clients to miss group memberships. With this update, the plug-in retrieves the updated entry before checking memberOfEntryScope. As a result, group membership changes correctly update the memberOf attributes of entries within the configured scope.

Jira:RHEL-221410^[1]

Before this update, the dsconf command-line utility for Directory Server ignored the --flow-control-window and --flow-control-pause options when creating a replication agreement. As a consequence, new agreements did not use the requested flow control settings. With this update, the dsconf repl-agmt create command applies both options when it creates an agreement. As a result, new replication agreements use the configured flow control settings.

Jira:RHEL-243050^[1]

Before this update, a logic error in SSSD invalidated an internal caching optimization during filter evaluation when user enumeration was enabled. As a consequence, evaluating the cache of enumerated users took a long time or timed out, causing operations such as getent passwd to experience significant delays or trigger the sssd_nss watchdog process.

With this release, SSSD corrects the conditional logic to properly restore the caching optimization during enumeration. As a result, user enumeration operations complete faster and no longer cause timeouts.

Jira:RHEL-143416^[1]

Before this update, selecting the Show password check box did not reveal the password for WPA3 Wi-Fi connections. As a consequence, WPA3 Wi-Fi passwords remained hidden. With this update, the Show password check box works correctly for WPA3 Wi-Fi connections. As a result, WPA3 Wi-Fi passwords are visible when you select the check box.

Jira:RHEL-4232

Before this update, the module underlying the kernel_settings role used an unordered dictionary on Red Hat Enterprise Linux 7, so the order in which settings were written could differ between role runs. As a consequence, the role reported a changed status even when no setting was actually changed, which broke idempotency.

With this update, the role sorts settings before writing them, so their order remains consistent across runs. As a result, the kernel_settings role reports changed only when a setting is genuinely changed.

Jira:RHEL-151853^[1]

Before this update, the role used an incorrect comparison parameter in its retry loop condition. If a device failed to respond during a read operation, the role terminated the loop prematurely and raised an exception instead of retrying. The loop condition is fixed, ensuring that the role completes all specified retry attempts and handles temporary device unresponsiveness reliably.

Jira:RHEL-157026^[1]

Before this release, the snapshot system role did not properly inspect the status of Logical Volume Manager (LVM) snapshots. As a consequence, you could not query snapshot status without performing an operation.

With this update, a new list command uses Ansible facts to expose structured metadata for LVM snapshots. As a result, you can inspect LVM snapshot status and metadata directly within the role.

Jira:RHEL-175664^[1]

Before this update, the ad_integration system role did not reboot managed hosts after changing the cryptographic policy when ad_integration_allow_rc4_crypto was set to true. As a consequence, joining an Active Directory (AD) domain sometimes failed because the new policy had not taken effect. With this update, the role automatically reboots managed hosts when required to apply the policy before joining the domain. As a result, domain joins use the correct cryptographic policy when RC4 support is enabled.

Jira:RHEL-177565^[1]

Before this update, the sudo system role parser did not properly handle the backslash line-continuation character in sudoers files. As a consequence, the system role treated the backslash as a command and skipped the commands on subsequent wrapped lines.

With this update, the parser unfolds multiline entries before evaluation. As a result, the sudo system role correctly processes all commands across multiline sudoers entries.

Jira:RHEL-178497^[1]

Before this update, the sudo system role handled spaces before user specification tags incorrectly during sudoers file generation. Consequently, configurations with the selinux_type and selinux_role parameters omitted the required space before the tag, which triggered an error when the sudo utility read the file. With this update, the sudo system role formats user specification tags with correct spaces.

Jira:RHEL-178506^[1]

Before this update, you could not customize the kernel command line with multiple duplicate options that had unique values. With this update, the kernel identifies and manages duplicate options with different values. As a result, you have increased flexibility when configuring the kernel command line.

Jira:RHEL-180604^[1]

Before this update, the bootloader_setting module unconditionally ran grubby commands in Ansible check mode. As a consequence, the GRUB configuration changed unexpectedly, which affected the boot process. With this release, the bootloader_setting module skips write operations in check mode. As a result, bootloader settings do not change in Ansible check mode.

Jira:RHEL-180861^[1]

Before this release, the storage system role always installed Stratis packages and started the Stratis daemon, even if you did not configure Stratis pools or volumes. This left unnecessary utilities and active background services running on the system, which compromised the default security posture.

With this update, the storage role manages Stratis packages and services only when Stratis resources are explicitly configured. Additionally, the documentation includes instructions for omitting Stratis packages from OSTree images when you do not use Stratis. As a result, systems managed by the storage system role no longer contain unconfigured background services.

Jira:RHEL-181990^[1]

Before this update, modified SELinux policy modules managed by the selinux system role were not reloaded. Consequently, if another policy referenced rules within the modified module, subsequent restorecon operations failed because the target policy was missing from memory. With this update, policy module changes automatically trigger a reload before restorecon executes. As a result, you can apply custom policy modules and dependent policies without encountering errors.

Jira:RHEL-182481^[1]

Before this update, the task in the firewall RHEL system role that applies the configuration did not check for empty items within the list of firewall configuration variables. As a consequence, the role executed this task during every run, even if there was no configuration to apply. This update corrects the logic so the task runs only if there is an actual configuration to apply.

Jira:RHEL-184523^[1]

Before this update, the nbde_server RHEL system role followed symbolic links when it set file ownership and permissions in the key directory. Consequently, an unprivileged local user could pre-stage symbolic links that pointed to sensitive files. When the system role ran as the root user, it changed the ownership of arbitrary files, which enabled local privilege escalation.

With this update, nbde_server checks for and skips symbolic links when it processes files in the key directory. As a result, the system role updates key files directly and prevents local privilege escalation.

Jira:RHEL-189402^[1]

Before this update, in-memory backend in the firewall RHEL system role used inconsistent keys for rich rules. As a consequence, the role did not correctly check if a given rich rule was already present in the configuration, and added the rich rule again. With this release, the rich-rule handling has been fixed and is idempotent. As a result, the firewall RHEL system role no longer adds multiple rich rules.

Jira:RHEL-189407^[1]

Before this update, the podman RHEL system role did not allow specifying multiple Kubernetes objects in the kube_file_content field within podman_kube_specs. As a consequence, you could not define multiple objects, such as Pod, Deployment, PersistentVolumeClaim, ConfigMap, Secret, or DaemonSet, in a single kube_file_content entry, even though the podman kube play command supported this functionality.

With this update, the podman RHEL system role accepts multiple Kubernetes objects in the kube_file_content field within podman_kube_specs. As a result, you can define multiple Kubernetes objects in a single kube_file_content entry, consistent with the capabilities of the podman kube play command.

Jira:RHEL-191866^[1]

Before this update, if you manually configured a bootloader timeout value other than 5, the bootloader role overwrote the custom configuration with the default value of the bootloader_timeout variable. As a consequence, the system did not preserve custom bootloader timeout settings. With this update, the role sets the default value of the bootloader_timeout variable to null. As a result, the role changes the bootloader timeout only when you explicitly specify a value for the bootloader_timeout variable in your playbook.

Jira:RHEL-211555^[1]

Before this update, the snapshot manager supported creating bootable LVM snapshots but did not provide a way to revert a system to a previous snapshot state through the boot menu. This limitation made disaster recovery after system upgrades or configuration changes difficult.

With this update, the snapshot manager supports revertable LVM snapshots with boot-time rollback capability. You can now create snapshot sets with the snapshot_lvm_revertable parameter to generate revert boot entries. To revert a system:

Jira:RHEL-212147^[1]

Before this update, the podman RHEL system role defaulted to running containers as root when podman_run_as_user was not set. As a consequence, if you wanted to run rootless containers under the Ansible connection user, you had to explicitly set podman_run_as_user every time you used the role.

With this update, the role provides a new podman_run_as_ansible_user variable. When set to true, the role uses ansible_user as the default run-as user instead of root. An explicit podman_run_as_user value still takes precedence.

As a result, you can run rootless Podman containers under the Ansible connection user by setting podman_run_as_ansible_user: true without configuring podman_run_as_user for each invocation.

Jira:RHEL-212672^[1]

Before this update, the podman RHEL system role only pruned images when Quadlet files were removed, by using the podman_prune_images option. There was no mechanism to prune unused images during regular container deployments.

As a consequence, if you continuously deployed containers, you had to remove older image versions in a separate job, which added complexity to your automation workflows.

With this update, the role provides a way to prune unused images on each run before pulling new images. This ensures that the previous image version is retained for rollback purposes while older unused versions are cleaned up automatically.

As a result, if you continuously deploy containers, you no longer need a separate job to manage old images. Unused images are pruned automatically during each role invocation, reducing disk usage while preserving the ability to roll back to the previous version.

Jira:RHEL-212677^[1]

With this enhancement, the certificate RHEL system role introduces the issuer variable to specify the issuing Certificate Authority (CA). You can use this variable to manage certificates issued by Red Hat Identity Management (IdM) sub-CAs.

Jira:RHEL-220560^[1]

In previous releases, the certificate RHEL system role always compared the key_size parameter against the key size of an existing certificate file, even key_size was not specified in the playbook. Consequently, playbooks that omitted this parameter caused the role to report changed: true on every execution. With this fix, the role does not use the key_size field during comparison if you do not specify the parameter in the playbook. As a result, the certificate RHEL system role is idempotent.

Jira:RHEL-220565^[1]

Previously, after manually modifying the default configuration of the virtio-win drivers of a Windows VM, the IP configuration of the network interface was lost. With this update, the IP handling in later virtio-win versions has been fixed, and the issue no longer occurs.

Jira:RHEL-171013

Before this update, the foreman_installer plugin in the sos utility did not obfuscate the --foreman-proxy-oauth-consumer-key and --foreman-proxy-oauth-consumer-secret command-line arguments in the Satellite Capsule server installer logs.

As a consequence, when you ran the sos report command on an external Satellite Capsule, the collected log files contained plain text OAuth credentials, which caused a credential leak in the generated archive.

With this update, the foreman_installer plugin has been updated to scrub Satellite OAuth consumer keys and secret arguments. As a result, the sos report command obfuscates Satellite OAuth credentials in the collected Capsule installer logs, preventing sensitive credentials from being exposed in diagnostic archives.

Jira:RHEL-282598^[1]

Before this update, the foreman and foreman_proxy plugins in the sos utility did not support foremanctl-managed environments where Foreman services run inside containers. As a consequence, when you ran the sos report command on systems with foremanctl deployments, sos did not collect diagnostic information and log files for Foreman and Foreman Proxy services.

With this update, the foreman and foreman_proxy plugins have been updated to support foremanctl container-based deployments. As a result, the sos report command collects comprehensive diagnostic data, configuration information, and logs from containerized Foreman environments managed by foremanctl.

Jira:RHEL-282626

Before this update, secret key was exposed due to lack of obfuscation in the /etc/pulp/settings.py configuration file and the output of 'dynaconf list' command. As a consequence, unobfuscated secret key leak occurred in customer data.

With this update, these keys are obfuscated, resulting in improved security, preventing potential customer credential leaks.

Jira:RHEL-299700

Before this update, Quadlet .volume definitions did not support the UID and GID options when creating persistent volumes. As a consequence, mounting a NFS share by using a Quadlet .volume failed with a permission denied error.

With this update, Quadlet .volume definitions support setting the UID and GID options during volume creation. As a result, Podman correctly stores and recognizes the volume options, and NFS Quadlet volumes mount successfully.

Jira:RHEL-145863^[1]

Before this update, because of incorrect handling of mount metadata in Podman, permissions from another mount were applied incorrectly. As a consequence, specifying a read-write bind mount by using the podman run --mount option occasionally defaulted to read-only permissions.

With this update, Podman correctly handles mount metadata. As a result, bind mounts retain their intended read-write permissions.

Jira:RHEL-154348^[1]

Before this update, removing a container in Podman left behind orphaned storage layer directories and files. These orphaned files continued consuming disk space. The podman system prune -a command could not fully reclaim the storage, which required a complete podman system reset.

With this update, Podman correctly cleans up layer files and directories during container removal. As a result, removing containers reclaims disk space, and podman system prune -a clears unused storage as intended.

Jira:RHEL-173976^[1]