Chapter 39. Red Hat Enterprise Linux Atomic Host 7.2.5

ostree admin unlock command now available

Red Hat Enterprise Linux Atomic Host 7.2.5 introduces the new command ostree admin unlock. It allows users to unlock the current ostree deployment and install packages temporarily. This is done by mounting a writable overlayfs on /usr. When a user reboots, the overlayfs is unmounted and the packages are no longer installed. Use the ostree admin unlock --hotfix option for the changes, such as package installs to persist across reboots. This command provides the same capabilities as atomic-pkglayer, which is now deprecated. There are known issues with overlayfs and SELinux, so this functionality is not intended for long term use.

Strict browser security policy for Cockpit is now enforced

This defines what code can be run in a Cockpit session and mitigates a number of browser-based attacks.