The beta release of the AlmaLinux 9 distribution has been introduced, built using packages from the Red Hat Enterprise Linux 9 branch and containing all the changes proposed in this release. The builds are prepared for x86_64, ARM64, s390x, and ppc64le architectures in the form of bootable (780 MB), minimal (1.7 GB), and full images (8 GB). RHEL 9 and AlmaLinux 9 releases are expected in early May.
The distribution matches RHEL in functionality, with the exception of changes related to rebranding and the removal of RHEL-specific packages such as redhat-*, insights-client, and subscription-manager-migration*. AlmaLinux is free for all user categories, developed with community involvement, and uses a governance model similar to the Fedora project. The creators of AlmaLinux have attempted to achieve an optimal balance between corporate support and community interests — on one hand, resources and developers from CloudLinux, which has extensive experience in maintaining RHEL forks, are involved in development, while on the other hand, the project is transparent and accountable to the community.
The AlmaLinux distribution is based on CloudLinux, which, despite utilizing its resources and developers, has transferred the project to an independent non-profit organization, the AlmaLinux OS Foundation, for neutral development involving the community. A million dollars per year has been allocated for the project's development. All AlmaLinux developments are published under open licenses.
Key changes in AlmaLinux 9 and RHEL 9 compared to the RHEL 8 branch:
- The system environment and build tools have been updated. GCC 11 is used for building packages. The standard C library has been upgraded to glibc 2.34. The Linux kernel package is based on the 5.14 release. The RPM package manager has been updated to version 4.16, which includes integrity checking support through fapolicyd.
- The migration of the distribution to Python 3 has been completed. The default branch proposed is Python 3.9. Python 2 is no longer supplied.
- The desktop is based on GNOME 40 (RHEL 8 shipped with GNOME 3.28) and the GTK 4 library. In GNOME 40, virtual desktops in the Activities Overview are transitioned to a horizontal layout, displayed as a continuously scrollable chain from left to right. Each desktop shown in the overview clearly presents the open windows, which employ dynamic panning and scaling during user interaction. Seamless transitioning is provided between the application list and virtual desktops.
- GNOME utilizes the power-profiles-daemon handler, enabling on-the-fly switching between power-saving mode, balanced power consumption mode, and maximum performance mode.
- All audio streams have been transitioned to the PipeWire multimedia server, which is now used by default instead of PulseAudio and JACK. The use of PipeWire allows the typical desktop edition to offer capabilities for professional audio processing, eliminate fragmentation, and unify the audio infrastructure for various applications.
- By default, the GRUB boot menu is hidden if RHEL is the only distribution installed on the system and if the last boot was successful. To display the menu during boot, simply hold down the Shift key or press the Esc or F8 key multiple times. Changes in the bootloader also include the placement of GRUB configuration files for all architectures in one directory /boot/grub2/ (the file /boot/efi/EFI/redhat/grub.cfg is now a symbolic link to /boot/grub2/grub.cfg), meaning the same installed system can be booted using either EFI or BIOS.
- Components supporting various languages have been separated into langpacks, allowing for varying levels of installed language support. For example, the langpacks-core-font package offers only fonts, langpacks-core includes the locale for glibc, the basic font, and input methods, while langpacks provide translations, additional fonts, and spell-checking dictionaries.
- Components have been updated for security purposes. A new branch of the OpenSSL 3.0 cryptographic library has been implemented in the distribution. More modern and reliable cryptographic algorithms are enabled by default (for example, the use of SHA-1 in TLS, DTLS, SSH, IKEv2, and Kerberos is prohibited, and support for TLS 1.0, TLS 1.1, DTLS 1.0, RC4, Camellia, DSA, 3DES, and FFDHE-1024 has been disabled). The OpenSSH package has been updated to version 8.6p1. Cyrus SASL has switched to the GDBM backend instead of Berkeley DB. Support for the DBM (Berkeley DB) format has been discontinued in the NSS (Network Security Services) libraries. GnuTLS has been updated to version 3.7.2.
- SELinux performance has been significantly improved, and memory consumption has been reduced. Support for the configuration "SELINUX=disabled" to disable SELinux has been removed from /etc/selinux/config (this configuration now only disables the loading of policies, and to actually disable SELinux functionality, the kernel parameter "selinux=0" must now be passed).
- Experimental support has been added for VPN WireGuard.
- SSH login as the root user is disabled by default.
- The iptables-nft firewall management tools (the iptables, ip6tables, ebtables, and arptables utilities) and ipset have been deprecated. It is now recommended to use nftables for firewall management.
- A new mptcpd daemon has been included for configuring MPTCP (MultiPath TCP), an extension of TCP protocol for establishing TCP connections with packet delivery over multiple routes through different network interfaces bound to different IP addresses. Using mptcpd allows MPTCP configuration without the usage of the iproute2 utility.
- The network-scripts package has been removed; NetworkManager should be used for configuring network connections. Support for ifcfg configuration format has been retained, but NetworkManager now uses the keyfile-based format by default.
- New versions of compilers and developer tools are included: GCC 11.2, LLVM/Clang 12.0.1, Rust 1.54, Go 1.16.6, Node.js 16, OpenJDK 17, Perl 5.32, PHP 8.0, Python 3.9, Ruby 3.0, Git 2.31, Subversion 1.14, binutils 2.35, CMake 3.20.2, Maven 3.6, Ant 1.10.
- Server packages have been updated: Apache HTTP Server 2.4.48, nginx 1.20, Varnish Cache 6.5, Squid 5.1.
- Database management systems MariaDB 10.5, MySQL 8.0, PostgreSQL 13, Redis 6.2 have been updated.
- By default, Clang is used to build the QEMU emulator, which has allowed the KVM hypervisor to implement additional protection mechanisms, such as SafeStack to protect against return-oriented programming (ROP) exploitation methods.
- In SSSD (System Security Services Daemon), log detail has been enhanced; for instance, completion times are now attached to events, reflecting the authentication stream. Search functions have been added for analyzing configuration and performance issues.
- Support for IMA (Integrity Measurement Architecture) has been expanded to verify the integrity of operating system components through digital signatures and hashes.
- A unified cgroup (cgroup v2) hierarchy is enabled by default. Cgroups v2 can be used, for example, to limit memory, CPU, and I/O usage. The key difference between cgroups v2 and v1 is the implementation of a single cgroup hierarchy for all resource types, rather than separate hierarchies for CPU distribution, memory consumption, and I/O. The separate hierarchies led to difficulties in coordinating interactions between handlers and additional kernel resource overhead when applying rules for processes mentioned across different hierarchies.
- Support for precise time synchronization based on the NTS (Network Time Security) protocol has been added, which utilizes public key infrastructure (PKI) elements and allows for TLS and authenticated encryption AEAD (Authenticated Encryption with Associated Data) to cryptographically secure the interaction between the client and server using NTP (Network Time Protocol). The NTP server chrony has been updated to version 4.1.
- Experimental support has been provided for KTLS (kernel-level implementation of TLS), Intel SGX (Software Guard Extensions), DAX (Direct Access) for ext4 and XFS, and support for AMD SEV and SEV-ES in the KVM hypervisor.
Source: opennet.ru
