Red Hat has released the distribution of Red Hat Enterprise Linux 9.3 (the new branch was announced last week, but the release notes were only posted yesterday, while the website previously indicated a beta version). The update for the previous branch RHEL 8.9 is expected on November 15. Installation images are available for registered users of Red Hat Customer Portal (for evaluating functionality, ISO images of CentOS Stream 9 and free RHEL Developer Builds can also be used). The release was built for x86_64, s390x (IBM System z), ppc64le, and Aarch64 (ARM64) architectures.
The RHEL 9 branch develops with a more open development process and uses the package base of CentOS Stream 9 as its foundation. CentOS Stream is positioned as an upstream project for RHEL, allowing external participants to oversee package preparations for RHEL, propose changes, and influence decision-making. According to the 10-year support cycle for the RHEL distribution, RHEL 9 will be supported until 2032.
RHEL 9.3 is the first release whose source code for the RPM packages is not available in the public repository git.centos.org and is provided to clients only through a restricted section of the website, where a user agreement (EULA) prohibits data redistribution, making it impossible to use these packages to create derivative distributions. The source code remains available in the CentOS Stream repository, but it is not fully synchronized with RHEL, and the latest versions of packages do not always match those from RHEL. Rocky Linux, Oracle, and SUSE have joined forces and are now reproducing the source code of RPM packages from RHEL releases as part of the OpenELA project.
Key changes in RHEL 9.3:
- New versions of compilers and development tools have been included: GCC Toolset 13, LLVM Toolset 16.0.6, Rust Toolset 1.71.1, Go Toolset 1.20.10, GCC 11.4.1 (system compiler), Redis 7, Node.js 20, java-21-openjdk (java-17-openjdk, java-11-openjdk, and java-1.8.0-openjdk also continue to be supplied), Valgrind 3.21, SystemTap 4.9, elfutils 0.189, PCP 6.0.5, Grafana 9.2.10.
- Server and system packages have been updated: samba 4.18.6, iproute 6.2.0, Apache httpd 2.4.57 (+ added mod_authnz_fcgi module), SEtools 4.4.3, OpenSCAP 1.3.8, opencryptoki 3.21.0, NetworkManager 1.44, xdp-tools 1.4.0, perf 6.2, dmpd 1.0.2, nvme-cli 2.4, Pacemaker 2.1.6, 389-ds-base 2.3.4.
- The DNF package manager has added the "reboot" command for automatic rebooting after completing updates. The following modes are available: "never" (default) — no reboot, "when-changed" — reboot after any update (dnf upgrade), and "when-needed" — reboot only if the installed changes require it (e.g., after installing a kernel or systemd update). The "—poweroff" parameter is available for shutting down instead of rebooting.
- New plugins have been added to DNF: "dnf leaves" for displaying all installed packages that are not dependencies for other packages; "show-leaves" for showing recently installed similar packages or packages that have stopped being used as dependencies after a transaction.
- Implementations of the SCTP (Stream Control Transmission Protocol) and MPTCP (Multipath TCP) protocols have been transferred from the latest version of the Linux kernel.
- Full support for cameras with USB interfaces, wireless adapters (Wi-Fi), and Bluetooth has been implemented on the ARM64 platform.
- Complete support for Intel Arc A-Series (Alchemist or DG2) discrete graphics cards has been provided.
- The eBPF subsystem implementation has been synchronized with the Linux kernel 6.3.
- The Stratis toolkit for managing local storage has been added, providing capabilities such as dynamic storage space allocation, snapshots, integrity assurance, and layer creation for caching.
- Changes have been made in systemd-udevd to assign unchanging names to InfiniBand network interfaces.
- Postfix has implemented the ability to check DNS SRV records to determine the host and port of the mail server that will be used for message delivery. This feature can be utilized in infrastructures where services with dynamically assigned network port numbers are used for email delivery.
- The cups-filters package has added an LF-to-CRLF driver that can be used to convert characters "\n" (newline) to "\r\n" (carriage return and newline) for printers that support only handling files with end of line "\r\n".
- FUSE3 has added the capability to revoke a directory entry without automatically unmounting the mount points associated with that entry.
- NetworkManager now supports the "no-aaaa" option in resolv.conf, which disables the sending of DNS queries for AAAA records (IPv6 address resolution via host name). Support for the "lacp_active" option has been added to control the processing of LACPDU (Link Aggregation Control Protocol Data Units). NetworkManager will now restart after the dbus service is restarted. A notification will be displayed when using the old ifcfg configuration format for connection profiles. New properties supported include: link.tx-queue-length, link.gro-max-size, link.gso-max-segments, and link.gso-max-size.
- For the same network interface in NetworkManager, both static and dynamic (DHCP) settings are now allowed; for instance, the nmstate utility can set a static address for an interface that has DHCP support enabled. The nmstate utility allows binding settings to a network interface by its MAC address, instead of the interface name.
- Hardware support has been expanded. Support for CPU ARM64 NVIDIA Grace has been added. The Intel QAT driver supporting Intel Quick Assist Technology 401xx/402xx has been ported from the Linux kernel 6.2.
- To protect against Spectre v2 attacks related to speculative instruction execution, the AutoIBRS (Automatic Indirect Branch Restricted Speculation) mode has been added, supported by AMD CPUs starting from the EPYC 9004 Genoa family.
- Containers now have the option to use virtual chips for storing cryptographic keys (vTPM), implemented on top of a shared physical TPM (Trusted Platform Module).
- Support for vmcore logical partitions for kernel dumps created by the kdump subsystem has been added to LVM.
- The installation builds now include the parameter "inst.wait_for_disks", which specifies the waiting time for loading the kickstart file or driver readiness during startup.
- In the installer for ARM systems, the option to choose the installed kernel variant (e.g., with 64 KB memory pages) has been provided. The s390utils-base package has been removed from the minimal installation mode, leaving only s390utils-core.
- The RHEL image builder has been enhanced to generate files in OVA format for VMware vSphere.
- New options "—ipv4-dns-search" and "—ipv6-dns-search" have been added to the network command in kickstart files to specify basic domains for the "search" directive in /etc/resolv.conf, as well as options "—ipv4-ignore-auto-dns" and "—ipv6-ignore-auto-dns" to ignore receiving DNS settings via DHCP.
- Improved support for TLS EMS (Extended Master Secret, RFC 7627), required for compliance with FIPS-140-3 in TLS 1.2 connections.
- In OpenSSH, efforts have begun to phase out the use of SHA-1-based algorithms in favor of SHA-2. If SHA-1 keys are absent, sshd will now use only SHA-2 for host key confirmation, which may lead to incompatibility with RHEL 8 clients and earlier releases. server In OpenSSL, support has been added for configuring parameters of the secure elliptic curves Brainpool, along with protection against RSA decryption attacks based on timing measurements using Blachman’s method variants.
- In RPCSEC GSS Kerberos V5, support for encryption methods camellia128-cts-cmac, camellia256-cts-cmac, aes128-cts-hmac-sha256-128, and aes256-cts-hmac-sha384-192 has been added.
- Audit tools now support FANOTIFY events, and logging of fields fan_type (event type), fan_info (related information), sub_trust, and obj_trust (trust levels for event subject and object) has been implemented. The fapolicyd service now transmits rule numbers for denied calls to the fanotify API to simplify debugging issues.
- A system role for the keylime toolkit has been added, simplifying the configuration of the Keylime registrar and verifier used for authenticity verification and continuous integrity monitoring of external systems. For example, it allows authenticating Edge and IoT devices located in uncontrolled areas where unauthorized access may occur. The new release of keylime 7.3 has been utilized.
- A system role for managing systemd units and their installation has been added. A system role for the installation, configuration, management, and startup of the PostgreSQL DBMS has been added. The firewall system role now supports defining, modifying, and deleting ipsets.
- In SELinux, the option virt_qemu_ga_run_unconfined has been introduced, allowing the qemu-ga (QEMU Guest Agent) process to execute commands such as mount, originally restricted by SELinux, in an unconfined mode (unconfined_t domain). SELinux policies have been added to protect services qat, systemd-pstore, boothd, fdo-manufacturing-server, fdo-rendezvous-server, fdo-client-linuxapp, and fdo-owner-onboarding-server.
- Enhanced security measures have been implemented, improving the detection and response to potential threats across the specified services in SELinux.
- Support for 4th generation Intel Xeon Scalable processors (Sapphire Rapids) virtualization features has been added, enabling the use of CPU model Sapphire Rapids in virtual machines and leveraging the advanced virtualization capabilities available in these processors.
- Podman now supports containers compressed using the zstd algorithm. The ability to use Quadlets for automatic systemd service generation from container descriptions has also been added. A shell called podmansh is now available as an alternative to /usr/bin/bash for launching user sessions within containers. The versions of Podman, Buildah, Skopeo, crun, and runc have been updated.
- New kernel command-line parameters have been added:
- amd_pstate for managing AMD CPU power modes;
- arm64.nosve to disable SVE (Scalable Vector Extension);
- arm64.nosme to disable SME (Scalable Matrix Extension);
- gather_data_sampling for managing protection against GDS (Gather Data Sampling or Downfall) attacks;
- nospectre_bhb to disable Spectre-BHB protection;
- trace_clock to set the trace event timer.
- Enhanced capabilities for clusters and high-availability systems: The LVM-activate agent now supports failover for volume groups without physical partitions. The IPaddr2 and IPsrcaddr cluster resource agents have added support for policy routing. The ocf:heartbeat:Filesystem agent now supports the EFS (Amazon Elastic File System).
- New container images with FDO (FIDO Device Onboard) settings have been added: fdo-manufacturing-server, fdo-owner-onboarding-server, fdo-rendezvous-server, and fdo-serviceinfo-api-server. A new container image rhel9/squid with the Squid proxy server has also been added. In the 'RHEL for Edge' edition, support for new image types 'minimal-raw', 'edge-vsphere' (*.vmdk), and 'edge-ami' (*.ami) has been implemented.
- AMI images for AWS EC2 cloud environments now include support for booting in UEFI mode.
- For working with smart cards and CCID (Chip Card Interface Device) and ICCD (Integrated Circuit Card Device) USB tokens, a new release of the pcsc-lite-ccid driver 1.5.2 has been deployed, resolving issues with the Alcor Micro AU9560 controller and adding support for new smart card readers.
- The initial-setup and pmdk (Persistent Memory Development Kit) packages have been deprecated.
- Experimental support for PRP (Parallel Redundancy Protocol) and HSR (High-availability Seamless Redundancy) protocols has been added.
- Experimental hardware acceleration for IPsec through offloading packet encapsulation operations to the network card has been introduced.
- Experimental support for SRv6 (Segment Routing over IPv6) has been added.
- The experimental implementation of kTLS (TLS at the kernel level) has been synchronized with kernel 6.3. Support for using kTLS to accelerate GnuTLS has been added.
- Experimental support for the io_uring asynchronous I/O interface has been added, notable for its polling input/output support and ability to operate both with and without buffering. In the io_uring API, kernel developers aimed to eliminate the shortcomings of the old aio interface. In terms of performance, io_uring is very close to SPDK and significantly outperforms libaio when polling is enabled.
- In IdM (Identity Management), experimental support for the ACME (Automated Certificate Management Environment) certificate management protocol, used in the Let’s Encrypt certificate authority, has been added.
- In Podman, experimental support for a SQLite-based storage backend (instead of BoltDB) has been added.
- Continued provision of experimental (Technology Preview) support:
- VPN WireGuard,
- Intel SGX (Software Guard Extensions),
- Intel IDXD (Data Streaming Accelerator),
- DAX (Direct Access) for ext4 and XFS,
- AMD SEV and SEV-ES in the KVM hypervisor,
- systemd-resolved service,
- the Sigstore mechanism for container verification via digital signatures,
- package with the GIMP image editor 2.99.8,
- MPTCP (Multipath TCP) settings via NetworkManager,
- DNSSEC in IdM,
- virtio-mem,
- KVM hypervisor for ARM64,
- installation on NVMe over Fibre Channel,
- Socket API for TuneD,
- Soft-iWARP (Internet Wide-area RDMA Protocol),
- GNOME for ARM64 and IBM Z.
Source: opennet.ru
