Red Hat has released the first beta version of the Red Hat Enterprise Linux 9 distribution. The installation images are prepared for registered users of the Red Hat Customer Portal (for functionality assessment, ISO images of CentOS Stream 9 can also be used). Package repositories are available without restrictions for the x86_64, s390x (IBM System z), ppc64le, and Aarch64 (ARM64) architectures. The source texts of the RPM packages for Red Hat Enterprise Linux 9 are hosted in the CentOS Git repository. The release is expected in the first half of next year. According to the 10-year support cycle for the distribution, RHEL 9 will be supported until 2032. Updates for RHEL 7 will continue to be released until June 30, 2024, and RHEL 8 until May 31, 2029.
Red Hat Enterprise Linux 9 is notable for its transition to a more open development process. Unlike previous branches, the distribution is based on the CentOS Stream 9 package base. CentOS Stream is positioned as an upstream project for RHEL, allowing third-party participants to monitor the preparation of packages for RHEL, propose changes, and influence decision-making. Previously, a snapshot of one of the Fedora releases was used as the basis for a new RHEL branch, which was developed and stabilized behind closed doors, without the opportunity to monitor the development process or decision-making. Now, based on a snapshot of Fedora, a branch of CentOS Stream is formed with community involvement, where preparatory work is conducted and the foundation for a new significant RHEL branch is established.
Key changes:
- The system environment and build tools have been updated. GCC 11 is used for building packages. The standard C library has been upgraded to glibc 2.34. The Linux kernel package is based on the 5.14 release. The RPM package manager has been updated to version 4.16, which includes integrity checking support through fapolicyd.
- The migration of the distribution to Python 3 has been completed. The default branch proposed is Python 3.9. Python 2 is no longer supplied.
- The desktop is based on GNOME 40 (RHEL 8 shipped with GNOME 3.28) and the GTK 4 library. In GNOME 40, virtual desktops in the Activities Overview are transitioned to a horizontal layout, displayed as a continuously scrollable chain from left to right. Each desktop shown in the overview clearly presents the open windows, which employ dynamic panning and scaling during user interaction. Seamless transitioning is provided between the application list and virtual desktops.
- GNOME utilizes the power-profiles-daemon handler, enabling on-the-fly switching between power-saving mode, balanced power consumption mode, and maximum performance mode.
- All audio streams have been transitioned to the PipeWire multimedia server, which is now used by default instead of PulseAudio and JACK. The use of PipeWire allows the typical desktop edition to offer capabilities for professional audio processing, eliminate fragmentation, and unify the audio infrastructure for various applications.
- By default, the GRUB boot menu is hidden if RHEL is the only distribution installed on the system and if the last boot was successful. To display the menu during boot, simply hold down the Shift key or press the Esc or F8 key several times. Among the changes in the boot loader, the configuration files for GRUB are now located in a single directory /boot/grub2/ (the file /boot/efi/EFI/redhat/grub.cfg is now a symbolic link to /boot/grub2/grub.cfg), meaning the same installed system can be booted using either EFI or BIOS.
- Components supporting various languages have been separated into langpacks, allowing for varying levels of installed language support. For example, the langpacks-core-font package offers only fonts, langpacks-core includes the locale for glibc, the basic font, and input methods, while langpacks provide translations, additional fonts, and spell-checking dictionaries.
- To allow for the simultaneous installation of different versions of software and more frequent update creation, Application Streams components are used, which can now be created using all supported package distribution options in RHEL, including RPM packages, modules (grouped into sets of RPM packages), SCL (Software Collection), and Flatpak.
- Components have been updated for security purposes. A new branch of the OpenSSL 3.0 cryptographic library has been implemented in the distribution. More modern and reliable cryptographic algorithms are enabled by default (for example, the use of SHA-1 in TLS, DTLS, SSH, IKEv2, and Kerberos is prohibited, and support for TLS 1.0, TLS 1.1, DTLS 1.0, RC4, Camellia, DSA, 3DES, and FFDHE-1024 has been disabled). The OpenSSH package has been updated to version 8.6p1. Cyrus SASL has switched to the GDBM backend instead of Berkeley DB. Support for the DBM (Berkeley DB) format has been discontinued in the NSS (Network Security Services) libraries. GnuTLS has been updated to version 3.7.2.
- SELinux performance has been significantly improved, and memory consumption has been reduced. Support for the configuration "SELINUX=disabled" to disable SELinux has been removed from /etc/selinux/config (this configuration now only disables the loading of policies, and to actually disable SELinux functionality, the kernel parameter "selinux=0" must now be passed).
- Experimental support has been added for VPN WireGuard.
- SSH login as the root user is disabled by default.
- The iptables-nft firewall management tools (the iptables, ip6tables, ebtables, and arptables utilities) and ipset have been deprecated. It is now recommended to use nftables for firewall management.
- A new mptcpd daemon has been included for configuring MPTCP (MultiPath TCP), an extension of TCP protocol for establishing TCP connections with packet delivery over multiple routes through different network interfaces bound to different IP addresses. Using mptcpd allows MPTCP configuration without the usage of the iproute2 utility.
- The network-scripts package has been removed; NetworkManager should be used for configuring network connections. Support for ifcfg configuration format has been retained, but NetworkManager now uses the keyfile-based format by default.
- New versions of compilers and developer tools are included: GCC 11.2, LLVM/Clang 12.0.1, Rust 1.54, Go 1.16.6, Node.js 16, OpenJDK 17, Perl 5.32, PHP 8.0, Python 3.9, Ruby 3.0, Git 2.31, Subversion 1.14, binutils 2.35, CMake 3.20.2, Maven 3.6, Ant 1.10.
- Updated server packages include Apache HTTP Server 2.4, nginx 1.20, Varnish Cache 6.5, and Squid 5.1.
- Database management systems MariaDB 10.5, MySQL 8.0, PostgreSQL 13, Redis 6.2 have been updated.
- By default, Clang is used to build the QEMU emulator, which has allowed the KVM hypervisor to implement additional protection mechanisms, such as SafeStack to protect against return-oriented programming (ROP) exploitation methods.
- The capabilities of the web console have been expanded: additional performance metrics have been added to identify bottlenecks (CPU, memory, disk, network resources), metric export has been simplified for visualization using Grafana, live patch management for the kernel has been introduced, and support for smart card authentication has been provided (including for sudo and SSH).
- In SSSD (System Security Services Daemon), log detail has been enhanced; for instance, completion times are now attached to events, reflecting the authentication stream. Search functions have been added for analyzing configuration and performance issues.
- Support for IMA (Integrity Measurement Architecture) has been expanded to verify the integrity of operating system components through digital signatures and hashes.
- A unified cgroup (cgroup v2) hierarchy is enabled by default. Cgroups v2 can be used, for example, to limit memory, CPU, and I/O usage. The key difference between cgroups v2 and v1 is the implementation of a single cgroup hierarchy for all resource types, rather than separate hierarchies for CPU distribution, memory consumption, and I/O. The separate hierarchies led to difficulties in coordinating interactions between handlers and additional kernel resource overhead when applying rules for processes mentioned across different hierarchies.
- Support for precise time synchronization based on the NTS (Network Time Security) protocol has been added, which utilizes public key infrastructure (PKI) elements and allows for TLS and authenticated encryption AEAD (Authenticated Encryption with Associated Data) to cryptographically secure the interaction between the client and server using NTP (Network Time Protocol). The NTP server chrony has been updated to version 4.1.
- New Ansible system roles have been added to automate the installation, configuration, and operation of Postfix, Microsoft SQL Server, VPN tunnels, and the timesync service. A new Ansible role has been added to support LVM (Logical Volume Manager) sections with VDO (Virtual Data Optimizer).
- Experimental (Technology Preview) support for KTLS (kernel-level TLS implementation), Intel SGX (Software Guard Extensions), DAX (Direct Access) for ext4 and XFS, and support for AMD SEV and SEV-ES in the KVM hypervisor has been provided.
- Changes have been made regarding the translation work of the code, documentation, and web resources developed in Red Hat to use more inclusive terminology, including the discontinuation of terms such as master, slave, blacklist, and whitelist.
Source: opennet.ru
