Red Hat Enterprise Linux 9.1 Distribution Release

Red Hat has released the Red Hat Enterprise Linux 9.1 distribution. The installation images are available for registered users on the Red Hat Customer Portal (ISO images of CentOS Stream 9 can also be used for functionality evaluation). The release was built for x86_64, s390x (IBM System z), ppc64le, and Aarch64 (ARM64) architectures. The source code for the RPM packages of Red Hat Enterprise Linux 9 is hosted in the CentOS Git repository.

The RHEL 9 branch develops with a more open development process and uses the package base of CentOS Stream 9 as its foundation. CentOS Stream is positioned as an upstream project for RHEL, allowing external participants to oversee package preparations for RHEL, propose changes, and influence decision-making. According to the 10-year support cycle for the RHEL distribution, RHEL 9 will be supported until 2032.

Key changes:

• Server and system packages updated: firewalld 1.1.1, chrony 4.2, unbound 1.16.2, frr 8.2.2, Apache httpd 2.4.53, opencryptoki 3.18.0, powerpc-utils 1.3.10, libvpd 2.2.9, lsvpd 1.7.14, ppc64-diag 2.7, PCP 5.3.7, Grafana 7.5.13, samba 4.16.1.
• The release includes new versions of compilers and developer tools: GCC 11.2.1, GCC Toolset 12, LLVM Toolset 14.0.6, binutils 2.35.2, PHP 8.1, Ruby 3.1, Node.js 18, Rust Toolset 1.62, Go Toolset 1.18.2, Maven 3.8, java-17-openjdk (java-11-openjdk and java-1.8.0-openjdk are also still supplied), .NET 7.0, GDB 10.2, Valgrind 3.19, SystemTap 4.7, Dyninst 12.1.0, elfutils 0.187.
• The eBPF (Berkeley Packet Filter) subsystem has been enhanced with improvements from Linux kernels 5.15 and 5.16. For example, BPF programs can now request and handle timer events, access and set socket options via setsockopt, support kernel module function calls, introduce a probabilistic data structure (BPF map) bloom filter, and bind tags to function parameters.
• The set of patches for real-time systems used in the kernel-rt has been updated to correspond with kernel 5.15-rt.
• The MPTCP (MultiPath TCP) protocol implementation has been updated, which is used for establishing TCP connections that deliver packets simultaneously over multiple routes through different network interfaces. Changes have been backported from Linux kernel 5.19 (for example, support has been added for MPTCP connections to fallback to regular TCP, and an API for managing MPTCP streams from user space has been proposed).
• On systems with 64-bit ARM, AMD, and Intel processors, the ability to change the Real-Time mode operation in the kernel during runtime is provided by writing the mode name in the file "/sys/kernel/debug/sched/preempt" or at boot time via the kernel parameter "preempt=" (none, voluntary, and full modes are supported).
• The GRUB bootloader settings have been changed to hide the default boot menu, which will be displayed if the previous boot fails. To show the menu during boot, you can hold the Shift key or periodically press Esс or F8. To disable hiding, you can use the command 'grub2-editenv — unset menu_auto_hide'.
• The PTP (Precision Time Protocol) driver has been enhanced to support the creation of virtual hardware clocks (PHC, PTP Hardware Clocks).
• A modulesync command has been added, which loads RPM packages from modules and creates a repository in the working directory with the metadata needed for installing modular packages.
• In tuned, the service for monitoring system status and optimizing profiles for maximum performance based on current load, the option to use the tuned-profiles-realtime package has been provided to isolate CPU cores and allocate all available resources to application threads.
• NetworkManager has implemented the conversion of connection profiles from the ifcfg settings format (/etc/sysconfig/network-scripts/ifcfg-*) to a keyfile-based format. The command 'nmcli connection migrate' can be used to migrate profiles.
• The SELinux toolkit has been updated to release 3.4, which improves the performance of relabeling operations by parallelizing tasks. The semodule utility has added the '-m' ('—checksum') option to obtain SHA256 hashes of modules, and mcstrans has transitioned to the PCRE2 library. New utilities for managing access policies have been added: sepol_check_access, sepol_compute_av, sepol_compute_member, sepol_compute_relabel, sepol_validate_transition. SELinux policies have been added to protect the services ksm, nm-priv-helper, rhcd, stalld, systemd-network-generator, targetclid, and wg-quick.
• Support has been provided for the Clevis client (clevis-luks-systemd) to automatically unlock disk partitions encrypted with LUKS and mounted at a later stage of boot, without the need to use the command 'systemctl enable clevis-luks-askpass.path'.
• The toolkit for preparing system images has been expanded, now supporting the booting of images in GCP (Google Cloud Platform), placing images directly into the container registry, adjusting the /boot partition size, and modifying parameters (Blueprint) during image generation (e.g., adding packages and creating users).
• A keylime utility has been added for the attestation (authentication confirmation and continuous integrity tracking) of external systems, using TPM (Trusted Platform Module) technology, for example, to verify the authenticity of Edge and IoT devices in uncontrolled environments where unauthorized access is possible.
• The 'RHEL for Edge' edition now allows the use of the fdo-admin utility to configure FDO (FIDO Device Onboard) services and create certificates and keys for them.
• SSSD (System Security Services Daemon) now supports caching SID queries (such as GID/UID checks) in memory, which speeds up operations for copying large numbers of files over Samba servers. Integration with Windows Server 2022 has been supported.
• In OpenSSH, the minimum size for RSA keys is now limited to 2048 bits by default, and support for RSA keys smaller than 1023 bits has been discontinued in NSS libraries. A RequiredRSASize parameter has been added to configure custom limits in OpenSSH. Support for the sntrup761x25519-sha512@openssh.com key exchange method, resilient to quantum computer attacks, has been introduced.
• The ReaR (Relax-and-Recover) toolkit now includes the ability to execute arbitrary commands before and after recovery.
• Support for iWARP and RoCE protocols has been implemented in the driver for Intel E800 Ethernet adapters.
• A new httpd-core package has been added, which relocates the basic components of Apache httpd necessary to run an HTTP server with minimal dependencies. Additional modules, such as mod_systemd and mod_brotli, have been included in the httpd package along with documentation.
• A new xmlstarlet package has been added, which includes utilities for parsing, transforming, validating, extracting data from, and editing XML files, similar to grep, sed, awk, diff, patch, and join, but specifically for XML rather than text files.
• Expanded capabilities for system roles, for example, the network role now includes support for configuring routing rules and using the nmstate API, the logging role has added support for filtering based on regular expressions (startmsg.regex, endmsg.regex), the storage role now supports partitions for which space is dynamically allocated in storage ("thin provisioning"), the sshd role has features for managing through /etc/ssh/sshd_config, the metrics role has added the export of performance statistics for Postfix, and the firewall role has implemented the ability to overwrite the previous configuration while providing support for adding, updating, and removing services based on their state.
• The toolkit for managing isolated containers has been updated, including packages such as Podman, Buildah, Skopeo, crun, and runc. Support for GitLab Runner in containers with the Podman runtime has been added. A utility called netavark and the Aardvark DNS server are provided for configuring the container network subsystem.
• Support for the ap-check command in mdevctl has been added to configure forwarding in virtual machines access to crypto accelerators.
• A preliminary (Technology Preview) feature for user authentication using external providers (IdP, identity provider) that support the OAuth 2.0 extension "Device Authorization Grant" for providing OAuth access tokens to devices without using a browser has been added.
• For GNOME sessions based on Wayland, Firefox builds using Wayland are provided. X11-based builds running in a Wayland environment via the XWayland component have been packaged separately as firefox-x11.
• By default, the Wayland session is activated for systems with Matrox GPUs (previously, Wayland was not used with Matrox GPUs due to limitations and performance issues that have now been resolved).
• Support for GPUs integrated into 12th generation Intel Core processors has been implemented, including Intel Core i3 12100T – i9 12900KS, Intel Pentium Gold G7400 and G7400T, Intel Celeron G6900 and G6900T, Intel Core i5-12450HX – i9-12950HX, and Intel Core i3-1220P – i7-1280P. Support for AMD Radeon RX 6[345]00 and AMD Ryzen 5/7/9 6[689]00 GPUs has been added.
• To manage the enabling of vulnerability protection in the MMIO (Memory Mapped Input Output) mechanism, a kernel boot parameter "mmio_stale_data" has been implemented, which can accept the values "full" (enabling buffer cleanup when transitioning to user space and in VM), "full,nosmt" (like "full" + additionally disables SMT/Hyper-Threads), and "off" (protection is disabled).
• To manage the activation of the Retbleed vulnerability protection, a kernel boot parameter "retbleed" has been implemented, which allows you to disable protection ("off") or choose a vulnerability blocking algorithm (auto, nosmt, ibpb, unret).
• The kernel boot parameter acpi_sleep now supports new options for managing sleep mode transitions: s3_bios, s3_mode, s3_beep, s4_hwsig, s4_nohwsig, old_ordering, nonvs, sci_force_enable, and nobl.
• A significant addition of new drivers for network devices, storage systems, and graphics chips has been made.
• Continued to provide experimental (Technology Preview) support for KTLS (kernel-level TLS implementation), VPN WireGuard, Intel SGX (Software Guard Extensions), Intel IDXD (Data Streaming Accelerator), DAX (Direct Access) for ext4 and XFS, AMD SEV and SEV-ES in the KVM hypervisor, systemd-resolved service, Stratis storage manager, Sigstore for validating containers via digital signatures, GIMP 2.99.8 graphic editor package, MPTCP (Multipath TCP) settings through NetworkManager, ACME (Automated Certificate Management Environment) server, virtio-mem, KVM hypervisor for ARM64.
• The GTK 2 toolkit and its associated packages adwaita-gtk2-theme, gnome-common, gtk2, gtk2-immodules, and hexchat have been deprecated. The X.org Server (by default, a GNOME session based on Wayland is offered in RHEL 9) has been deprecated, and it is planned to be removed in the next major branch of RHEL, but the ability to run X11 applications from a Wayland session using the XWayland DDX server will be retained.

Source: opennet.ru