Release of Red Hat Enterprise Linux 9.4

Red Hat has released the Red Hat Enterprise Linux 9.4 distribution. The installation images are available for registered users on the Red Hat Customer Portal (the ISO images of CentOS Stream 9 and free RHEL developer builds can also be used for functionality evaluation). The release is built for x86_64, s390x (IBM System z), ppc64le, and Aarch64 (ARM64) architectures.

The RHEL 9 branch develops with a more open development process and uses the package base of CentOS Stream 9 as its foundation. CentOS Stream is positioned as an upstream project for RHEL, allowing external participants to oversee package preparations for RHEL, propose changes, and influence decision-making. According to the 10-year support cycle for the RHEL distribution, RHEL 9 will be supported until 2032.

The source code of the RHEL 9.4 RPM packages is not available in the public repository git.centos.org and is provided to clients by the company only through a restricted section of the website, which operates under a user agreement (EULA) prohibiting redistribution of the data, preventing the use of these packages to create derivative distributions. The source code remains available in the CentOS Stream repository, but it is not fully synchronized with RHEL, and not all the latest package versions correspond with those from RHEL. Rocky Linux, Oracle, and SUSE reproduce the source code of RHEL RPM packages as part of the OpenELA project.

Key Changes in RHEL 9.4:

• Full support for Intel SGX (Software Guard Extensions) isolated enclave technology is provided. SGX versions 1 and 2 are supported, allowing the use of FLC (Flexible Launch Control) and EDMM (Enclave Dynamic Memory Management) mechanisms to modify access rights to individual enclave memory pages, dynamically add/remove memory pages to the enclave, and expand the enclave.
• The IDXD (Data Streaming Accelerator) driver has been promoted to stable status for utilizing data transfer accelerators built into Intel CPUs. Previously, SGX and IDXD were classified as experimental features (Technology Preview).
• The eBPF subsystem implementation is synchronized with the Linux kernel 6.6 (the previous release used the eBPF implementation from the Linux kernel 6.3).
• The GRUB bootloader and shim layer have added the ability to implement memory protection mechanisms such as DEP (Data Execution Prevention), NX (No Execute), and XD (Execute Disable) to prevent the execution of instructions in certain memory regions before system boot.
• New versions of compilers and development tools included: GCC Toolset 13, LLVM Toolset 17.0.6, Rust Toolset 1.75.1, and Go Toolset 1.21.7.
• New packages (Application Streams) have been added with versions for Python 3.12, Ruby 3.3, PHP 8.2, nginx 1.24, MariaDB 10.11, and PostgreSQL 16.
• Updated versions include Git 2.43.0, Git LFS 3.4.1, Valgrind 3.22, SystemTap 5.0, elfutils 0.190, and cmake 3.26. New packages maven-openjdk21 and libzip-tools have been added.
• Security-related packages have been updated: GnuTLS 3.8.3, nettle 3.9.1, p11-kit 0.25.3, libkcapi 1.4.0, stunnel 5.71, audit 3.1.2, SSG (SCAP Security Guide) 0.1.72, openCryptoki 3.22.0, and ipa 4.11.
• Server and system packages have been updated: chrony 4.5, linuxptp 4.2, Rsyslog 8.2310, iptables 1.8.10, nftables 1.0.9, firewalld 1.3, stratis-cli 3.6.0, boom 1.6.0, 389-ds-base 2.4.5, samba 4.19.4, and Podman 4.9.
• The user-space tools for SELinux (libsepol, libselinux, libsemanage, policycoreutils, checkpolicy, mcstrans) have been updated to version 3.6, which adds support for 'deny' rules and the keywords 'notself' and 'other' in the CIL (Common Intermediate Language). An executable file named getpolicyload has been added to display the number of SELinux rule reloads. The SELinux protection has been extended to the services nvme-stas, rust-afterburn, rust-coreos-installer, and bootc, which were previously running in unconfined_service_t mode. SELinux rules have been added for SAP HANA. A new SELinux-protected service, chronyd-restricted, has also been introduced. Additionally, the grafana-selinux package has been added to run grafana with SELinux protection.
• The Keylime registrar and verifier, used for authentication and continuous integrity monitoring of external systems, can now be run inside containers isolated from the main system.
• In the Rsyslog logging system, the ability to modify TLS/SSL encryption settings has been provided, along with additional options for privilege dropping.
• OpenSSL now allows you to place TLS configuration files in a separate directory /etc/pki/tls/openssl.d, enabling the overriding of settings for additional cryptographic modules without altering the main OpenSSL configuration file.
• SSSD (System Security Services Daemon) now includes support for enabling and configuring passwordless authentication using biometric sensors that comply with the FIDO2 specification, such as YubiKey devices.
• An experimental command 'podman build farm' has been added for building container images for multiple architectures at once. Podman has introduced full support for a SQLite-based backend and allows the use of containers.conf modules for selective loading of settings. Multi-line HereDoc instructions are permitted in the Containerfile. The CNI (Container Network Interface) network stack has been deprecated. The 'podman machine' command now implements the ability to forward USB devices to QEMU virtual machines.
• In IdM (Identity Management), the option to enable mandatory two-factor authentication for LDAP clients using one-time passwords (OTP) is provided. The IdM API, which was previously experimental, has been stabilized. Support for the HAProxy protocol has been added to the 389 Directory Server, allowing correct identification of the IP addresses of clients connecting through the proxy.
• The RHEL image builder now allows specifying arbitrary mount points and creating various partitioning modes (auto-lvm, lvm, raw).
• Before version 1.0.0, the implementation of the synce4l protocol has been updated to support SyncE (Synchronous Ethernet) technology, which is supported in some network cards and switches, enhancing data exchange efficiency in RAN (Radio Access Network) applications through more accurate time synchronization. Support for the DPLL (Digital Phase Locked Loop) interface provided by the kernel has been added.
• The nftables subsystem has been enhanced to verify the fields of internal packet headers transmitted over tunnels. The nft utility has introduced the 'nft reset' command to reset the states of nftables rules, such as packet counters and quota values. In firewalld, the removal of rules added via iptables has been ceased when the nftables backend is used and no rules have been created with the '—direct' option.
• The ss utility included in the iproute2 package now has the '--bound-inactive' option to display inactive TCP network sockets that are bound to IP address and the network port (the bind call has been executed), but not connected (the connect call) or switched to connection wait mode (the listen call).
• In NetworkManager, the ability to change the number of channels (queues tied to interrupt handlers) for network interfaces and configure the SwitchDev mode has been added, allowing the delegation of frame forwarding and network packet processing operations to specialized hardware chips. Support for MACsec network interfaces has been added. For wireless connections, the option to assign a separate permanent MAC address (stable-ssid mode) has been provided.
• In Nmstate, the creation of a YAML file for reverting to previous settings has been enabled. To manage priorities in aggregated network interfaces (bond), the priority property has been added. Additional attributes for VLAN have been introduced: registration-protocol, mvrp, reorder-headers, and loose-binding. The configuration of VLAN tags on SR-IOV (Single Root I/O Virtualization) supporting network devices has been facilitated.
• The kernel module with the implementation of the TCP Illinois congestion control algorithm has been returned, which on average allows for greater throughput and a more fair allocation of resources.
• The capabilities of the rteval, rtla, and cyclicdeadline utilities have been expanded. The rteval now allows the use of prefixes "+" and "-" to attach and detach CPU cores from the monitored core list (measurement-cpulist). The rtla utility has been updated to correspond with kernel version 6.6. An option "rtla -C" has been added to attach additional cgroups to threads. The cyclicdeadline utility now includes the ability to visualize delays as a histogram.
• A maximum filesystem size can now be specified when dynamically increasing the filesystem size with the stratisd service, which helps to avoid performance degradation after uncontrolled XFS size increases.
• Support for converting standard logical volumes (LV) to a version that allows for dynamic space allocation (thin provisioning) has been added to the lvconvert utility.
• Support for handling FPIN-Li (Fabric Performance Impact Notification) events has been added to multipathd to optimize access to NVMe storage. The default settings section in multipath.conf has been updated with max_retries and auto_resize parameters. Settings have also been added for using the HPE Alletra 9000 NVMeFC array and supporting the ANA (Asymmetric Namespace Access) mode in NVMeoFC.
• The ability to boot from NVMe/FC adapters (Non-volatile Memory Express over Fibre Channel) has been promoted to stable status.
• The web console has simplified storage management and resizing of partitions. Support for generating shell scripts and Ansible playbooks for configuring kdump has been added. In the Virtual Machines section, it is now possible to add SSH public keys and connect preformatted block devices. VNC has been used instead of the SPICE protocol for connecting to virtual machines.
• New system roles for launching, managing, and configuring fapolicyd and Microsoft SQL Server 2022 have been added. A snapshot role for creating and managing LVM snapshots has been introduced. The sshd role now includes support for certificate-based authentication.
• Support for virtualization on ARM64 systems using the KVM hypervisor has been stabilized.
• Support for migrating virtual machines in Multi-FD (multiple file descriptors) mode has been added, allowing multiple parallel connections during the migration of a virtual machine, which speeds up data transfer over high-speed network connections (20 Gbps and above).
• The performance of live migration in Postcopy mode has been improved, where the virtual environment starts almost immediately, and all missing data is loaded when accessing uncopied memory pages.
• A new tool called toolbx has been added, allowing the launch of an additional isolated environment that can be configured in any way using the standard DNF package manager and used to install experimental packages without affecting the main system.
• Support has been added for Linux kernel command-line parameters: accept_memory, ia32_emulation, arm64.nomops, cgroup_favordynmods, early_page_ext, fw_devlink.sync_state, kunit.enable, mtrr=debug, rcupdate.rcu_cpu_stall_cputime, rcupdate.rcu_exp_stall_task_details, spec_rstack_overflow, and workqueue.unbound_cpus.
• New sysctl parameters have been added: io_uring_group and numa_balancing_promote_rate_limit_MBps.
• The use of the io_uring mechanism is disabled by default for all processes (sysctl io_uring_disabled=2).
• Hardware support has been expanded. Drivers have been added for technologies including Intel QuickAssist Technology, Intel TPMI, Intel Uncore Frequency, AMD HSMP, AMD XCP, AMD Platform Management, and Mellanox PMC. The octeon_ep driver for Marvell Octeon PCIe Endpoint Network Interface Controllers has also been added.
• Continued provision of experimental (Technology Preview) support:
  • VPN WireGuard,
  • kTLS (TLS at the kernel level),
  • asynchronous I/O interface io_uring,
  • DAX (Direct Access) for ext4 and XFS,
  • AMD SEV and SEV-ES in the KVM hypervisor,
  • systemd-resolved service,
  • the Sigstore mechanism for container verification via digital signatures,
  • PRP (Parallel Redundancy Protocol) and HSR (High-availability Seamless Redundancy) protocols,
  • hardware acceleration of IPsec by offloading packet encapsulation operations to the network card,
  • the ACME certificate management protocol used in Let's Encrypt,
  • SRv6 (Segment Routing over IPv6)
  • package with the GIMP image editor 2.99.8,
  • MPTCP (Multipath TCP) settings via NetworkManager,
  • DNSSEC in IdM,
  • virtio-mem,
  • Socket API for TuneD,
  • Soft-iWARP (Internet Wide-area RDMA Protocol),
  • GNOME for ARM64 and IBM Z.

Source: opennet.ru