FreeBSD 14.4 Release

After nine months of development, the release of FreeBSD 14.4 has been finalized. Installation images have been prepared for amd64, i386, aarch64, armv7, powerpc, powerpc64, and riscv64 architectures. Additionally, builds for virtualization systems (QCOW2, VHD, VMDK, raw) and cloud environments Amazon EC2, Google Compute Engine, and Vagrant have been prepared.

The next update, FreeBSD 14.5, is scheduled for September 2026. Support for the current release, FreeBSD 14.4, will continue until December 31, 2026, while the previous release, FreeBSD 14.3, will be supported until June 30, 2026. Overall, the FreeBSD 14 branch will be maintained until November 30, 2028, and the FreeBSD 13.x branch until April 30, 2026. Concurrently, the FreeBSD 15 branch is being developed, with the next release (15.1) planned for June 2, 2026.

Key changes in FreeBSD 14.4:

• A new utility, sndctl, has been added to manage the settings of sound cards.
• The swapon utility now supports encrypted swap files, which can be specified in fstab using md devices with the suffix '.eli'.
• The nuageinit utility, responsible for initialization, of virtual machineshas been updated to support cloud-init, network configuration, and package management. Commands for compatibility with cloud-init have been added: ‘runcmd’, ‘packages’, ‘fqdn’, ‘hostname’, ‘sudo’, ‘write_files’, ‘nameservers’, ‘tzsetup’, and ‘doas’. A full YAML format parser has been implemented, along with logging functionality. The commands ‘chpasswd’, ‘wakeonlan’, ‘set-name’, and ‘match.driver’ have also been added.
• The console font spleen has been updated to version 2.2.0 and expanded with additional symbols (long dash, short dash, hyphen, angle brackets, white square, cross, and double cross). Character alignment on high pixel density screens has been improved. The gallant console font, which now includes over 4300 glyphs, has been enhanced to support Cyrillic characters and sets featuring mathematical symbols, arrows, currencies, and frames.
• Included is the 9P filesystem (p9fs), which can be used with virtio-9p devices and the Bhyve hypervisor to provide access from virtual machines to the host environment's filesystem contents. To load the driver, use the configuration setting ‘virtio_p9fs_load=YES’ in loader.conf.
• The tarfs filesystem has been updated to support files larger than 4 GB.
• In the FS, unionfs and nullfs have enhanced checks for root vnode when processing paths with ".." to block potential vulnerabilities that allow escaping the root directory of the jail environment.
• In the Jail subsystem, access for unprivileged users from the parent Jail to perform debugging, scheduler configuration, and sending signals to processes running in child Jails has been restricted. Separate privileges have been introduced for such operations: PRIV_SCHED_DIFFJAIL, PRIV_DEBUG_DIFFJAIL, and PRIV_SIGNAL_DIFFJAIL. A setting "allow.nounprivileged_parent_tampering" has been added to revert to the old behavior in process management within a Jail.
• Support for the "met" and "env" parameters has been added to the Jail subsystem, allowing arbitrary string metadata and environment data to be associated with Jail environments. These parameters can be set upon Jail creation, modified with the command "jail -cm", and viewed with the command jls. For example, ‘jail -cm … meta="tag1=value1 tag2=value2" env="configuration"‘. A sysctl setting "security.jail.meta_maxbufsize" has been proposed to limit the maximum size of data in the parameters.
• The ngctl utility has been enhanced with the "-j" flag to run commands within the specified Jail environment. This added flag enables manipulation of netgraph nodes in isolated environments where the ngctl utility is not installed.
• The capabilities of the mdo utility have been expanded to allow commands to be run under another user, similar to the "su" utility, but using the mac_do kernel module and the setcred system call instead of setuid. The new version implements options for managing user and group identifiers in the executed processes: "-k" for preserving the current users; "-g" and "-G" for setting the primary and additional groups; "-s" for changing additional groups; "—euid", "—ruid", "—svuid", "—egid", "—rgid", and "—svgid" for overriding specified identifiers.
• The kadmin utility, designed for managing Kerberos, has added the option "-f" for dumping the Heimdal KDC database in a format compatible with MIT KDC, allowing migration from Heimdal Kerberos to MIT Kerberos without fully recreating the database.
• In the basic system provided, the package manager pkg(7) has a simplified version, with option parsing unified with the full version of the pkg(8) toolkit. The order of options for commands in pkg(7) must now match the behavior of pkg(8); for example, instead of 'pkg -f bootstrap', one should specify 'pkg bootstrap -f'.
• The bsdinstall installer has discontinued support for installing with ZFS file systems on MBR disks (ZFS can only be used on GPT disks). The loader.efi bootloader is copied to all ESP (EFI System Partition) created on ZFS disks, in case the primary disk fails.
• The freebsd-update utility has established a strict order for installing shared libraries: libsys, libc, libthr, and then the others, preventing issues during upgrading from FreeBSD 14.x to the 15.x branch.
• The newfs utility has been enhanced with the '-u' flag to disable the 'soft updates' mechanism and journaling for the UFS2 filesystem by default.
• In the PAM (Pluggable Authentication Modules) libraries, module searching has been extended to the '${LOCALBASE}/lib/security' directory in addition to the '${LOCALBASE}/lib' directory.
• Support for VHT160 and VHT80P80 channels, used in modern access points, has been added to the net80211 wireless stack.
• Hardware support has been expanded. The iwlwifi driver for Intel wireless adapters now includes support for ACPI. Support for the Intel Ethernet E610 2.5G/5G/10G network card family has been added to the ix and ixv drivers. Support for Fujitsu SAS 6Gbit/s 1GB RAID controllers (D3116) has been added to the mfi and mrsas drivers. servers Fujitsu PRIMERGY.
• Support for Raspberry Pi Zero 2W boards has been included in the generated SD card images.
• The background process blacklistd, which provides dynamic blocking of network ports to protect against DoS attacks, has been updated and renamed to blocklistd.
• A package with Lua bindings for libyaml has been included in the base system.
• OpenSSH has been upgraded from version 9.9p2 to 10.0p2, including the hybrid algorithm mlkem768x25519-sha256 enabled by default, which is resistant to cracking by quantum computers.
• Updated versions of third-party components: OpenZFS 2.2.9 (previously 2.2.7), OpenSSL 3.0.16, SQLite 3.50.4, unbound 1.24.1, libucl 0.9.2, expat 2.7.3, libyaml 0.2.5, libarchive 3.8.5, xz 5.8.2, less 685, bmake 20251111, bc 7.1.0.
• Packages with firmware for wireless devices have been added to the base installation media (bootonly), enabling wireless connections to fetch installation files over the network.
• The executable file sbin/ipfw15 has been added, built with a new KBI (Kernel Binary Interface) for compatibility with FreeBSD 15. The original ipfw utility itself detects the presence of the new KBI and launches ipfw15 if necessary to correctly load packet filtering rules when upgrading to FreeBSD 15.
• Support for the RIP routing protocol (routed, rtquery, route6d, rip6query) has been deprecated and is scheduled for removal. It is recommended to use the 'bird' or 'quagga' packages from the ports collection instead of routed.
• The built-in MIDI sequencer implementation in the kernel has been deprecated.
• Code for compatibility with previous versions of the ipfw packet filter, supplied before the release of FreeBSD 8, has been removed.

Source: opennet.ru