DNF-automatic reboot Option

Use DNF-automatic reboot option after performing an upgrade to automatically reboot the system and apply changes.

reboot = [never , when-changed, when-needed]

where:

• never (default behavior) – The system is not rebooted following an upgrade.
• when-changed –The system is automatically rebooted following any upgrade changes.
• when-needed – The system is only automatically rebooted following upgrade changes to systemd or the kernel.

You can also include a reboot_command entry to customize the reboot behavior. For example, to skip the 5 minute delay following an upgrade, you can specify the shutdown - r

reboot_command = shutdown -r

DNF System-Upgrade Plugin reboot --poweroff Flag

Use the DNF system-upgrade plugin reboot --poweroff flag to shutdown the system after installing updates, instead of rebooting.

dnf system-upgrade reboot --poweroff

DNF Plugins: leaves and show-leaves

Postfix Can Handle SRV Lookups

DNS service records resolution (SRV) entries can be used by Postfix to automatically configure mail clients and balance server load. Furthermore, Postfix can handle temporary DNS issues and provides configurable options for fault-resilience in case of SRV record failures. You can configure SRV handling for Postfix by setting the following options in the Postfix server configuration:

• use_srv_lookup=smtp

  Enables discovery of the specified service by using DNS SRV records.

• allow_srv_lookup_fallback= yes

  Configures the service for SRV lookup fallback, so that Postfix falls back to using MX and IP address records in the case where an SRV entry lookup fails either because of misconfiguration or a missing entry, but continues to use SRV for the service.

• ignore_srv_lookup_error=yes

  Configures the service to stop using SRV when a lookup fails, and to switch to using MX or IP address records instead.

CUPS: Generic LF-to-CRLF Print Driver

A Generic LF-to-CRLF, lftocrlf, print driver is available for configuration when using the Common UNIX Printing System (CUPS). This driver enables you to convert a line ending with a Line Feed (LF) control character to a Carriage Return Line Feed (CRLF) control character.

The lftocrlf print driver is a renamed version of the text-only driver available in Oracle Linux 7, so that the name describes its actual functionality.

Keylime Updated to Version 7.3.0

Aside from security fixes, this updated version of Keylime includes the convert_runtime_policy.py script that lets you combine allow and exclude lists into the runtime policy.

crypto-policies Includes the NO-ENFORCE-EMS Subpolicy for TLS 1.2 Connections in FIPS Mode

The NO-ENFORCE-EMS subpolicy is included in the system-wide cryptographic policies. When this subpolicy is enforced, the system no longer requires the Extended Master Secret (EMS) extension (RFC 7627) for all TLS 1.2 connections negotiated in FIPS mode. The system can therefore connect with legacy systems that don't work with EMS or TLS 1.3. Note, however, that applying the subpolicy would result in noncompliance with the requirements of the FIPS-140-3 standard.

To apply the subpolicy, use the following command:

sudo update-crypto-policies --set FIPS:NO-ENFORCE-EMS

GnuTLS Requires EMS With TLS 1.2 in FIPS Mode

The FIPS-140-3 standard requires the Extended Master Secret (EMS) extension in GnuTLS servers and clients for all TLS 1.2 connections in FIPS mode.

If you need to preserve compatibility with older servers and clients that don't enforce EMS and, at the same time, you can't use TLS 1.3, apply the NO-ENFORCE-EMS subpolicy instead. Enter the following command:

sudo update-crypto-policies --set FIPS:NO-ENFORCE-EMS

NSS Enforce EMS in FIPS Mode

The Network Security Services (NSS) libraries contain the TLS-REQUIRE-EMS policy. This policy enforces the use of the Extended Master Secret (EMS) extension for all TLS 1.2 connections as required by the FIPS 140-3 standard. NSS enforces the TLS-REQUIRE-EMS policy when system-wide cryptographic policies are set to FIPS.

If you need to work with older servers and clients that don't enforce EMS and, at the same time, you can't use TLS 1.3, apply the NO-ENFORCE-EMS subpolicy instead. Enter the following command:

sudo update-crypto-policies --set FIPS:NO-ENFORCE-EMS

However, applying the subpolicy would violate the requirements of the FIPS-140-3 standard.

EMS in FIPS Mode Can Be Disabled in OpenSSL

You can configure the OpenSSL cryptographic libraries so you can use TLS 1.2 connections without the Extended Master Secret (EMS) extension in FIPS mode. Do the following:

1. Edit the /etc/pki/tls/fips_local.cnf file by adding the following section:

   [fips_sect]
   tls1-prf-ems-check = 0
   activate = 1

2. Open the /etc/pki/tls/openssl.cnf and navigate to the SSL configuration section whose section heading is [crypto_policy].

   At the end of the section, add the following line:

   Options=RHNoEnforceEMSinFIPS

You can also stop enforcing EMS for TLS 1.2 in FIPS mode with the following command:

sudo update-crypto-policies --set FIPS:NO-ENFORCE-EMS

However, whether you use the previous steps or the single command, disabling EMS for TLS 1.2 in FIPS mode would violate the requirements of the FIPS-140-3 standard.

OpenSSH Enforces SHA-2

To improve the less secure SHA-1 algorithm, OpenSSH applies the following changes:

• Checks sshd startup whether SHA-1 is configured. If it's unavailable, OpenSSH doesn't use SHA-1 for operations. Thus, DSS keys, if present, aren't loaded. Further, the advertising of rsa-sha2 combinations, when available, is enforced.

• On SSH private key conversion, OpenSSH explicitly uses SHA-2 for testing RSA keys.

• The sshd daemon uses SHA-2 to confirm host key proof if SHA-1 signatures are unavailable on the server side. However, this configuration might be incompatible with clients that use Oracle Linux 8 and earlier versions.

• The sshd daemon also uses SHA-2 if SHA-1 signatures are unavailable on the client side.

• On the client side, OpenSSH accepts SHA-2-based key proofs from the server if SHA-1 is used in the key proof request or when the hash algorithm isn't specified and the default configuration is used. This behavior is aligned with the already present exception for RSA certificates, and lets connections be established by using modern algorithms.

OpenSSL Elliptic Curve Cryptography Works With Brainpool Curves

The following brainpool curves are enabled in OpenSSL Elliptic Curve Cryptography:

• brainpoolP256r1

• brainpoolP256t1

• brainpoolP320r1

• brainpoolP320t1

• brainpoolP384r1

• brainpoolP384t1

• brainpoolP512r1

• brainpoolP512t1

pcsc-lite-ccid Updated to 1.5.2

The updated pcsc-lite-ccid package provides various bug fixes and enhancements such as the ability to work with new readers and a fix for Alcor Micro AU9560 card reader.

opensc Package Updated to 0.23

The updated opensc package provides various bug fixes and enhancements such as the following:

• Works with encryption and decryption using symmetric keys

• Can be used to sign data with a length of more than 512 bytes

• Automatically disables old card driver functionality

• Removes functionality for the MioCOS and JCOP drivers

New SELinux Boolean for QEMU Guest Agent

Commands that were run in a confined context by the QEMU Guest Agent daemon program, such as mount, used to fail with an Access Vector Cache (AVC) denial. For these commands to work, the guest-agent needed to be running in the unconfined_t domain.

The update adds a new SELinux policy Boolean called virt_qemu_ga_run_unconfined. This Boolean enables the guest-agent to transition to the unconfined domain. Rules for transitions for the qemu-ga daemon have also been added to the SELinux policy Boolean.

By enabling the virt_qemu_ga_run_unconfined Boolean, you can run confined commands through the QEMU Guest Agent and not see AVC denial errors.

OpenSCAP Updated to 1.3.8

The OpenSCAP packages are updated to version 1.3.8. Notable changes include:

• Fixes to systemd probes to not ignore some systemd units.
• Addition of offline capabilities to the shadow OVAL probe.
• Addition of offline capabilities to the sysctl OVAL probe.
• Addition of auristorfs to the list of network file systems.
• Improved handling of tailoring files generated by autotailor.

SCAP Security Guide Updated to Version 0.1.69

Among other enhancements, this version of the SCAP Security Guide introduces three new SCAP profiles for Oracle Linux 9. These profiles are aligned with the CCN-STIC-610A22 Guide that was issued in October 2022 by the National Cryptologic Center of Spain.

SCAP Security Guide Updated ANSSI-BP-028 Security Profiles to Version 2.0

The Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) BP-028 profiles in the SCAP security guide were updated to align with the version 2.0 guidelines described at https://www.ssi.gouv.fr/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/.

iproute Packages Updated to Version 6.2.0

The iproute packages have been updated to version 6.2.0. This update provides various enhancements and bug fixes over the previous version. The most notable changes include:

• New ip stats command to view and manage interface statistics. See the ip-stats(8) manual page for more information.

• New --threads option used by the ss command to display thread information. See the ss(8) manual page for more information.

• New bridge fdb flush command to flush forwarding database entries. See the bridge(8) manual page for more information.

Network Manager Updated With Latest Upstream Version

The NetworkManager packages have been upgraded to upstream version 1.44.0. This update provides various enhancements and bug fixes over the previous version.

SCTP Updated With Latest Kernel Version of Networking Tree

Notable changes in the Stream Control Transmission Protocol (SCTP) networking subsystem include:

• Virtual routing and forwarding (VRF) enables you to segment and isolate SCTP traffic within complex network environments.

• New stream schedulers (fair capacity, and weighted fair queueing) to ensure that efficient and equal resource allocation within the network.

xdp-tools Package Updated to Version 1.4.0

The xdp-tools package version 1.4.0 includes the following bug fixes and enhancements:

• The xdp-bench utility includes a multibuffer eXpress Data Path (XDP) benchmarker helper function xdp_load_bytes() within the kernel. This enhancement enables conducting network benchmarking tests with large maximum transmission units (MTUs).

• Improved locking functionality for the command line utilities xdp-tools, which prevents stale locking of the utility if it didn't exit cleanly.

• The libxdp library includes a new xsk_umem__create_with_fd() API that accepts an extra file descriptor of an already open AF_XDP socket. You can use this function as a substitute for the regular xsk_umem__create() function when a process doesn't have CAP_NET_RAW privileges.

Updated Crash Utility

Version 8.0.3 of the Crash utility addresses both bug fixes and enhancements. Crash is an interactive utility used to analyze the Linux system state while it's running, or after a kernel failure and the creation of a core kdump file. The most notable enhancement is the added IPv6 functionality. For example:

• The Crash utility prints IPv6 addresses with the net or net -s command. net displays the list of network devices, names, and the IP address. net -s command displays the following information:

  • Open network socket and sock addresses

  • Sockets types and addresses

  • Source and destination addresses, and ports for INET and INET6 families

Updated Intel® QAT Kernel Driver

The Intel® Quick Assist Technology (QAT), as of version 6.2, includes both bug fixes and enhancements. The most notable enhancement includes added functionality for the following QAT GEN4 hardware accelerator devices:

• Intel Quick Assist Technology 401xx devices

• Intel Quick Assist Technology 402xx devices

RHCK Can Handle AutoIBRS Configurations on AMD Processors

RHCK can handle Automatic Indirect Branch Restricted Speculation (AutoIBRS) configurations on AMD processors. AutoIBRS is a feature provided by the AMD EPYC 9004 Genoa family of processors and later CPU versions. AutoIBRS is the default mitigation used for the Spectre v2 CPU to reduce vulnerabilities, boost performance, and improve scalability.

Kdump Utility Can Handle LVM Thin Provisioned Logical Volumes as Targets

The kdump utility includes added functionality for configuring thin provisioned logical volumes as the vmcore target. The configuration of LVM thin provisioning includes these steps:

1. Create a LVM volume group.

   vgcreate vg00 /dev/sdb

2. Create a LVM thin pool of 10 MB available space.

   lvcreate -L 10M -T vg00/thinpool

3. Create a LVM thin volume with 300 MB of the file system space.

   lvcreate -V 300M -T vg00/thinpool -n thinvol
   mkfs.ext4 /dev/vg00/thinvol

4. Configure the LVM thin pool threshold to automatically extend the space.

   cat /etc/lvm/lvm.conf
   activation {
   	thin_pool_autoextend_threshold = 70
   	thin_pool_autoextend_percent = 20
   	monitoring = 1
   }

5. Enable the LVM thin pool monitoring service for the first kernel.

   systemctl enable lvm2-monitor.service
   systemctl start lvm2-monitor.service

6. Append the following lines to the kdump.conf file to set the LVM thin volume as the kdump target.

   ext4 /dev/vg00/thinvol
   path /

7. Start the kdump service.

   kdumpctl restart

8. Verify the configuration by triggering a kernel panic and check if the vmcore is saved to /dev/vg00/thinvol.

With this enhancement, the kdump utility can save the vmcore dump files on thin provisioned storage volumes.

Updated nvme-cli Package

The nvme-cli package as of version 2.4 provides bug fixes and enhancements. Notable changes include:

• Functionality for TLS over TCP configurations.

• Functionality for nvme effects-log command for fabrics controllers.

• Fixes for the incorrect ordering of systemd for auto-connect services when mounting file systems using the /etc/fstab configuration file.:

• Fixes for printing issues seen with u32 values.

• Fixes for incorrect validation storage tag size.

New NFSv4 Courteous Server Functionality

New functionality is added for NSFv4 Courteous Server in RHCK. The NFSv4 Courteous Server enables clients to continue operation even after experiencing a transient network outage by enabling clients’ uncontested locks to remain valid on the server when network outage lasts longer than the NFSv4 lease period. For more information about NFS Courteous Server functionality, see NSFD 5.19 Release Notes https://lore.kernel.org/lkml/DDB7B172-52E3-4015-9BD2-9BCDE209E5AC@oracle.com/.

HTTP::Tiny Perl Module Updated to Perform TLS Verification by Default

The HTTP::Tiny Perl module is updated to perform TLS certificate verification by default when using HTTPS. The update adds the following dependencies to the perl-HTTP-Tiny package:

• perl-IO-Socket-SSL

• perl-Mozilla-CA

• perl-Net-SSLeay

The verify_SSL option is changed from 0 to 1 when the package is installed.

httpd Updated to Version 2.4.57

This updated version of thee Apache HTTP Server contains bug fixes, enhancements, and security fixes, such as the following:

• The HTTP daemon's rotatelogs utility has a -T option which truncates rotated logfiles except the initial logfile.

• In httpd configuration dumping operations, the mod_ssl module no longer tests existence of certificate and key files.

• In the mod_ldap module, the LDAPConnectionPoolTTL directive accepts negative values. This feature enables reuse of connections of any age.

• Workers from the mod_proxy_hcheck module work correctly based on worker timeout settings.

• The mod_proxy_hcheck module's hcmethod parameter includes these new methods for HTTP/1.1 requests:

  • GET11

  • HEAD11

  • OPTIONS11

New Module in Apache HTTP server

The httpd daemon includes the mod_authnz_fcgi module, enabling FastCGI authorizer applications to authenticate users and authorize access to resources.

The module must be manually configured to load, as follows:

1. Create a configuration file in the /etc/httpd/conf.mudles.d directory.

2. Add the following line to the file:

   LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so

nginx:1.22 Updated With New Directive

The nginx:1.22 module stream includes the new ssl_pass_phrase_dialog directive. Use the directive to configure an external program that's called when nginx is start for each encrypted private key.

To use the new directive, add one of the following lines to the /etc/nginx/nginx.conf file:

• ssl_pass_phrase_dialog exec:<path_to_program>;

  Add this line if you're using an external program. This program is called for each encrypted private key file with two arguments:

  • Server name

  • One of the following algorithms: RSA, DSA, EC, DH, or UNK if a cryptographic algorithm can't be recognized.

• ssl_pass_phrase_dialog builtin;

  Add this line to manually enter a passphrase for each encrypted private key file. Entering a passphrase is the default behavior when ssl_pass_phrase_dialog isn't configured.

• ssl_pass_phrase_dialog exec:/usr/libexec/nginx-ssl-pass-dialog;

  Add this line to use this helper script so you can enter a passphrase for each encrypted private key at the nginx service start when you use the systemctl command.

Redis 7 Module Stream Introduced

Redis 7 is now available as a new module stream called redis:7. Changes from Redis 6 include the following:

• Server-side scripting in the Redis Functions API

• Fine-grained access control lists (ACLs)

• Shared publish/subscribe (pub/sub) functionality for clusters

• New commands and command arguments

Some Redis 7 features are incompatible with earlier versions, such as the following:

• Redis 7 now stores append-only files (AOF) as several files in a folder.

• Redis 7 uses a new version format for Redis Database (RDB) files.

For a complete list of features and incompatible changes, see the upstream release notes.

To install the redis:7 module stream, issue the following command:

sudo dnf module install redis:7

For information about the length of support for the redis Application Streams, see Oracle Linux: Product Life Cycle Information.

glibc Performance Enhancement for Intel Xeon V5 Hardware

The default amount of cache used by glibc for string and memory routines is tuned to improve performance on Intel Xeon v5 hardware.

System GCC Compiler Updated to Version 11.4.1

The GNU Compiler Collection (GCC) provides tools for developing applications with the C, C++, and Fortran programming languages. Its system GCC compiler is now updated to version 11.4.1.

GCC Preserves Register Arguments

GCC is updated to preserve register argument content and generate proper Call Frame Information (CFI) to make it easier for the unwinder to find this information without negatively impacting performance.

GCC Toolset 13

GCC Toolset 13 is a compiler toolset that provides recent versions of development tools. The toolset is available as an Application Stream in the form of a Software Collection in the AppStream repository.

The following tools and versions are available in the GCC Toolset 13:

• GCC 13.1.1
• GDB 12.1
• binutils 2.40
• dwz 0.14
• annobin 12.20

To install the toolset, type:

sudo dnf install gcc-toolset-13

To run a tool from GCC Toolset 13, type:

$ scl enable gcc-toolset-13 tool

To run a shell session where tool versions from GCC Toolset 13 override system versions of these tools, type:

scl enable gcc-toolset-13 bash

bintuils Updated to Version 2.40 in GCC Toolset 13

The GCC Toolset 13 includes version 2.40 of binutils which includes the following notable changes:

• Added a -w (--no-warnings) option for the linker to disable warning messages.

• Improved warning messages in the ELF linker for notifications around permissions changes.

• Added a --private option in the objdump tool that shows the fields in the file header and section headers for Portable Executable (PE) format files.
• Added a --show-all-symbols option for the objdump tool to show all symbols matching an address when disassembling.
• Added a --strip-section-headers option for the objcopy and strip tools to remove the ELF section header from ELF files.
• Added a -W (--no-weak) option to the nm tool to set it to ignore weak symbols.

• Added syntax highlighting for disassembler output in the objdump tool.

libabigail Updated to Version 2.3

libabigail version 2.3 includes the following features:

• Works with the BTF debuginfo format.

• Improvements to Ada range types.

• Availability of new [allow_type] directive in suppression specifications.

• Addition of new properties for the [supress_type] suppression specification.

• Update of the ABIXML to version 2.2.

• Change of the SONAME of the library to reflect its own ABI change.

New Flag Available in debugedit Utility

In the debugedit utility, the find-debuginfo script can be configured with the -q (--quiet) flag to silence non error output from the script.

systemtap Updated to Version 4.9

This updated version include the following changes:

• A new Language-Server-Protocol (LSP) backend for easier interactive drafting of systemtap scripts on LSP-capable editors.

• Access to a Python/Jupyter interactive notebook frontend.

• Improved handling of DWARF 5 bitfields.

elfutils Updated to Version 0.189

Notable features include the following:

• In libelf, the elf_compress tool accepts the ELFCOMPRESS_ZSTD ELF compression type.

• In libdwfl, the dwfl_module_return_value_location function returns 0 (no return type) for DWARF Information Entries (DIEs) that point to a DW_TAG_unspecified_type type tag.

• In eu-elfcompress, the -t and --type= options can handle the Zstandard (zstd) compression format through the zstd argument.

libpfm Updated to Version 4.13

This version provides access to performance monitoring hardware native events for a wider range of processor microarchitectures, including ARM Neoverse, AMD Zen 4, and 4th Generation Intel Xeon processors.

LLVM Toolset Updated to Version 16.0.6

In this version, some enhancements include the following:

• Improved optimization

• Addition of new CPU extensions

• Improvements for new C++ versions.

This version also includes changes that are incompatible with earlier versions, such as the following:

• Clang’s default C++ standard is gnu++17 instead of gnu++14.

• The following options default to error for the C code and might affect the behavior of configure scripts:

  • -Wimplicit-function-declaration

  • -Wimplicit-int

  • -Wincompatible-function-pointer-types

By default, Clang 16 uses the libstdc++ library version 13 and binutils 2.40 provided by GCC Toolset 13.

Rust Toolset Updated to Version 1.71.1

The updated version includes the following features:

• A new implementation of multiple producer, single consumer (mpsc) channels to improve performance

• A new Cargo sparse index protocol for more efficient use of the crates.io registry

• New OnceCell and OnceLock types for one-time value initialization

• A new C-unwind ABI string to enable usage of forced unwinding across Foreign Function Interface (FFI) boundaries

Further, the following compiler options for Rust profiler_builtins runtime component are available:

• -C instrument-coverage for coverage profiling

• -C profile-generate for profile-guided optimization

sos Utility Updated to Version 4.6

The Supportability and Serviceability (sos) utility for collecting configuration, diagnostic, and troubleshooting data is updated to Version 4.6 with enhancements such as the following:

• Improvements to the reporting and logging methods that aid in troubleshooting.
• Fixes in gathering of cgroup data and other information for generation of reports.
• Fixes that improve security in the manner that usernames, passwords, and other sensitive data are handled when data is collected for reports.

For details on each release of sos, see upstream release notes.