2 New Features and Changes
This chapter describes the new features, major enhancements, bug fixes, and other changes that are included in this release of Oracle Linux 8.
Installation
The following installation changes are introduced in Oracle Linux 8.5:
-
Capability for overriding official repositories added
The
osbuild-composer
backend includes a set of official repositories that are defined in the/usr/share/osbuild-composer/repositories
directory by default; but, it does not inherit the system repositories that are located in the/etc/yum.repos.d/
directory. However, in this release, you can override the official repositories by defining overrides in the/etc/osbuild-composer/repositories
directory. As a result. the files that are located in this directory take precedence over those in the/usr
directory. -
Graphical installation program displays warnings about deprecated kernel boot arguments
Graphical installation program boot arguments that do not contain the
inst.
prefix, such asks
,stage2
,repo
, and so on, are deprecated as of Oracle Linux 7, with the intent to remove these arguments in the next major Oracle Linux release.Starting with Oracle Linux 8.4, warning messages are displayed by the graphical installation program whenever any boot arguments that do not contain the
inst.
prefix are used, as appropriate.For example, the following warnings are displayed in
dracut
when booting the installation:ks has been deprecated. All usage of Anaconda boot arguments without the inst. prefix have been deprecated and will be removed in a future major release. Please use inst.ks instead.
When the installation program has started in a terminal window, the following warnings are displayed:
Deprecated boot argument ks must be used with the inst. prefix. Please use inst.ks instead. Anaconda boot arguments without inst. prefix have been deprecated and will be removed in a future major release.
Red Hat Compatible Kernel
The following notable features, enhancements, and changes apply to the Red Hat Compatible Kernel (RHCK) that is shipped with Oracle Linux 8.5 on the x86_64 platform.
For the latest information about Unbreakable Enterprise Kernel Release 6 (UEK R6), which is shipped with Oracle Linux 8.5, see Unbreakable Enterprise Kernel: Release Notes for Unbreakable Enterprise Kernel Release 6 Update 3 (5.4.17-2136).
schedutil CPU governor available in RHCK and UEK R6
In Oracle Linux 8.5, the schedutil
CPU frequency
governor is available for both RHCK and UEK R6. This feature
leverages utilization data from the CPU scheduler to
appropriately adjust CPU frequency settings and performance
state. The schedutil
governor is capable of
accessing the scheduler’s internal data structures directly
and can control how the CPU raises and lowers its frequency in
response to system load.
Note that the schedutil
governor feature is
not enabled by default and must be manually enabled.
igc Driver Included
The igc
Intel 2.5G Ethernet Linux wired
local area network (LAN) driver, which was previously
introduced in Oracle Linux 8.1 as a technology preview, is supported on
all architectures, starting with Oracle Linux 8.4. Note that the
ethtool command that is used to control
network driver and hardware settings also includes support for
igc
wired LANs.
EDAC for Intel Sapphire Rapids Processors Enabled
This enhancement provides Error Detection And Correction (EDAC) device support for Intel Sapphire Rapids processors. EDAC mainly handles Error Code Correction (ECC) memory and detects and reports PCI bus parity errors.
Note that this feature is already enabled in Unbreakable Enterprise Kernel Release 6.
Software Management
The following software management features and enhancements are introduced in Oracle Linux 8.5:
-
RPM includes read-only support for sqlite database back end
When inspecting other root directories, such as containers, you might want to query an RPM that is based on the
sqlite
database backend. Oracle Linux 8.5 includes read-only support for the RPMsqlite
database back end, which means you can query the packages that are installed in a container directly from the Oracle Linux 8 host.To perform this type of query with Podman, mount the container’s file system by using podman mount command, then run the rpm -qa command with the
--root
option and point to the mounted location.Note that RPM on Oracle Linux 8 continues to use the Berkeley DB database (
bdb
) back end. -
libmodulemd updated to version 2.13.0
The
libmodulemd
packages have been updated to version 2.13.0. This version oflibmodulemd
includes fixes for several issues with the modulemd-validator command, as well as the following improvements over the previous version:-
Capability for delisting demodularized packages from a module.
-
Capability for validating
modulemd-packager-v3
documents by specifying the new --type
option with the modulemd-validator command. -
Fortified parsing integers.
-
-
sslverifystatus added to dnf configuration
Starting with this release, enabling the
sslverifystatus
option causes the dnf command to each server certificate revocation status by using the Certificate Status Request TLS extension (OCSP stapling). As a result, when a revoked certificate is encountered, the dnf command refuses the download from its server. -
libcomps-devel package moved to ol8_codeready_builder repository
The
libcomps-devel
package was moved by upstream from theol8_baseos
repository to theol8_codeready_builder
repository between Oracle Linux 8.4 and Oracle Linux 8.5. If you were using this package previously, you may need to enable theol8_codeready_builder
repository to resolve any potential update issues.
Shells and Command-Line Tools
The following shells and command-line tools features and improvements are introduced in Oracle Linux 8.5:
-
Errors when restoring LVM with thin pools is fixed
This enhancement enables Relax-and-Recover (ReaR) to detect when thin pools and other logical volume types with kernel metadata, such as RAIDs and caches, are used in a volume group (VG). ReaR then switches to a mode where it recreates all of the logical volumes (LVs) in the VG by using lvcreate commands. Thus, LVM with thin pools are restored without producing any errors.
Note:
The new method does not preserve all the LV properties, such as LVM UUIDs. Before you use ReaR in a production environments, you should test restoring from the backup to determine whether the recreated storage layout matches the requirements.
-
FCoE option changed to rd.fcoe
The rd.nofcoe=0 command has been changed to rd.fcoe in Oracle Linux 8.5. In previous releases, the
dracut.cmdline(7)
manual page documented using the rd.nofcoe=0 command to turn off Fibre Channel over Ethernet (FCoE). Starting with this release, you should use the rd.fcoe=0 command to disable FCoE. -
lsvpd updated to version 1.7.12
The
lsvpd
package has been updated to version 1.7.12 in this release. Notable bug fixes and enhancements in this version oflsvpd
include the following:-
UUID property added in
sysvpd
. -
Improvements to the NVMe firmware version.
-
Fix for the PCI device manufacturer parsing logic.
-
Added
recommends clause
to thelsvpd
configuration file.
-
-
modulemd-tools package added
The
modulemd-tools
package is introduced in Oracle Linux 8.5. This package provides tools for parsing and generatingmodulemd
YAML files. To install the package, use the dnf install modulemd-tools command. -
opencryptoki updated to version 3.16.0
The
opencryptoki
package has been updated to version 3.16.0 in this release. This version ofopencryptoki
includes several bug fixes and the following improvements over the previous version:-
Improvements to the
protected-key
option and support forattribute-bound keys
in the EP11 core processor -
Improvements to the import and export of secure key objects in the
cycle-count-accurate
(CCA) processor.
-
-
ppc64-diag updated to version 2.7.1
The
ppc64-diag
package has been updated to version 2.7.7 in this release. This version ofppc64-diag
includes the following improvements:-
Unit test cases have been improved.
-
UUID property is added in
sysvpd
. -
The
rtas_errd
service does not run in Linux containers. -
Obsolete logging options removed from the
systemd
service files.
-
-
ReaR updated to version 2.6
The ReaR feature has been updated to version 2.6 in this release. This version of ReaR includes several notable improvements over the previous version.
Compilers and Development Toolsets
Oracle Linux 8.5 introduces the following features, enhancements, and changes to compilers and development toolsets.
-
Go Toolset updated to version 1.16.6
The Go Toolset has been updated to version 1.16.6. The following are some of the notable changes that have been made:
-
The
GO111MODULE
environment variable is set toon
by default. You can revert this setting by changing the variable's value toauto
. -
The Go linker uses less resources and improves code robustness and maintainability. This improvement applies to all supported architectures and operating systems.
-
A new
embed
package has been added. With this package, you can access embedded files while compiling programs. -
All of the functions of the
io/ioutil
package have been moved to theio
andos
packages. You an still use theio/ioutil
package; however, theio
andos
packages provide better definitions. -
The Delve debugger has been updated to version 1.6.0. This version of the Delve debugger supports the Go 1.16.7 Toolset.
-
-
Rust Toolset updated to version 1.54.0
The Rust Toolset has been updated to version 1.54.0. This version of the Rust Toolset included the following changes:
-
The Rust standard library is available for the
wasm32-unknown-unknown
target. This enhancement enables you to generate WebAssembly binaries, including newly stabilized intrinsics. -
Rust includes the
IntoIterator
implementation for arrays. This enhancement enables you to use theIntoIterator
trait to iterate over arrays by value and pass arrays to methods. Note, however, that thearray.into_iter()
still iterates values by reference until the 2021 edition of Rust. -
The syntax for
or
patterns allows for nesting anywhere in the pattern, for example,Pattern(1|2)
can be used instead ofPattern(1)|Pattern(2)
. -
Unicode identifiers can contain all valid identifier characters, as defined in the Unicode Standard Annex #31.
-
Methods and trait implementations have been stabilized.
-
Incremental compilation has been reenabled by default.
-
-
LLVM Toolset updated to version 12.0.1
The LLVM Toolset has been updated to version 12.0.1. A new compiler was added and several changes were made to existing compilers. The following are the notable changes that were made in this version of the tool:
-
The new
-march=x86-64-v[234]
complier flag has been added. -
The
-fasynchronous-unwind-tables
compiler flag, which is part of theclang
compiler, is the default on Linux AArch64/PowerPC. -
The
clang
compiler includes support for the C++20 likelihood attributes. -
The new
tune-cpu
function attribute has been added. This function attribute enables microarchitectural optimizations to be applied independently from thetarget-cpu
attribute or TargetMachine CPU. -
The new sanitizer,
-fsanitize=unsigned-shift-base
, has been added to the integer sanitizer,-fsanitize=integer
, for improved security. -
Code generation on PowerPC targets has been optimized.
-
The WebAssembly back end is now enabled in LLVM. This enhancments enables you to generate WebAssembly binaries with LLVM and Clang.
-
For debugging .NET applications, use the lldb debugger. For other languages, use the gdb debugger.
-
-
CMake updated to version 3.20.2
CMake has been updated to version 3.20.2. Notable changes that are included in this version of CMake include the following:
-
C++23 compiler modes can be specified by using the
CXX_STANDARD
,CUDA_STANDARD
, andOBJCXX_STANDARD
target properties or by using thecxx_std_23
meta-feature of the compile features function. -
CUDA language support allows the NVIDIA CUDA compiler to be a symbolic link.
-
Intel oneAPI NextGen LLVM compilers are supported with the
IntelLLVM
compiler ID. -
CMake can facilitate cross compiling for Android by merging with the Android NDK’s toolchain file.
-
When using
cmake(1)
to generate a project build system, unknown command-line arguments that begin with a hyphen are rejected.
-
-
GCC Toolset 11: dwz suppors DWARF 5
Staring with GCC Toolset 11,
dwz
includes support for DWARF 5. -
SystemTap updated to verison 4.5
SystemTap has been updated to to version 4.5. This version of SystemTap includes several bug fixes and other improvements, including the following:
-
32-bit floating-point variables are automatically widened to double variables. As a result, they can be accessed directly as
$context
variables. -
enum
values can be accessed as$context
variables. -
The BPF uconversions tapset has been extended to include more tapset functions for accessing values in user space, such as
user_long_error()
. -
Concurrency control is significantly improved to provide more stable operatiosn on large servers.
-
-
elfutils updated to version 0.185
The
elfutils
packages have been updated to version 0.185. Several bug fixes and the following notable improvements have been made in this version:-
The
eu-elflint
andeu-readelf
tools can recognize and show theSHF_GNU_RETAIN
andSHT_X86_64_UNWIND
flags on ELF sections. -
The
DEBUGINFOD_SONAME
macro is added todebuginfod.h
. You can use this macro with thedlopen
function to load thelibdebuginfod.so
library dynamically from an application. -
The
debuginfod_set_verbose_fd
function has been added to thedebuginfod-client
library. This function enhances thedebuginfod_find_*
queries functionality by redirecting the verbose output to a separate file. -
Setting the
DEBUGINFOD_VERBOSE
environment variable shows additional information about to which servers thedebuginfod
client is connected, as well HTTP responses of those servers. -
The
debuginfod
server includes a new thread-busy metric and more detailed error metrics, which makes it easier to inspect processes that run on thedebuginfod
server. -
The
libdw
library transparently handles theDW_FORM_indirect
location value, which enables thedwarf_whatform
function to return the actual FORM of an attribute. -
The
debuginfod-client
library stores negative results in a cache, and client objects can reuse an existing connection, which reduces network traffic.
-
-
Valgrind updated to version 3.17.0
Valgrind has been updated to version 3.17.0. This version of Valgrind introduces several bug fixes and enhancements. A few of the more notable improvements include the following: Valgrind can read DWARF Version 5 debugging format, support for debugging queries to the
debuginfod
server, and partial support for ARMv8.2 processor instructions. -
New pcp-ss PCP utility
The new
pcp-ss
PCP utility is added in this release. The utility reports socket statistics that are collected by thepmdasockets(1)
PMDA. The command is compatible with severalss
command-line options and reporting formats. The utility also provides the advantages of local and remote monitoring, in live mode and historical replay, from a previously recorded PCP archive. -
PCP updated to 5.3.1
The Performance Co-Pilot (PCP) package has been updated to version 5.3.1. This release includes bug fixes, enhancements, and new features, including the following: scalability improvements, resolved memory leaks in the
pmproxy
service and thelibpcp_web
API library, a newpcp-ss
tool for historical socket statistics, improvements to thepcp-htop
tool, and extensions to the over-the-wire PCP protocol, which supports higher resolution timestamps. -
pcp-container package updated to version 5.3.1
The
pcp-container
package has been updated to version 5.3.1 in this release. -
grafana package updated to version 7.5.9
The
grafana
package has been updated to version 7.5.9 in this release. Notable new features enhancements include the following: a new time series panel (beta), a new pie chart panel (beta), altering support for Loki, and multiple new query transformations. -
grafana-container package updated to version 7.5.9
The
grafana-container
packages have been updated to version 7.5.9 in this release. Notable new features enhancements include the following:-
The
grafana
package is updated to version 7.5.9. -
The
grafana-pcp
package is updated to version 3.10. -
The container includes support for the
GF_INSTALL_PLUGINS
environment variable for installing custom Grafana plugins at container start-up.
-
-
grafana-pcp package updated to version 3.10.0
The
grafana-pcp
package has been updated to version 3.1.0. Notable improvements include the following:-
Performance Co-Pilot (PCP) Vector Checklist dashboards use a new time series panel, show units in graphs, and contain updated help texts.
-
Addition of the
pmproxy
URL andhostspec
variables to PCP Vector Host Overview and PCP Checklist dashboards. -
All dashboards display datasource selection.
-
Marking all included dashboards as read-only.
-
Added compatibility with Grafana 8.
-
GCC Toolset 11
Oracle Linux 8.5 provides the GCC Toolset 11, which is an Application
Stream that is distributed in the form of a Software Collection
in the AppStream
repository. The GCC Toolset
is similar to the Oracle Linux Developer Toolset.
In Oracle Linux 8.5, the GCC compiler is updated to the upstream version. The following tools have been updated since GCC Toolset 10:
-
GCC version 11.1.1
-
GDB version 10.1
-
Valgrind version 3.17.0
-
SystemTap version 4.5
-
Dyninst version 10.2.1
-
binutils
version 2.36.1 -
elfutils
version 0.184 -
dwz
version 0.14 -
annobin
version 9.69
See Compilers and Development Toolsets for further details about notable changes that have been made to some of the tools that are in GCC Toolset 11.
The GCC Toolset 11 is available as an Application Stream within
the AppStream
repository, in the form of a
Software Collection.
To install this toolset, use the following command:
sudo dnf install gcc-toolset-11
To run a tool from GCC Toolset 11, use the following command:
scl enable gcc-toolset-11 tool
The following command initiates a shell session, where tool versions from the GCC Toolset 11 take precedence over system versions of the same tools:
scl enable gcc-toolset-11 bash
Dynamic Programming Languages, Web, and Database Servers
Oracle Linux 8.5 includes several feature changes and improvements for dynamic programming languages and web and database servers. Note that that this release also introduces several new and improved module streams:
-
ruby:3.0 module stream added
Oracle Linux 8.5 includes Ruby version 3.0.2 in a new
ruby:3.0
module stream. Ruby 3.0.2 includes several performance improvements, bug and security fixes, and new features, compared with Ruby version 2.7 that was previously available. This version of Ruby includes the following significant features:-
Concurrency and parallelism features.
-
Static analysis features.
-
Pattern matching with the
case/in
expression is no longer experimental. -
One-line pattern matching has been redesigned. This feature is an experimental feature.
-
The find pattern is added as an experimental feature.
-
Pasting of long code to the
Interactive Ruby Shell (IRB)
is significantly faster. -
The measure command has been added to IRB for time measurement.
-
Changes to keyword arguments, which are now separated from other arguments.
-
The default directory for user-installed gems has changed to
$HOME/.local/share/gem/
, unless the$HOME/.gem/
directory already exists.
-
-
Default separator for Python urllib parsing functions has changed
The default separator for the
urllib.parse.parse_qsl
andurllib.parse.parse_qs
functions has been changed from the ampersand (&
) and semicolon (;
) to just an ampersand. These changes were made to mitigate the Web Cache Poisoning CVE-2021-23336 in the Pythonurllib
library.This change, which was introduced in Python 3.6 with Oracle Linux 8.4, is now being backported to Python 3.8 and Python 2.7. Note that Python 3.9 is unaffected, as it already includes the new default separator.
Note:
Because this change is potentially backwards incompatible, you have the option to configure the behavior in Python packages, where the default separator has been changed. Note also that the affected
urllib
parsing functions emit a warning if it is detected that a customer’s application is affected by the change. -
Python ipaddress module changes
The Python
ipaddress
module has been updated to reject IPv4 addresses with leading zeros, with anAddressValueError: Leading zeros are not permitted
error. This change was made to mitigate CVE-2021-299221.This change was introduced in
python38
andpython39
modules. Note that previous Python modules are not impacted by CVE-2021-299221.If you rely on the previous behavior, you can pre-process your IPv4 address inputs to strip the leading zeros off as follows:
>>> def reformat_ip(address): return '.'.join(part.lstrip('0') if part != '0' else part for part in address.split('.')) >>> reformat_ip('0127.0.0.1') '127.0.0.1'
To strip off the leading zeros with an explicit loop for readability, use the following:
def reformat_ip(address): parts = [] for part in address.split('.'): if part != "0": part = part.lstrip('0') parts.append(part) return '.'.join(parts)
-
php:7.4 module stream updated to version 7.4.19
The PHP scripting language, which is included in the
php:7.4
module stream, has been updated to version 7.4.19 in this release. With this update, multiple security and bug fixes have been implemented. -
pg_repack package added
The new
pg_repack
has been added to thepostgresql:12
andpostgresql:13
modules. This package provides aPostgreSQL
extension that enables you remove bloat from tables and indexes, as well as optionally restore the physical order of clustered indexes. -
nginx:1.20 module added
The
nginx 1.20
web and proxy server is available as thenginx:1.20
module stream in Oracle Linux 8.5. This version provides numerous bug fixes, security fixes, enhancements, and new features over the previous version, including the following:-
Support for the client SSL certificate validation with Online Certificate Status Protocol (OCSP).
-
Support for cache clearing, based on the minimum amount of free space. Note that this feature is implemented as the
min_free
parameter of theproxy_cache_path
directive.
Other notable changes in the
nginx:1.20
module include enhanced directives, such as thessl_conf_command
andssl_reject_handshake
, andproxy_cookie_flags
, as well as improved support for HTTP/2. -
-
squid:4 module updated to version 4.15
The
Squid
proxy sserver, which is available in thesquid:4
module stream has been updated to version 4.15. This update includes several bug and security fixes over the previous version. -
quota command supports HPE XFS
This change enables users of HPE XFS to monitor and manage user and group disk usage by using the quota.
-
mutt updated to version 2.0.7
The Mutt email client has been updated to version 2.0.7 in this release. This version of
mutt
provides a number of enhancements and bug fixes, as well as added supported for the following:-
The
OAuth 2.0
authorization protocol by using theXOAUTH2
mechanism. Mutt also supports theOAUTHBEARER
authentication mechanism for the IMAP, POP, and SMTP protocols. -
Domain-literal email addresses such as
user@[IPv6:fcXX:…]
-
New
$imap_deflate
variable that supportsCOMPRESS=DEFLATE
compression. Note that this variable is disabled by default. -
$ssl_starttls
variable no longer controls aborting an unencrypted IMAPPREAUTH
connection. Instead, use the$ssl_force_tls
variable if you rely on theSTARTTLS
process.
Note:
After updating to the new Mutt version, the
ssl_force_tls
configuration variable still defaults tono
, which is designed prevent problems in existing environments. Note also in the upstream version of Mutt,ssl_force_tls
is enabled by default. -
File Systems and Storage
Oracle Linux 8.5 provides the following file systems and storage features, enhancements, and changes:
-
Btrfs removed from RHCK
The Btrfs file system is removed from RHCK in Oracle Linux 8. As such, you cannot create or mount Btrfs file systems when using this kernel. Also, note that any Btrfs user space packages that are provided are not supported with RHCK.
Note:
Support for the Btrfs file system is enabled in UEK R6; starting with Oracle Linux 8.3, you have the option to create a Btrfs root file system during an installation, as well as select Btrfs as the file system type when formatting devices. See Oracle Linux 8: Installing Oracle Linux for more information about this feature.
For more information about managing a Btrfs root file system, see Oracle Linux 8: Managing Local File Systems.
For the latest enhancements that have been made to Btrfs in UEK R6, see Unbreakable Enterprise Kernel: Release Notes for Unbreakable Enterprise Kernel Release 6 Update 3 (5.4.17-2136).
-
OCFS2 removed from RHCK
The Oracle Cluster File System version 2 (OCFS2) file system is removed from RHCK in Oracle Linux 8. As such, you cannot create or mount OCFS2 file systems when using this kernel. Also, any OCFS2 user space packages that are provided are not supported with RHCK.
Note:
OCFS2 is fully supported with UEK R6 in Oracle Linux 8.5.
-
NVMe/TCP included as a Technology Preview
NVMe over Fabrics TCP host and the target drivers are included in RHCK as a technology preview in this release.
Note:
Support for NVMe/TCP is already available in Unbreakable Enterprise Kernel Release 6.
High Availability and Clusters
The following high availability and clustering features are included in Oracle Linux 8.5:
-
Local mode version for pcs cluster setup command added
Support for the local mode version of the pcs cluster setup command has been added in this release.
-
fence_watchdog agent enables watchdog-only SBD configuration on subset of cluster nodes
This release includes a new
fence_watchdog
agent for configuring a watchdog-only SBD setup. Because this capability did not exist previously, it prevented the use of SBD in a cluster where some nodes supported it, but others (most often remote nodes) required some other form of fencing. -
pcs command for updating SCSI fencing device
A new pcs command for updating a SCSI fencing device without causing the restart of all other resources has been added.
-
Reduced output display option added to pcs resoure safe-disable command
The reduced output display option has been added to the pcs resource safe-disable command
-
pcs command accepts Promoted and Unpromoted role names
With this update, the pcs command accepts the
Promoted
andUnpromoted
role names. -
pcs resoure status display commands added
This update introduces new pcs resource status display commands.
-
LVM volume group flag added
A new LVM volume group flag for controlling auto-activation has been added in this release.
Infrastructure Services
Oracle Linux 8.5 introduces several version updates to infrastructure and command-line tools, including the following features:
-
linuxptp updated to version 3.1
The
linuxptp
package has been updated to version 3.1. Notable enhancements include thets2phc
program for synchronizing the Precision Time Protocol (PTP) hardware clock to Pulse Per Second (PPS) signal, and added support for the automotive profile and client event monitoring. -
chrony updated to version 4.1
The
chrony
package has been updated to version 4.1 in this release. Notable changes in this version ofchrony
include the following:-
Added support for Network Time Security (NTS) authentication.
-
The Authenticated Network Time Protocol (NTP) sources are trusted over non-authenticated NTP sources by default in this update. To restore the original behavior, add the
autselectmode ignore
argument to thechrony.conf
file. -
Support is no longer available for authentication with the following
RIPEMD
keys:RMD128
,RMD160
,RMD256
, andRMD320
. -
Support for long, non-standard MACs in NTPv4 packets is no longer available. If you are using the
chrony 2.x
,non-MD5/SHA1
keys, you need to configurechrony
by using theversion 3
option.
-
-
PowerTop updated to version 2.14
PowerTop has been updated to version 2.14 in this release. This update provides support for the Alder Lake, Sapphire Rapids, and Rocket Lake platforms.
-
kdumpctl updated to provide an estimate utility
The kdumpctl command features an estimate subcommand. Running the kdumpctl estimate command provides a recommended
crashkernel
value that is based on the current kdump setup and includes additional details on memory usage. -
Intel® QuickAssist Technology Library user space package updated to version 21.05
The Intel® QuickAssist Technology Library (QATlib) user space package and the
qatlib
user space libraries that allow access to Intel QuickAssist devices and expose the Intel QuickAssist APIs, have been updated to version 21.05. -
Tuned moves unnecessary IRQs to housekeeping CPUs
Network device drivers such as
i40e
,iavf
, andmlx5
evaluate online CPUs to determine the number of queues andMSIX
vectors to be created. Previously, for low-latency environments consisting of a large number of isolated and very few housekeeping CPUs, any attempts by Tuned to move these device IRQs to housekeeping CPUs failed, due to the per-CPU vector limit.With this enhancement, Tuned explicitly adjusts the numbers of network device channels, and MSIX vectors, as per the housekeeping CPUs. Therefore, all of the device IRQs on the housekeeping CPUs can be moved to achieve low latency.
Graphics Infrastructure
-
Intel's Tiger Lake graphics available
Intel's Tiger Lake graphics is made available in Oracle Linux 8.5 .
Networking
Oracle Linux 8.5 introduces the following networking features, enhancements, and changes:
-
firewalld updated to version 0.9.3
The
firewalld
package has been updated to version 0.9.3. This version offirewalld
includes numerous upstream bug fixes and improvements over version 0.8.2.Notably, this update includes the introduction of the policy object feature that allows forward and output filtering for virtual machines (VMs), containers, and zones. For further information, see https://firewalld.org/2020/09/policy-objects-introduction and https://firewalld.org/2020/09/policy-objects-filtering-container-and-vm-traffic.
-
NetworkManager updated to version 1.32.10
NetworkManager
has been updated to version 1.32.10. This version ofNetworkManager
includes numerous bug fixes and enhancements over the previous version. -
Capability for managing ethtool parameters added to NetworkManager
In certain cases, you need to explicitly set non auto-pause parameters on a specific network interface. In this release,
NetworkManager
includes capability for pausing the control flow parameters of ethtool innmstate
. Previously,NetworkManager
did not include this capability.To disable auto negotiation of the pause parameter and enable RX/TX pause support explicitly, use the following command:
sudo nmcli connection modify enp1s0 ethtool.pause-autoneg no ethtool.pause-rx true ethtool.pause-tx true
-
Property for setting physical and virtual interface in promiscuous mode added to Network Manager
The
802-3-ethernet.accept-all-mac-addresses
property for setting physical and virtual interfaces in theaccept all MAC addresses
mode has been added toNetworkManager
. With this enhancement, the kernel can accept network packages that are targeting current interfaces’ MAC address in theaccept all MAC addresses
mode.For example, to enable
accept all MAC addresses
mode oneth1
, use the following command:sudo nmcli c add type ethernet ifname eth1 connection.id eth1 802-3-ethernet.accept-all-mac-addresses true
-
nftables can be used as firewall back end in NetworkManager
This enhancement adds support for the
nftables
firewall framework to NetworkManager. To switch the default back end fromiptables
tonftables
, use the following commands:
Security
Oracle Linux 8.5 introduces the following security features, enhancements, and changes:
-
crypto-policies updated to 20210617
The
crypto-policies
packages have been updated to the upstream version 20210617. This version ofcrypto-policies
includes numerou bug fixes and improvements over the previous version. -
crypto-policies support for AES-192 ciphers in custom policies
In Oracle Linux 8.5, the system-wide cryptographic policies include support for the following values of the
cipher
option in the custom policies and subpolicies:AES-192-GCM
,AES-192-CCM
,AES-192-CTR
, andAES-192-CBC
. With this change, you an enable theAES-192-GCM
andAES-192-CBC
ciphers for the Libreswan application, as well as theAES-192-CTR
andAES-192-CBC
ciphers for thelibssh
library and the OpenSSH suite throughcrypto-policies
. -
CBC ciphers are disabled in the FUTURE cryptographic policy
IThe
crypto-policies
packages have been updated to disable ciphers that use cipher block chaining (CBC) mode in theFUTURE
policy. The settings in theFUTURE
policy should be able to withstand near-term future attacks; this change reflects the current progress. Consequently, system components that respectcrypto-policies
cannot use CBC mode when theFUTURE
policy is active. -
gnutls updated to version 3.6.16
The
gnutls
packages have been updated to version 3.6.16. The following notable enhancements and bug fixes are included:-
The
gnutls_x509_crt_export2()
function returns0
value instead of the size of the internal base64 blob in the event of success. This change aligns with the documentation in thegnutls_x509_crt_export2(3
) manual page. -
Certificate verification failures due to the Online Certificate Status Protocol (OCSP) must-stapling not being followed are correctly marked with the
GNUTLS_CERT_INVALID
flag. -
Version negotiation for TLS 1.2 has been fixed and TLS 1.2 can now be correctly disabled. Previously, if TLS 1.2 was explicitly disabled by using the
-VERS-TLS1.2
option, the server continued to offer TLS 1.2, even if TLS 1.3 was enabled
-
-
Kernel AVC tracepoint added
This enhancement introduces a new
avc:selinux_audited
kernel tracepoint that triggers when an SELinux denial is to be audited. This tracepoint provides for a more convenient and low-level debugging of SELinux denials. Note that the new tracepoint is also available for tools like perf. -
libreswan updated to version 4.4
The
libreswan
packages have been updated to version 4.4. This version introduces important enhancements and bug fixes, including several IKEv2 andpluto
IKE daemon enhancements, most notably the following:-
IKEv2 protocol fixes and enhancements:
-
Fixes for TCP encapsulation in
Transport Mode
and host-to-host connections. -
--globalstatus
option added to theipsec whack
command for displaying redirect statistics. -
The
vhost
andvnet
values in theipsec.conf
configuration file are no longer allowed for IKEv2 connections.
-
-
pluto
IKE daemon fixes and enhancements:-
Fixes for host-to-host connections that use non-standard IKE ports.
-
The
interface-ip=
option is disabled because Libreswan does not provide the corresponding functionality yet. -
The
PLUTO_PEER_CLIENT
variable in theipsec__updown
script for NAT inTransport Mode
is fixed. -
Set the
PLUTO_CONNECTION_TYPE
variable totransport
ortunnel
. -
Non-templated wildcard ID connections can now match.
-
-
-
SCAP Security Guide updated to version 0.1.57
In Oracle Linux 8.5, the
scap-security-guide
packages have been updated to version 0.1.57. This version of the SCAP Security Guide provides several bug fixes and improvements over the previous version, including the following:-
Performance remediations for Audit improvements
Performance of remediations for Audit has been improved by grouping similar system calls. Previously, Audit remediations generated an individual rule for each system call tha was audited by the profile. This behavior led to large numbers of audit rules, which in turn, degraded performance. With this change, remediations for Audit can group rules together for similar system calls with identical fields into a single rule, which improves performance.
-
Profile for ANSSI-BP-028 High level added
The ANSSI High level profile, which is based on the ANSSI BP-028 recommendations from the French National Security Agency (ANSSI), is added in this release. This additional completes the availability of profiles for all ANSSI-BP-028 v1.2 hardening levels in the SCAP Security Guide. The new profile enables you to harden the system to the recommendations from ANSSI for GNU/Linux Systems at the High hardening level. Thus, you can configure and automate compliance of your Oracle Linux 8 systems to the strictest hardening level by using ANSSI Ansible Playbooks and ANSSI SCAP profiles.
-
-
OpenSCAP updated to version 1.3.5
The OpenSCAP packages have been updated to version 1.3.5. This version of OpenSCAP includes numerous fixes and other enhancements over the previous version.
-
Support for validating digitally signed SCAP source data streams
To conform with the Security Content Automation Protocol (SCAP) 1.3 specifications, OpenSCAP has been updated in Oracle Linux 8.5 to enable the validation of digital signatures for digitally signed SCAP source data streams. OpenSCAP also now validates the digital signature when evaluating a digitally signed SCAP source data stream. The signature validation is performed automatically while loading the file. Data streams with invalid signatures are rejected, and OpenSCAP does not evaluate their content. OpenSCAP uses the XML Security Library in conjunction with the OpenSSL cryptography library to validate the digital signature.
To skip the signature validation, add the
--skip-signature-validation
option to the oscap xccdf eval command.Caution:
OpenSCAP does not address the trustworthiness of certificates or public keys that are part of the
KeyInfo
signature element, which are used to verify the signature. As such, it is important that you verify such keys to prevent the evaluation of data streams that may have been modified and signed by bad actors. -
OpenSSL for encrypting Rsyslog TCP and RELP traffic
In this release, the OpenSSL network stream driver has been added to Rsyslog. This driver implements TLS-protected transport by using the OpenSSL library. This change provides added functionality, compared to the stream driver that uses the GnuTLS library. In addition, you can use either OpenSSL or GnuTLS as an Rsyslog network stream driver.
-
Rsyslog updated to version 8.2102.0-5
Rsyslog has been updated to version 8.2102.0-5. The version of Rsyslog provides numerous improvements over the previous version, including the following:
-
Added the
exists()
script function for checking whether a variable exists or not, for example$!path!var
-
Ability to set OpenSSL configuration commands with the new
tls.tlscfgcmd
configuration parameter for theomrelp
andimrelp
modules. -
Added two new rate-limit options to the
omfwd
module for rate-limitingsyslog
messages that are sent to the remote server:-
ratelimit.interval
: This option specifies the rate-limiting interval in seconds. -
ratelimit.burst
: This option specifies the rate-limiting burst in the number of messages.
-
-
The
immark
module has been rewritten to include various improvements. -
Added the
max sessions
configuration parameter to theimptcp
module. The maximum is measured per-instance, not globally, across all instances. -
Added the
rsyslog-openssl
subpackage. This network stream driver implements TLS-protected transport by using the OpenSSL library. -
Added per-minute rate limiting to the
imfile
module, with theMaxBytesPerMinute
andMaxLinesPerMinute
options. Note that these options accept integer values and limit the number of bytes or lines that are allowed to be sent in a minute. -
Capability added to the
imtcp
andomfwd
module to configure a maximum depth for the certificate chain verification by using thestreamdriver.TlsVerifyDepth
option.
-
-
socat updated to version 1.7.4
The
socat
packages have been updated to version 1.7.4. This version ofsocat
includes numerous bug fixes and improvements over version 1.7.3.
For information about security features that are related to networking, see Networking.
Supportability
-
SoS supportability feature updated to version 4.1
The
sos
package for the System of Systems (SoS) supportability feature has been updated to version 4.1.
Technology Preview
For the Red Hat Compatible Kernel in the current Oracle Linux 8 release, the following features are under technology preview:
kexec Fast Reboot
The kexec fast reboot feature is available
as a technology preview feature in Oracle Linux 8. This feature
significantly speeds up the boot process by enabling the
kernel to boot directly into the second kernel without having
to first pass through the Basic Input/Output System (BIOS). To
use this feature, load the kexec
module
first, then reboot the system.