New Features and Changes

2 New Features and Changes

Unless indicated otherwise, the following new features, major enhancements, bug fixes, and other changes that are introduced in this release of Oracle Linux 9 apply to both the x86_64 and 64-bit Arm (aarch64) platforms.

Installation and Boot

The following features, enhancements, and changes related to installation and boot are introduced in this release of Oracle Linux 9.

Graphical Installation Program Activates the Network Automatically During Interactive Installations

In the interactive installation mode that uses the graphical user interface, the network is automatically enabled. Manually activating the network is no longer required.

Note that this change does not impact the kickstart installations and installations that use the ip= boot option.

Licensing and User Setting Configuration Screens No Longer Part of Post Installation

Initial setup screens for licensing and for configuring users that previously appeared as post installation steps are now disabled. To restore these screens, run the following commands which install and enable the relevant packages, and then reboot the system. The initial setup screens appear when the boot up system is completed.

sudo dnf install initial-setup initial-setup-gui -y
systemctl enable initial setup
reboot

For kickstart installations, add and enable these packages as follows:

firstboot --enable
%packages
@^graphical-server-environment
initial-setup-gui
%end

Root Account Is Locked by Default

As an added security feature, the root account in an Oracle Linux 9 installation is locked by default. However, the installation program provides options for you to enable SSH root logins with appropriately set passwords during the installation. For instructions, see Oracle Linux 9: Installing Oracle Linux.

Kickstart Changes Have Been Implemented

The following changes in Oracle Linux 9 affect how you configure automatic installations that use kickstart:

All boot options must use the inst prefix; otherwise, those options are ignored. Add the prefix to previously configured standalone options to maintain their functionality.
The new timesource command replaces the previous timezone --ntpservers command, which has been deprecated.
The following kickstart commands and options are removed and generate errors if used:
- device
- deviceprobe
- dmraid
- install
  
  Instead, use the subcommands or methods directly as commands.
- multipath
- bootloader --upgrade
- ignoredisk --interactive
- partition --active
- harddrive --biospart
- autostep

Changes to Boot Options Implemented

The following changes were applied to some boot options:

inst.zram and inst.singlelang options are not supported in Oracle Linux 9.
inst.loglevel is always set to debug. Other log levels in previous Oracle Linux releases have been removed.

Kernel and System Libraries

The following notable features, enhancements, and changes apply to the Red Hat Compatible Kernel (RHCK) that's shipped with the current Oracle Linux 9 version.

RHCK Kernel Signed With Trusted Secure Boot Certificates

This feature eliminates the need to enroll a separate public key to use the kernel versions on systems that have UEFI Secure Boot enabled. Previous releases required you to enroll a separate public key by using the Machine Owner Key (MOK) facility.

Control Group Version 2 Enabled by Default

Version 2 of the control groups (cgroup-v2) is enabled together with version 1 (cgroup-v1).

cgroup-v2 implements a single hierarchy model to simplify the management of control groups. The model ensures that a process can only be a member of a single control group at a time. The feature is integrated with systemd and improves resource control configuration on an Oracle Linux system.

Note that feature incompatibilities exist between cgroup-v2 and cgroup-v1. Moreover, control interfaces are different between the two versions. Consequently, third-party software that has a direct dependency on cgroup-v1 might not run properly in the cgroup-v2 environment.

While both versions are enabled in the kernel, no default control group version is set in the kernel. Instead, the version that mounts at startup is determined by systemd.

To use cgroup-v1, add the following parameters to the kernel command line:

systemd.unified_cgroup_hierarchy=0
systemd.legacy_systemd_cgroup_controller

Kernel Changes Might Affect Third-Party Kernel Modules

Linux distributions with a kernel version prior to 5.9 included support for exporting GPL functions as non-GPL functions. This support enabled users to link proprietary functions to GPL kernel functions by using the shim mechanism. In this release, upstream changes have been incorporated into the kernel that enable Oracle Linux to enforce GPL more strictly. Accordingly, shim is now rebuffed.

Important:

Partners and independent software vendors (ISVs) should test their kernel modules with an early version of Oracle Linux 9 to ensure compliance with GPL.

Fixes to `strace` Utility

In this release, the strace utility correctly displays SELinux context mismatches through the extension of the utilities --secontext option. This extension is the mismatch parameter. See the following example:

[...]
$ strace --secontext=full,mismatch -e statx stat /home/user/file
statx(AT_FDCWD, "/home/user/file" [system_u:object_r:user_home_t:s0!!unconfined_u:object_r:user_home_t:s0], ...

$ strace --secontext=mismatch -e statx stat /home/user/file
statx(AT_FDCWD, "/home/user/file" [user_home_t:s0], ...

`perf-top` Capable of Sorting by a Specific Column

The perf-top system profiling tool can sort samples by an arbitrary event column instead of just the first column when multiple events in the group are sampled. Samples are sorted through the --group-sort-idx option, where you press a number key to sort the table by the data column that corresponds to that key. Column numbering starts from 0.

New Jigawatts Package Added

The new jigawatts package includes a Java library that works to improve the functionality of the Checkpoint/Restore in Userspace (CRIU) utility specifically on Java applications.

`trace-cmd reset` Behavior Change

Instead of disabling, trace-cmd reset now resets settings of the ftrace framework to their default values. This behavior specifically affects tracing_on, trace_clock, set_event_pid, and tracing_max_latency.

Support for Extended Berkeley Packet Filter

The Extended Berkeley Packet Filter (eBPF) is an in-kernel virtual machine that enables code execution in the kernel space in a restricted sandbox environment with access to a limited set of functions. The virtual machine executes a special assembly-like code.

Crash Utility 8.0.0

This version of the utility has a new offset parameter in the add-symbol-file command that helps to set the kaslr-offset to gdb. The parameter also upgrades gdb-7.6 to gdb-10.2.

Changes Implemented on `makedumpfile` Utility

The following enhancements and improvements are in the utility:

Support for the Zstandard compression capability

The utility is thus able to take advantage of zstd's high compression ratios which improve compression efficiency especially in large memory systems. The improved compression mechanism creates a smaller vmcore file within a reasonable compression time.
New options improve ways to obtain an estimate of the vmcore size

The following options can be used with the makedump command:
- --dry-run performs all operations specified by the command without writing the output file.
- --show-stats prints the report messages. This option is an alternative to enabling bit 4 that is provided to the --message-level option.
  
  The following shows an example in the use of these options:
```
sudo makedumpfile --dry-run --show-stats -l --message-level 7 -d 31 /proc/kcore dump.dummy
```

Support for `numatop` Utility for Intel Xeon Scalable Processors

numatop monitors and analyzes threads and processes running on Numa systems. It uses Intel performance counter sampling technologies and associates the performance data with Linux system runtime information for better analysis of Numa systems deployed in production.

New `crashkernel.default` File for `kdump` Memory Allocation

In the kexec-tools package, the new crashkernel.default file for kdump contains a default crash kernel value for the corresponding kernel build. kdump uses the value to control the default crash kernel memory value of each kernel.

crashkernel.default serves as a good reference for kdump memory reservation. By basing on this value, you can configure the desired setting for crashkernel=. Consequently, memory allocation for kdump is improved for systems that have less than 4 GB of available memory.

To query the default crashkernel value, type:

sudo kdumpctl get-default-crashkernel

For more details, refer to the /usr/share/doc/kexec-tools/crashkernel-howto.txt file.

Core Scheduling Functionality Added

The core scheduling functionality enables you to define groups of tasks that can share a CPU core, and thereby exclude tasks that should not trust each other from sharing the same resource. This feature enhances security by mitigating some cross-Symmetric Multithreading (SMT) attacks. It also isolates tasks that need a whole core, such as those that are performed in real-time environments or those that rely on specific processor features, such as Single Instruction, Multiple Data (SIMD) processing.

CPU Hot-Plug in `hv_24x7` and `hv_gpci` PMUs

PMU counters can correctly react to the hot plugging of a CPU, such that if an hv_gpci event counter is running on a CPU that becomes disabled, the counting redirects to another CPU.

IRDMA Driver Added

The IRDMA driver enables RDMA functionality on the following RDMA-capable Intel network devices:

Ethernet Network Adapter X722: an Internet Wide-area RDMA Protocol (iWARP) device.

This device supports only iWARP and a more limited set of configuration parameters.
Ethernet Controller E810: a device that supports iWARP and RDMA over Converged Ethernet (RoCEv2)

This device iWARP and RoCEv2 RDMA transports, Priority Flow Control (PFC), and Explicit Congestion Notification (ECN).

The IRDMA module replaces as well as extends the Application Binary Interface (ABI) defined for the legacy i40iw module for X722. The change is backward compatible with legacy X722 RDMA-Core provider (libi40iw).

`aarch64`: Default Page Size on Arm Platform Changed to 4 KB

Based on UEK R7 implementation, the default page size on the 64-bit Arm platform has changed from 64 KB to 4 KB. This new size pairs well with the workloads and memory amounts that exist on the majority of Arm-based systems. To use large page sizes efficiently, ensure that you specify the huge pages option, which addresses a greater amount of memory for workloads with large data sets.

`aarch64`: `kexec_file_load` Enabled by Default

For systems using the 64-bit Arm architecture, the added kexec_file_load system call provides an in-kernel kexec loader for kdump which enables an unsigned kernel to work correctly. Prior to this update, an unsigned kernel failed to load with secure boot enabled and kexec_file_load() specified.

`aarch64`: Armv8-R Architecture Supported

The architecture is supported through the -march=armv8-r option of the improved GCC 11.2.1.

Operating System and Software Management

The following features, enhancements, and changes related to the OS and software management are introduced in this Oracle Linux 9 release.

RPM Updated to Version 4.16

The updated version includes notable changes such as the following:

Support for new SPEC features such as caret version operator, %autopatch for specifying patch ranges, meta or unordered dependencies, generation of dynamic build dependencies through the %generate_buildrequires section, and so on.
RPM is fully based on the sqlite library. For Berkeley DB databases, Read-only support is provided.
rpm-audit-plugin is a new plugin for recording audit log events on transactions.
Validation of UTF-8 headers is performed at build time.
Increased parallelism is applied in package builds.

New RPM Plugin Notifies `fapolicyd` About Changes During RPM Transactions

Updated rpm packages include a new RPM plugin that integrates the fapolicyd framework with the RPM database. By informing fapolicyd about any installed and changed files during an RPM transaction, the plugin enables fapolicyd to support integrity checking. The plugin's functionality extends its coverage beyond just Yum transactions to changes made by RPM as a whole. Thus, the plugin is effectively a replacement to the Yum plugin.

Support for Signing Keys Using EdDSA Public Key Algorithm

This added support to the rpm command enables you to use EdDSA-generated keys for signing and verifying packages. However, RSA continues to be the default public key algorithm in GnuPG.

RPM Supports ZSTD Algorithm

RPM supports the Zstandard (zstd) compression algorithm, which makes package installations faster, especially in large transactions. Oracle Linux 9 uses Zstandard as the default compression algorithm.

New Options Available for DNF

The following are new DNF options:

exclude_from_weak_autodetect automatically detects unwanted weak dependencies of packages being installed. Thus, providers of the weak dependencies are not installed as weak dependencies. However, if pulled in, these weak dependencies are installed as regular dependencies. The option is enabled by default.
exclude_from_weak prevents the installation of packages as weak dependencies.

`libmodulemd` Packages Updated to Version 2.13.0

This version of libmodulemd packages includes the following features and changes:

Support for delisting demodularized packages from a module.
Support for validating modulemd-packager-v3 documents by using modulemd-validator --type, where --type is a new option.
Fortified parsing integers.

Shells and Command Line Tools

The following features, enhancements, and changes related to shells and command line tools are introduced in this Oracle Linux 9 release.

`bash` Library Version 8.1

In this library, bracketed paste mode is enabled by default. This mode causes text that you paste on your terminal to be highlighted and requires you to press Enter to execute the command in the text. This feature prevents you from executing malicious commands.

To disable the feature, add the following line to either $HOME/.inputrc or /etc/inputrc:

set enable-bracketed-paste off

If added to $HOME/.inputrc, the feature is disabled for a specific user.
If added to /etc/inputrc, the feature is disabled for all users.

Disabling the feature causes pasted commands on the terminal to be immediately executed.

Additional Shell Related Packages Available With Updated Versions

opal-prd 6.7.1
lvspd 1.7.12
Fetchmail 6.4.24
Eigen 3.4

New `cdrskin` Package Introduced

The package replaces the cdrecord executable. However, the cdrskin package includes the cdrecord command as a symbolic link to the cdrskin binary so that existing user scripts need not be revised.

`util-linux-core` Added as a Package

The util-linux-core is added as a subpackage to the util-linux package to manage scenarios where the size of installed package is a critical issue, such as in buildroots, some containers, and boot images.

However, for standard installations, install the util-linux package, which automatically includes the util-linux-core package.

Compilers and Development Tools

The following features, enhancements, and changes related to compilers and development tools are introduced in this Oracle Linux 9 release.