RedHat Enterprise Linux 7.6 beta released

eva2000 · Aug 23, 2018

RedHat Enterprise Linux 7.6 Beta has been released so CentOS 7.6 will follow Red Hat Enterprise Linux 7.6 Beta now available

Looks Cloud is of focus

To better enable enterprise-class hybrid clouds while still supporting traditional IT scenarios, Red Hat Enterprise Linux 7.6 beta adds new and enhanced capabilities emphasizing innovations in security and compliance features, management and automation, and Linux containers.
Click to expand...

For more information on Red Hat Enterprise Linux 7.6 beta, please read the release notes

Security

Driven by Trusted Platform Module (TPM) 2.0 hardware modules, the NBDE capability has been extended to provide two layers of security for hybrid-cloud operations: the network-based mechanism is applicable in the cloud, while the use of TPM on-premises helps to keep information on disks physically more secure.

The GnuTLS library now provides improved Hardware Security Module (HSM) support.

OpenSSL now works with new CP Assist for Cryptographic Functions (CPACF) instructions to accelerate Galois/Counter Mode (GCM) of operation as available with IBM z14.

Red Hat Certificate System distributed with Red Hat Enterprise Linux 7.6 Beta provides new default cryptographic algorithms for RSA and ECC, which help maintain FIPS compliance and stay current with cryptography requirements from NIST and other standards bodies, as well as organizations responsible for handling sensitive information.

See Chapter 14, Security and Chapter 5, Authentication and Interoperability for more information.
Click to expand...

Chapter 3. Important Changes to External Kernel Parameters
This chapter provides system administrators with a summary of significant changes in the kernel shipped with Red Hat Enterprise Linux 7.6 Beta. These changes include added or updated proc entries, sysctl, and sysfs default values, boot parameters, kernel configuration options, or any noticeable behavior changes.
Kernel parameters
hardened_usercopy = [KNL]
This parameter specifies whether hardening is enabled (default) or not enabled for the boot.
Hardened usercopy checking is used to protect the kernel from reading or writing beyond known memory allocation boundaries as a proactive defense against bounds-checking flaws in the kernel's copy_to_user()/copy_from_user() interface.
The valid settings are: on, off.
on: Perform hardened usercopy checks (default).
off: Disable hardened usercopy checks.
no-vmw-sched-clock [X86,PV_OPS]
Disables paravirtualized VMware scheduler clock and uses the default one.
rdt = [HW,X86,RDT]
Turns on or off individual RDT features.
Available features are: cmt, mbmtotal, mbmlocal, l3cat, l3cdp, l2cat, l2cdp, mba.
For example, to turn on cmt and turn off mba, use:
rdt=cmt,!mba
nospec_store_bypass_disable [HW]
Disables all mitigations for the Speculative Store Bypass vulnerability.
spec_store_bypass_disable = [HW]
Certain CPUs are vulnerable to an exploit against a common industry wide performance optimization known as Speculative Store Bypass.
In such cases, recent stores to the same memory location cannot always be observed by later loads during speculative execution. However, such stores are unlikely and thus they can be detected prior to instruction retirement at the end of a particular speculation execution window.
In vulnerable processors, the speculatively forwarded store can be used in a cache side channel attack. An example of this is reading memory to which the attacker does not directly have access, for example inside the sandboxed code.
This parameter controls whether the Speculative Store Bypass (SSB) optimization to mitigate the SSB vulnerability is used.
Possible values are:
on: Unconditionally disable SSB.
off: Unconditionally enable SSB.
auto: Kernel detects whether the CPU model contains an implementation of SSB and selects the most appropriate mitigation.
prctl: Controls SSB for a thread using prctl. SSB is enabled for a process by default. The state of the control is inherited on fork.
Not specifying this option is equivalent to spec_store_bypass_disable=auto.
nmi_watchdog = [KNL,BUGS=X86]
These settings can now be accessed at runtime with the use of the nmi_watchdog and hardlockup_panic sysctls.
New and updated /proc/sys/kernel/ entries
hardlockup_panic
This parameter controls whether the kernel panics if a hard lockup is detected.
Possible values are:
0: Do not panic on hard lockup.
1: Panic on hard lockup.
This can also be set using the nmi_watchdog kernel parameter.
perf_event_mlock_kb
Controls size of per-cpu ring buffer not counted against mlock limit.
The default value is 512 + 1 page.
perf_event_paranoid
Controls use of the performance events system by unprivileged users (without CAP_SYS_ADMIN).
The default value is 2.
Possible values are:
-1: Allow use of the majority of events by all users.
>=0: Disallow ftrace function tracepoint and raw tracepoint access by users without CAP_SYS_ADMIN.
>=1: Disallow CPU event access by users without CAP_SYS_ADMIN.
>=2: Disallow kernel profiling by users without CAP_SYS_ADMIN.
New /proc/sys/net/core entries
bpf_jit_harden
Enables hardening for the Berkeley Packet Filter (BPF) Just in Time (JIT) compiler.
Supported are eBPF JIT backends. Enabling hardening trades off performance, but can mitigate JIT spraying.
Possible values are:
0: Disable JIT hardening (default value).
1: Enable JIT hardening for unprivileged users only.
2: Enable JIT hardening for all users.
Click to expand...

Chapter 5. Authentication and Interoperability
Certificate System now supports additional strong ciphers by default
With this update, the following additional ciphers, which are compliant with the Federal Information Processing Standard (FIPS), are enabled by default in Certificate System:

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_RSA_WITH_AES_256_GCM_SHA384

For a full list of enabled ciphers, enter:
# /usr/lib64/nss/unsupported-tools/listsuites | grep -B1 --no-group-separator "Enabled"
Click to expand...

Certificate System automatically applies ECC profiles when setting up root CA with ECC certificates
This update enhances Certificate System to automatically apply ECC profiles when setting up a new root CA with ECC profiles using the pkispawn utility. As a result, administrators no longer have to set the profile overwrite parameters for ECC certificates as a workaround in the configuration file passed to pkispawn when setting up a root CA. (BZ#1550742)
Click to expand...

The ipset comment extension is now supported
Τhis update adds the ipset comment extension. Τhis enables you to add entries with a comment. For more information, see the ipset (8) man page. (BZ#1496859)
Click to expand...

The SCHED_DEADLINE scheduler class enabled
This update adds support for the SCHED_DEADLINE scheduler class for the Linux kernel. The scheduler enables predictable task scheduling based on application deadlines. SCHED_DEADLINE benefits periodic workloads by guaranteeing timing isolation, which is not based only on a fixed priority but also on the applications' timing requirements. (BZ#1344565)
Click to expand...

Chapter 13. Networking
Support for the libnftnl and nftables packages
The nftables and libnftl packages, previously available as a Technology Preview, are now supported.

The nftables packages provide a packet-filtering tool, with numerous improvements in convenience, features, and performance over previous packet-filtering tools. It is the designated successor to the iptables, ip6tables, arptables, and ebtables utilities.

The libnftnl packages provide a library for low-level interaction with nftables Netlink's API over the libmnl library. (BZ#1332585)
Click to expand...

ipset rebased to Linux kernel version 4.17
The ipset kernel component has been upgraded to upstream Linux kernel version 4.17 which provides a number of enhancements and bug fixes over the previous version. Notable changes include:

The following ipset types are now supported:

hash:net,net

hash:net,port,net

hash:ip,mark

hash:mac

hash:ip,mac (BZ#1557599)

ipset (userspace) rebased to version 6.38
The ipset (userspace) package has been upgraded to upstream version 6.38, which provides a number of bug fixes and enhancements over the previous version. Notable changes include:

The userspace ipset is now aligned to the Red Hat Enterprise Linux (RHEL) kernel ipsetimplementation in terms of supported ipset types

A new type of set, hash:ipmac, is now supported (BZ#1557600)

firewalld rebased to version 0.5.3
The firewalld service daemon has been upgraded to upstream version 0.5.3, which provides a number of bug fixes and enhancements over the previous version. Notable changes include:

Added the --check-config option to verify sanity of configuration files.

Generated interfaces such as docker0 are now correctly re-added to zones after firewalld restarts. (? I'm just guessing the correct form - the second bullet is not clear to me)

A new IP set type, hash:mac, is now supported. (BZ#1554993)

Click to expand...

gnutls rebased to 3.3.29
The GNU Transport Layer Security (GnuTLS) library has been upgraded to upstream version 3.3.29, which provides a number of bug fixes and enhancements over the previous version. Notable changes include:

Improved the PKCS#11 cryptographic token interface for hardware security modules (HSMs): added DSA support in p11tool and fixed key import in certain Atos HSMs.

Improved counter-measures for the TLS Cipher Block Chaining (CBC) record padding. The existing counter-measures had certain issues and were insufficient when the attacker could access the CPU cache and perform a chosen-plaintext attack (CPA).

Disabled the legacy HMAC-SHA384 cipher suites by default. (BZ#1561481)

audit rebased to 2.8.4
The audit packages have been upgraded to upstream version 2.8.4, which provides a number of bug fixes and enhancements over the previous version. Notable changes include:

Added support for dumping internal state. You can now run the service auditd statecommand to see information about the Audit daemon.

Added support for the SOFTWARE_UPDATE event generated by the rpm and yum tools.

Allowed unlimited retries during a remote logging startup. This helps to start even if the aggregating server is not running when a client is booted.

Improved IPv6 remote logging. (BZ#1559032)

RPM now provides Audit events
With this update, the RPM Package Manager (RPM) provides Audit events. The information that a software package is installed or updated is important for system analysis with the Linux Audit system. RPM now creates a SOFTWARE_UPDATE audit event whenever a package is installed or upgraded by the root user. (BZ#1555326)
Click to expand...

A non-functioning systemctl reload network.service has been removed
The systemctl reload network.service command, which does not work due to technical limitations of initscripts has been removed, and using it now results in an appropriate warning message. To correctly apply a new configuration for the network service, use the restart command instead:
~]# systemctl restart network.service

(BZ#1554690)
Click to expand...

YUM 4 available as Technology Preview
YUM version 4, a next generation of the YUM package manager, is now available as a Technology Preview in the Red Hat Enterprise Linux 7 Extras channel.
YUM 4 is based on the DNF technology and offers the following advantages over the standard YUM 3 used on RHEL 7:

Increased performance

Support for modular content

Well-designed stable API for integration with tooling

To install YUM 4, run the yum install nextgen-yum4 command.
To manage packages, use the yum4 command and its particular options the same way as the yum command.
For detailed information about differences between the new YUM 4 tool and YUM 3, see Changes in DNF CLI compared to YUM — DNF 3.3.0-1 documentation. (BZ#1461652)
Click to expand...

TLS compression support has been removed from nss
To prevent security risks, such as the CRIME attack, support for TLS compression in the NSSlibrary has been removed for all TLS versions. This change preserves the API compatibility.
Click to expand...

Sendmail has been deprecated
Sendmail has been deprecated in Red Hat Enterprise Linux 7. Customers are advised to use Postfix, which is configured as the default Mail Transfer Agent (MTA).
Click to expand...

Symbols from libraries linked as dependencies no longer resolved by ld
Previously, the ld linker resolved any symbols present in any linked library, even if some libraries were linked only implicitly as dependencies of other libraries. This allowed developers to use symbols from the implicitly linked libraries in application code and omit explicitly specifying these libraries for linking.

For security reasons, ld has been changed to not resolve references to symbols in libraries linked implicitly as dependencies.
As a result, linking with ld fails when application code attempts to use symbols from libraries not declared for linking and linked only implicitly as dependencies. To use symbols from libraries linked as dependencies, developers must explicitly link against these libraries as well.

To restore the previous behavior of ld, use the -copy-dt-needed-entries command-line option. (BZ#1292230)
Click to expand...

Several rsyslog options deprecated
The rsyslog utility version in Red Hat Enterprise Linux 7.4 has deprecated a large number of options. These options no longer have any effect and cause a warning to be displayed.

The functionality previously provided by the options -c, -u, -q, -x, -A, -Q, -4, and -6 can be achieved using the rsyslog configuration.

There is no replacement for the functionality previously provided by the options -land -s

Click to expand...

Containers using the libvirt-lxc tooling have been deprecated
The following libvirt-lxc packages are deprecated since Red Hat Enterprise Linux 7.1:

libvirt-daemon-driver-lxc

libvirt-daemon-lxc

libvirt-login-shell

Future development on the Linux containers framework is now based on the dockercommand-line interface. libvirt-lxc tooling may be removed in a future release of Red Hat Enterprise Linux (including Red Hat Enterprise Linux 7) and should not be relied upon for developing custom container management applications.
For more information, see the Red Hat KnowledgeBase article.
Click to expand...

GCC thread sanitizer included in RHEL no longer works
Due to incompatible changes in kernel memory mapping, the thread sanitizer included with the GCC compiler version in RHEL no longer works. Additionally, the thread sanitizer can not be adapted to the incompatible memory layout. As a result, it is no longer possible to use the GCC thread sanitizer included with RHEL.

As a workaround, use the version of GCC included in Red Hat Developer Toolset to build code using thread sanitizer. (BZ#1569484)
Click to expand...

Verification of signatures using the MD5 hash algorithm is disabled in Red Hat Enterprise Linux 7
It is impossible to connect to any Wi-Fi Protected Access (WPA) Enterprise Access Point (AP) that requires MD5 signed certificates. To work around this problem, copy the wpa_supplicant.service file from the /usr/lib/systemd/system/ directory to the /etc/systemd/system/ directory and add the following line to the Service section of the file:

Environment=OPENSSL_ENABLE_MD5_VERIFY=1

Then run the systemctl daemon-reload command as root to reload the service file.
Important: Note that MD5 certificates are highly insecure and Red Hat does not recommend using them. (BZ#1062656)
Click to expand...

Log in / Register

Forums

Discover Centmin Mod today

RedHat Enterprise Linux 7.6 beta released

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Discover Centmin Mod today

RedHat Enterprise Linux 7.6 beta released

eva2000 Administrator Staff Member

.