RedHat Enterprise Linux 7.5 released, next stop: CentOS 7.5

buik · Apr 11, 2018

RedHat Enterprise Linux 7.5 is released
Source code is uploaded to : https://git.centos.org
Example RedHat Enterprise Linux 7.5 kernel: https://git.centos.org/summary/rpms!kernel.git

eva2000 · Apr 11, 2018

Sweet thanks for heads up - more fun on the way when CentOS 7.5 comes.

Redhat Enterprise 7.5 Release notes - https://access.redhat.com/documenta...e_linux/7/html-single/7.5_release_notes/index

nice more platform support

Support for Architectures in the New Kernel Version
Red Hat Enterprise Linux 7.5 is distributed with the kernel-alt packages, which include kernel version 4.14. This kernel version provides support for the following architectures:

64-bit ARM

IBM POWER9 (little endian)

IBM z Systems

For details, see Chapter 2, Architectures.
Click to expand...

Kernel parameters for AMD EPYC and Meltdown/Spectre

Chapter 3. Important Changes to External Kernel Parameters
This chapter provides system administrators with a summary of significant changes in the kernel shipped with Red Hat Enterprise Linux 7.5. These changes include added or updated proc entries, sysctl, and sysfs default values, boot parameters, kernel configuration options, or any noticeable behavior changes.
Kernel parameters
amd_iommu_intr = [HW,X86-64]
Specifies one of the following AMD IOMMU interrupt remapping modes.
legacy - Use legacy interrupt remapping mode.
vapic - Use virtual APIC mode, which allows IOMMU to inject interrupts directly into guest. This mode requires kvm-amd.avic=1, which is default when IOMMU HW support is present.
debug_pagealloc = [KNL]
When CONFIG_DEBUG_PAGEALLOC is set, this parameter enables the feature at boot time. It is disabled by default. To avoid allocating huge chunk of memory for debug pagealloc do not enable it at boot time, and the operating system will work similarly as with the kernel built without CONFIG_DEBUG_PAGEALLOC.
Use debug_pagealloc = on to enable the feature.
ftrace_graph_max_depth = uint[FTRACE]
This parameter is used with the function graph tracer. It defines the maximum depth it will trace into a function. Its value can be changed at run time by the max_graph_depth filefile in the tracefs tracing directory.
The default values is 0, which means that no limit is set.
init_pkru = [x86]
Specifies the default memory protection keys rights register contents for all processes.
The default value is 0x55555554, which disallows access to all but pkey 0. You can override the value in the debugfs file system after boot.
nopku = [x86]
Disables the Memory Protection Keys CPU feature found in some Intel CPUs.
mem_encrypt = [X86-64]
Provides AMD Secure Memory Encryption (SME) control. The valid arguments are: on, off.
The default setting depends on kernel configuration option:
on : CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y
off : CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n
mem_encrypt=on: Activate SME
mem_encrypt=off: Do not activate SME
Kernel parameters to mitigate Spectre and Meltdown issues
kpti = [X86-64]
Enables kernel page table isolation.
nopti = [X86-64]
Disables kernel page table isolation.
nospectre_v2 = [X86]
Disables all mitigations for the Spectre variant 2 (indirect branch speculation) vulnerability. The operating system may allow data leaks with this option, which is equivalent to spectre_v2=off.
spectre_v2 = [X86]
Controls mitigation of Spectre variant 2 (indirect branch speculation) vulnerability.
The valid arguments are: on, off, auto.
on: unconditionally enable
off: unconditionally disable
auto: kernel detects whether your CPU model is vulnerable
Selecting on will, and auto may, choose a mitigation method at run time according to the CPU, the available microcode, the setting of the CONFIG_RETPOLINE configuration option, and the compiler with which the kernel was built.
You can also select specific mitigations manually:
retpoline: replaces indirect branches
ibrs: Intel: Indirect Branch Restricted Speculation (kernel)
ibrs_always: Intel: Indirect Branch Restricted Speculation (kernel and user space)
Not specifying this option is equivalent to spectre_v2=auto.
Click to expand...

bye bye 3DES

Certificate System disables weak 3DES ciphers by default
By default, Certificate System now disables ciphers based on the weak Triple Data Encryption Standard (3DES). This increases the security of the system. However, administrators are able to enable these ciphers again, if needed. For details, see https://access.redhat.com/documenta...html/administration_guide/configuring-ciphers.
As a result, new Certificate System installations have only strong ciphers enabled by default. (BZ#1469169)
Click to expand...

oooh binutils rebased to 2.2.7 - too much to hope for for rebase of glibc to 2.27 I guess heh

binutils rebased to version 2.27
The binutils package has been rebased to upstream version 2.27. This version brings the following changes:

Support for compressed debug sections

Improved handling of orphan sections during linking

Support for the LLVM plugin

Ability to insert new symbols into an object file with the objcopy utility

Support for the IBM POWER9 architecture

Support for the ARMv8.1 and ARMv8.2 instruction set extensions

Additionally, this update fixes the following bugs:

Previously, the binutils package did not contain the standards.info documentation file that describes the GNU Coding Standard. This file has been added and is available through the info command again.

Previously, the ld linker on the IBM Power Systems architecture stored intermediate data in the first object file specified by the linker command line. As a consequence, the linker terminated unexpectedly with a segmentation fault if that file was not used in the output and was discarded. The linker has been modified to directly store the data in the output file and skip the intermediate storage in the input file. As a result, linking no longer fails with a segmentation fault in the described situation. (BZ#1385959, BZ#1356856, BZ#1467390, BZ#1513014)

Click to expand...

as has rsync

rsync rebased to version 3.1.2
The rsync packages have been upgraded to upstream version 3.1.2, which provides a number of bug fixes and enhancements over the previous version.
This update introduces the following output changes:

The default output format of numbers has been changed to 3-digit groups, for example, 1,234,567.

The output of the --progress option has been changed; the following strings have been shortened: xfer to xfr, and to-check to to-chk.

Notable enhancements in this version include:

I/O handling has been improved, which results in faster data transfers.

New --info and --debug options have been added for more fine-grained output.

The ability to synchronize nano-second modified times has been added.

New options, --usermap, --groupmap, and --chown, have been added for manipulating file ownership during the copy operation.

A new --preallocate option has been added. (BZ#1432899)

Click to expand...

retpolines for GCC compiler

Support for retpolines added to GCC
This update adds support for retpolines to GCC. Retpolines are a technique used by the kernel to reduce overhead of mitigating Spectre Variant 2 attacks described in CVE-2017-5715. (BZ#1535655)
Click to expand...

nice

libreswan now supports NIC offloading
This update of the libreswan packages introduces support for the network interface controller (NIC) offloading. Libreswan now automatically detects the NIC hardware offload support, and the nic-offload=auto|yes|no option has been added for manual setup of this feature. (BZ#1463062)
Click to expand...

rpm-build improvements !

Multi-threaded xz compression in rpm-build
This update adds multi-threaded xz compression for source and binary packages when setting the %_source_payload or %_binary_payload macros to the wLTX.xzdio pattern. In it, L represents the compression level, which is 6 by default, and X is the number of threads to be used (may be multiple digits), for example w6T12.xzdio. To enable this feature, edit the /usr/lib/rpm/macros file or declare the macro within the spec file or at the command line.
As a result, compressions take less time for highly parallel builds, which is beneficial especially for continuous integration of large projects that are built on hardware with many cores. (BZ#1278924)
Click to expand...

eva2000 · Apr 11, 2018

Known issues https://access.redhat.com/documenta...l-single/7.5_release_notes/index#known-issues

Kernel panic during RHEL 7.5 installation on HPE BL920s Gen9 systems
A known issue related to the fix for the Meltdown vulnerability causes a kernel panic with a NULL pointer dereference during the installation of Red Hat Enterprise Linux 7.5 on HPE BL920s Gen2 (Superdome 2) systems. When the problem appears, the following error message is displayed:
WARNING: CPU: 576 PID: 3924 at kernel/workqueue.c:1518__queue_delayed_work+0x184/0x1a0

Then the system reboots, or enters an otherwise faulty state.
There are multiple possible workarounds for this problem:

Add the nopti option to the kernel command line using the boot loader. Once the system finishes booting, upgrade to the latest RHEL 7.5 kernel.

Install RHEL 7.4, and then upgrade to the latest RHEL 7.5 kernel.

Install RHEL 7.5 on a single blade. Once the system is installed, upgrade to the latest RHEL 7.5 kernel, and then add additional blades as required. (BZ#1540061)

Click to expand...

Security patches addressing Spectre and Meltdown issues can cause performance loss
Security patches to address issues reported in CVE-2017-5754, CVE-2017-5715, and CVE-2017-5753 have been implemented. For more information on the issues, including their impact, detection and resolution, see the Red Hat Knowledgebase article at https://access.redhat.com/security/vulnerabilities/speculativeexecution. The patches are enabled by default but they can cause a performance degradation.
Users can control the impact by using Red Hat Enterprise Linux Tunables. The three debugfs tunables can be enabled or disabled on the kernel command line at boot, or at runtime using debugfs controls. The tunables control Page Table Isolation (pti), Indirect Branch Restricted Speculation (ibrs), and Indirect Branch Prediction Barriers (ibpb). Red Hat enables each of the features by default as needed to protect the architecture detected at boot.
Customers who feel confident that their systems are well protected by other means and wish to disable the CVE mitigations to avoid such a performance loss, should use one of the following options:
1. Add the following flags to the kernel command line, and then reboot the kernel for the changes to take effect:
noibrs noibpb nopti

2. Run the following commands to disable the patches at runtime. The change is immediately active and does not require a reboot.
# echo 0 > /sys/kernel/debug/x86/pti_enabled
# echo 0 > /sys/kernel/debug/x86/ibpb_enabled
# echo 0 > /sys/kernel/debug/x86/ibrs_enabled

For more information on controlling the performance impact of the CVE mitigations, refer to the Red Hat Knowledgebase article available at https://access.redhat.com/articles/3311301.
See also the Diagnose tab at https://access.redhat.com/security/vulnerabilities/speculativeexecution. (BZ#1532547)
Click to expand...

buik · Apr 11, 2018

eva2000 said: ↑

Sweet thanks for heads up - more fun on the way when CentOS 7.5 comes.
Click to expand...

You definitely want a CentOS 7.5 release? you want to?
@eva2000 and CentOS 7.5:
https://www-static-blogs.operacdn.com/multi/wp-content/uploads/sites/3/2018/01/BLOG_error-dog-1.gif

Haha

eva2000 · Apr 12, 2018

Yup indeed i do. Looks like Redhat 8.0 will ditch python 2.7 too for python 3.x defaults ! Long way off till Redhat 8.0 though.

ArisC · Apr 12, 2018

eva2000 said: ↑

Yup indeed i do. Looks like Redhat 8.0 will ditch python 2.7 too for python 3.x defaults ! Long way off till Redhat 8.0 though.
Click to expand...

How long are we talking about ?

eva2000 · Apr 12, 2018

Well there should be a 7.6, 7.7, 7.8 and 7.9 before 8.0

buik · Apr 12, 2018

ArisC said: ↑

How long are we talking about ?
Click to expand...

I suspect an Red Hat Enterprise Linux 8 release within a year.

Given the fact that "Full Support" for Red Hat Enterprise Linux 7, will end next year.

As can be reviewed at the "Life-cycle Dates" paragraph on Red Hat Enterprise Linux Life Cycle - Red Hat Customer Portal

buik · Apr 17, 2018

Oracle Linux 7.5 released on http://yum.oracle.com and http://linux.oracle.com ISOs are available on http://support.oracle.com and will be on the usual edelivery site in the next few days @oraclelinux
Click to expand...

Release notes: Oracle® Linux Release Notes for Oracle Linux 7 Update 5

eva2000 · Apr 17, 2018

Ah Oracle 7.5 !

bassie said: ↑

I suspect an Red Hat Enterprise Linux 8 release within a year.

Given the fact that "Full Support" for Red Hat Enterprise Linux 7, will end next year.
Click to expand...

Wow time does fly by - seems like only yesterday RHEL/CentOS 7 was released heh

Revenge · Apr 18, 2018

Yep, it seems it was yesterday. But i only moved to it when 7.2 was out.

buik · Apr 18, 2018

Revenge said: ↑

Yep, it seems it was yesterday. But i only moved to it when 7.2 was out.
Click to expand...

Time flies when you're having fun.

Got cages full of mission critical systems that are still on
Red Hat Enterprise Linux 5 (ELS)

New is not always desirable. Every situation requires its own approach.

eva2000 · Apr 18, 2018

bassie said: ↑

Red Hat Enterprise Linux 5 (ELS)
Click to expand...

oh dear, that must be fun maintaining for

buik · Apr 18, 2018

eva2000 said: ↑

oh dear, that must be fun maintaining for
Click to expand...

Not a sys admin, non programmer and of course no help desk but with Extended Life Cycle Support it is rock solid. Can recommend it to all.

buik · Apr 18, 2018

bassie said: ↑

Not a sys admin, non programmer and of course no help desk but with Extended Life Cycle Support it is rock solid. Can recommend it to all.
Click to expand...

@eva2000 never change a winning team!
Mission critical is not a testing ground

eva2000 · Apr 18, 2018

bassie said: ↑

@eva2000 never change a winning team!
Mission critical is not a testing ground
Click to expand...

but isn't that what staging test copies of production servers are for ?

buik · Apr 18, 2018

eva2000 said: ↑

but isn't that what staging test copies of production servers are for ?
Click to expand...

Of course, test server + production backup, sprinkled with the love of Australia > after some months is production.

Not every customized solution can be migrated from the old host OS to another new OS.

Log in / Register

Forums

Learn about Centmin Mod LEMP Stack today

RedHat Enterprise Linux 7.5 released, next stop: CentOS 7.5

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

ArisC Active Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

Revenge Active Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

.

Log in / Register

Useful Searches

Learn about Centmin Mod LEMP Stack today

RedHat Enterprise Linux 7.5 released, next stop: CentOS 7.5

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

ArisC Active Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

Revenge Active Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

.