Considerations in adopting RHEL 8
Making open source more inclusive
Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message.
Providing feedback on Red Hat documentation
We appreciate your input on our documentation. Please let us know how we could make it better. To do so:
-
For simple comments on specific passages:
-
Make sure you are viewing the documentation in the Multi-page HTML format. In addition, ensure you see the Feedback button in the upper right corner of the document.
-
Use your mouse cursor to highlight the part of text that you want to comment on.
-
Click the Add Feedback pop-up that appears below the highlighted text.
-
Follow the displayed instructions.
-
-
For submitting more complex feedback, create a Bugzilla ticket:
-
Go to the Bugzilla website.
-
As the Component, use Documentation.
-
Fill in the Description field with your suggestion for improvement. Include a link to the relevant part(s) of documentation.
-
Click Submit Bug.
-
Preface
This document provides an overview of differences between two major versions of Red Hat Enterprise Linux: RHEL 7 and RHEL 8. It provides a list of changes relevant for evaluating an upgrade to RHEL 8 rather than an exhaustive list of all alterations.
Capabilities and limits of RHEL 8 as compared to other versions of the system are available in the Knowledgebase article Red Hat Enterprise Linux technology capabilities and limits.
Information regarding the RHEL life cycle is provided in the Red Hat Enterprise Linux Life Cycle document.
The Package manifest document provides a package listing for RHEL 8.
For details regarding RHEL 8 usage, see the RHEL 8 product documentation.
For guidance regarding an in-place upgrade from RHEL 7 to RHEL 8, see Upgrading from RHEL 7 to RHEL 8.
For information about major differences between RHEL 6 and RHEL 7, see the RHEL 7 Migration Planning Guide.
Architectures
Red Hat Enterprise Linux 8 is distributed with the kernel version 4.18, which provides support for the following architectures:
-
AMD and Intel 64-bit architectures
-
The 64-bit ARM architecture
-
IBM Power Systems, little endian
-
64-bit IBM Z
Make sure you purchase the appropriate subscription for each architecture. For more information, see Get Started with Red Hat Enterprise Linux - additional architectures. For a list of available subscriptions, see Subscription Utilization on the Customer Portal.
Note that all architectures are supported by the standard kernel
packages in RHEL 8; no kernel-alt
package is needed.
Repositories
Red Hat Enterprise Linux 8 is distributed through two main repositories:
-
BaseOS
-
AppStream
Both repositories are required for a basic RHEL installation, and are available with all RHEL subscriptions.
Content in the BaseOS repository is intended to provide the core set of the underlying OS functionality that provides the foundation for all installations. This content is available in the RPM format and is subject to support terms similar to those in previous releases of RHEL. For a list of packages distributed through BaseOS, see the Package manifest.
Content in the Application Stream repository includes additional user space applications, runtime languages, and databases in support of the varied workloads and use cases. Application Streams are available in the familiar RPM format, as an extension to the RPM format called modules, or as Software Collections. For a list of packages available in AppStream, see the Package manifest.
In addition, the CodeReady Linux Builder repository is available with all RHEL subscriptions. It provides additional packages for use by developers. Packages included in the CodeReady Linux Builder repository are unsupported.
For more information about RHEL 8 repositories, see the Package manifest.
Application streams
Red Hat Enterprise Linux 8 introduces the concept of Application Streams. Multiple versions of user space components are now delivered and updated more frequently than the core operating system packages. This provides greater flexibility to customize Red Hat Enterprise Linux without impacting the underlying stability of the platform or specific deployments.
Components made available as Application Streams can be packaged as modules or RPM packages and are delivered through the AppStream repository in RHEL 8. Each Application Stream component has a given life cycle, either the same as RHEL 8 or shorter. For details, see Red Hat Enterprise Linux Life Cycle.
Modules are collections of packages representing a logical unit: an application, a language stack, a database, or a set of tools. These packages are built, tested, and released together.
Module streams represent versions of the Application Stream components. For example, several streams (versions) of the PostgreSQL database server are available in the postgresql
module with the default postgresql:10
stream. Only one module stream can be installed on the system. Different versions can be used in separate containers.
Detailed module commands are described in the Installing, managing, and removing user-space components document. For a list of modules available in AppStream, see the Package manifest.
Installer and image creation
Installer networking
Device naming scheme
A new network device naming scheme that generates network interface names based on a user-defined prefix is available in Red Hat Enterprise Linux 8.
The net.ifnames.prefix
boot option allows the device naming scheme to be used by the installation program and the installed system. See the dracut.cmdline(7)
man page for information.
Installation images and packages
Ability to register your system, attach RHEL subscriptions, and install from the Red Hat CDN
Since Red Hat Enterprise Linux 8.2, you can register your system, attach RHEL subscriptions, and install from the Red Hat Content Delivery Network (CDN) before package installation. Interactive GUI installations, as well as automated Kickstart installations, support this feature. For more information, see the RHEL 8.2 Release Notes document.
Ability to register your system to Red Hat Insights during installation
Since Red Hat Enterprise Linux 8.2, you can register your system to Red Hat Insights during installation. Interactive GUI installations, as well as automated Kickstart installations, support this feature. For more information, see the RHEL 8.2 Release Notes document.
Unified ISO
In Red Hat Enterprise Linux 8, a unified ISO automatically loads the BaseOS and AppStream installation source repositories. This feature works for the first base repository that is loaded during installation. For example, if you boot the installation with no repository configured and have the unified ISO as the base repository in the graphical user interface (GUI), or if you boot the installation using the inst.repo=
option that points to the unified ISO.
As a result, the AppStream repository is enabled under the Additional Repositories section of the Installation Source GUI window. You cannot remove the AppStream repository or change its settings but you can disable it in Installation Source. This feature does not work if you boot the installation using a different base repository and then change it to the unified ISO. If you do that, the base repository is replaced. However, the AppStream repository is not replaced and points to the original file.
Stage2 image
In Red Hat Enterprise Linux 8, multiple network locations of stage2
or Kickstart files can be specified to prevent installation failure. This update enables the specification of multiple inst.stage2
and inst.ks
boot options with network locations of stage2
and a Kickstart file. This avoids the situation in which the requested files cannot be reached and the installation fails because the contacted server with the stage2
or the Kickstart file is inaccessible.
With this new update, the installation failure can be avoided if multiple locations are specified. If all the defined locations are URLs, namely HTTP
, HTTPS
, or FTP
, they will be tried sequentially until the requested file is fetched successfully. If there is a location that is not a URL, only the last specified location is tried. The remaining locations are ignored.
inst.addrepo parameter
Previously, you could only specify a base repository from the kernel boot parameters. In Red Hat Enterprise Linux 8, a new kernel parameter, inst.addrepo=<name>,<url>
, allows you to specify an additional repository during installation. This parameter has two mandatory values: the name of the repository and the URL that points to the repository. For more information, see the inst-addrepo usage.
Installation from an expanded ISO
Red Hat Enterprise Linux 8 supports installing from a repository on a local hard drive. Previously, the only installation method from a hard drive was using an ISO image as the installation source. However, the Red Hat Enterprise Linux 8 ISO image might be too big for some file systems; for example, the FAT32 file system cannot store files larger than 4 GiB. In Red Hat Enterprise Linux 8, you can enable installation from a repository on a local hard drive; you only need to specify the directory instead of the ISO image. For example: inst.repo=hd:<device>:<path to the repository>
.
For more information about the Red Hat Enterprise Linux 8 BaseOS and AppStream repositories, see the Repositories section of this document.
System Purpose new in RHEL
System Purpose support in the graphical installation
Previously, the Red Hat Enterprise Linux installation program did not provide system purpose information to Subscription Manager. In Red Hat Enterprise Linux 8, you can set the intended purpose of the system during a graphical installation by using the System Purpose window, or in a Kickstart configuration file by using the syspurpose
command. When you set a system’s purpose, the entitlement server receives information that helps auto-attach a subscription that satisfies the intended use of the system.
System Purpose support in Pykickstart
Previously, it was not possible for the pykickstart
library to provide system purpose information to Subscription Manager. In Red Hat Enterprise Linux 8, pykickstart
parses the new syspurpose
command and records the intended purpose of the system during automated and partially-automated installation. The information is then passed to the installation program, saved on the newly-installed system, and available for Subscription Manager when subscribing the system.
Installer module support
Installing modules using Kickstart
In Red Hat Enterprise Linux 8, the installation program has been extended to handle all modular features. Kickstart scripts can now enable module and stream combinations, install module profiles, and install modular packages.
Unresolved include directive in modules/ROOT/partials/assembly_installation-and-booting.adoc - include::assembly_kickstart-changes.adoc[] :leveloffset: +1
Image creation
Custom system image creation with Image Builder
The Image Builder tool enables users to create customized RHEL images. As of Red Hat Enterprise Linux 8.3, Image Builder runs as a system service osbuild-composer package.
With Image Builder, users can create custom system images which include additional packages. Image Builder functionality can be accessed through:
-
a graphical user interface in the web console
-
a command line interface in the
composer-cli
tool.
Image Builder output formats include, among others:
-
TAR archive
-
qcow2 file for direct use with a virtual machine or OpenStack
-
QEMU QCOW2 Image
-
cloud images for Azure, VMWare and AWS
To learn more about Image Builder, see the documentation title Composing a customized RHEL system image.
Software management
Unresolved include directive in modules/ROOT/partials/assembly_software-management.adoc - include::assembly_notable-changes-to-yum-stack.adoc[] :leveloffset: +1
Notable RPM features and changes
Red Hat Enterprise Linux (RHEL) 8 is distributed with RPM 4.14. This version introduces many enhancements over RPM 4.11, which is available in RHEL 7.
Notable features include:
-
The debuginfo packages can be installed in parallel
-
Support for weak dependencies
-
Support for rich or boolean dependencies
-
Support for packaging files above 4 GB in size
-
Support for file triggers
-
New
--nopretrans
and--noposttrans
switches to disable the execution of the%pretrans
and%posttrans
scriptlets respectively. -
New
--noplugins
switch to disable loading and execution of all RPM plug-ins. -
New
syslog
plug-in for logging any RPM activity by the System Logging protocol (syslog). -
The
rpmbuild
command can now do all build steps from a source package directly.This is possible if
rpmbuild
is used with any of the-r[abpcils]
options. -
Support for the reinstall mode.
This is ensured by the new
--reinstall
option. To reinstall a previously installed package, use the syntax below:rpm {--reinstall} [install-options] PACKAGE_FILE
This option ensures a proper installation of the new package and removal of the old package.
-
Support for SSD conservation mode.
This is ensured by the new
%_minimize_writes
macro, which is available in the/usr/lib/rpm/macros
file. The macro is by default set to 0. To minimize writing to SSD disks, set%_minimize_writes
to 1. -
New
rpm2archive
utility for converting rpm payload to tar archives
See more information about New RPM features in RHEL 8.
Notable changes include:
-
Stricter spec-parser
-
Simplified signature checking the output in non-verbose mode
-
Improved support for reproducible builds (builds that create an identical package):
-
Setting build time
-
Setting file mtime (file modification time)
-
Setting buildhost
-
-
Using the
-p
option to query an uninstalled PACKAGE_FILE is now optional. For this use case, therpm
command now returns the same result with or without the-p
option. The only use case where the-p
option is necessary is to verify that the file name does not match anyProvides
in therpmdb
database. -
Additions and deprecations in macros
-
The
%makeinstall
macro has been deprecated. To install a program, use the%make_install
macro instead.
-
-
The
rpmbuild --sign
command has been deprecated.Note that using the
--sign
option with therpmbuild
command has been deprecated. To add a signature to an already existing package, userpm --addsign
instead.
Infrastructure services
Unresolved include directive in modules/ROOT/partials/assembly_infrastructure-services.adoc - include::assembly_time-synchronization.adoc[] :leveloffset: +1
BIND - Implementation of DNS
RHEL 8 includes BIND (Berkeley Internet Name Domain) in version 9.11. This version of the DNS server introduces multiple new features and feature changes compared to version 9.10.
New features:
-
A new method of provisioning secondary servers called Catalog Zones has been added.
-
Domain Name System Cookies are now sent by the
named
service and thedig
utility. -
The Response Rate Limiting feature can now help with mitigation of DNS amplification attacks.
-
Performance of response-policy zone (RPZ) has been improved.
-
A new zone file format called
map
has been added. Zone data stored in this format can be mapped directly into memory, which enables zones to load significantly faster. -
A new tool called
delv
(domain entity lookup and validation) has been added, with dig-like semantics for looking up DNS data and performing internal DNS Security Extensions (DNSSEC) validation. -
A new
mdig
command is now available. This command is a version of thedig
command that sends multiple pipelined queries and then waits for responses, instead of sending one query and waiting for the response before sending the next query. -
A new
prefetch
option, which improves the recursive resolver performance, has been added. -
A new
in-view
zone option, which allows zone data to be shared between views, has been added. When this option is used, multiple views can serve the same zones authoritatively without storing multiple copies in memory. -
A new
max-zone-ttl
option, which enforces maximum TTLs for zones, has been added. When a zone containing a higher TTL is loaded, the load fails. Dynamic DNS (DDNS) updates with higher TTLs are accepted but the TTL is truncated. -
New quotas have been added to limit queries that are sent by recursive resolvers to authoritative servers experiencing denial-of-service attacks.
-
The
nslookup
utility now looks up both IPv6 and IPv4 addresses by default. -
The
named
service now checks whether other name server processes are running before starting up. -
When loading a signed zone,
named
now checks whether a Resource Record Signature’s (RSIG) inception time is in the future, and if so, it regenerates the RRSIG immediately. -
Zone transfers now use smaller message sizes to improve message compression, which reduces network usage.
Feature changes:
-
The version
3 XML
schema for the statistics channel, including new statistics and a flattened XML tree for faster parsing, is provided by the HTTP interface. The legacy version2 XML
schema is no longer supported. -
The
named
service now listens on both IPv6 and IPv4 interfaces by default. -
The
named
service no longer supports GeoIP. Access control lists (ACLs) defined by presumed location of query sender are unavailable.
DNS resolution
In RHEL 7, the nslookup
and host
utilities were able to accept any reply without the recursion available
flag from any name server listed. In RHEL 8, nslookup
and host
ignore replies from name servers with recursion not available unless it is the name server that is last configured. In case of the last configured name server, answer is accepted even without the recursion available
flag.
However, if the last configured name server is not responding or unreachable, name resolution fails. To prevent such fail, you can use one of the following approaches:
-
Ensure that configured name servers always reply with the
recursion available
flag set. -
Allow recursion for all internal clients.
Optionally, you can also use the dig
utility to detect whether recursion is available or not.
Postfix
By default in RHEL 8, Postfix
uses MD5 fingerprints with the TLS for backward compatibility. But in FIPS mode, the MD5 hashing function is not available, which may cause TLS to incorrectly function in the default Postfix
configuration. As a workaround, the hashing function needs to be changed to SHA-256
in the postfix configuration file.
For more details, see the related link: https://access.redhat.com/articles/5824391
Printing
Print settings tools
The Print Settings configuration tool, which was used in RHEL 7, is no longer available.
To achieve various tasks related to printing, you can choose one of the following tools:
-
CUPS web user interface (UI)
-
GNOME Control center
For more information on print setting tools in RHEL 8, see Deploying different types of servers.
Location of CUPs logs
CUPS provides three kinds of logs:
-
Error log
-
Access log
-
Page log
In RHEL 8, the logs are no longer stored in specific files within the /var/log/cups directory, which was used in RHEL 7. Instead, all three types are logged centrally in systemd-journald together with logs from other programs.
For more information on how to use CUPS logs in RHEL 8, see Deploying different types of servers.
Additional information
For more information how to configure printing in RHEL 8, see Deploying different types of servers.
Performance and power management options
Notable changes in the recommended Tuned profile
In RHEL 8, the recommended Tuned profile, reported by the tuned-adm recommend
command, is selected based on the following rules:
-
If the
syspurpose
role (reported by thesyspurpose show
command) containsatomic
, and at the same time:-
if Tuned is running on bare metal, the
atomic-host
profile is selected -
if Tuned is running in a virtual machine, the
atomic-guest
profile is selected
-
-
If Tuned is running in a virtual machine, the
virtual-guest
profile is selected -
If the
syspurpose
role containsdesktop
orworkstation
and the chassis type (reported bydmidecode
) isNotebook
,Laptop
, orPortable
, then thebalanced
profile is selected -
If none of the above rules matches, the
throughput-performance
profile is selected
Note that the first rule that matches takes effect.
Other changes to infrastructure services components
This section summarizes other notable changes to particular infrastructure services components.
| Name | Type of change | Additional information |
|---|---|---|
acpid |
Option change |
|
bind |
Configuration option removal |
|
brltty |
Configuration option change |
|
brltty |
Configuration option removal |
|
brltty |
Configuration option change |
A Bluetooth device address may now contain dashes (-) instead of colons (:). The |
cups |
Functionality removal |
Upstream removed support of interface scripts because of security reasons. Use ppds and drivers provided by OS or proprietary ones. |
cups |
Directive options removal |
Removed |
cups |
Directive options removal |
Removed |
cups |
Directive options removal |
Removed |
cups |
Directives moved between conf files |
|
cups |
Directives moved between conf files |
|
cups-filters |
Default configuration change |
Names of remote print queues discovered by cups-browsed are now created based on device ID of printer, not on the name of remote print queue. |
cups-filters |
Default configuration change |
|
cyrus-imapd |
Data format change |
Cyrus-imapd 3.0.7 has different data format. |
dhcp |
Behavior change |
|
dhcp |
Options incompatibility |
The |
dosfstools |
Behavior change |
Data structures are now automatically aligned to cluster size. To disable the alignment, use the |
finger |
Functionality removal |
|
GeoIP |
Functionality removal |
|
grep |
Behavior change |
|
grep |
Behavior change |
|
grep |
Behavior change |
|
grep |
Behavior change |
|
grep |
Behavior change |
When searching binary data, |
grep |
Behavior change |
|
grep |
Behavior change |
Context no longer excludes selected lines omitted because of |
irssi |
Behavior change |
|
lftp |
Change of options |
|
ntp |
Functionality removal |
ntp has been removed; use chrony instead |
postfix |
Configuration change |
3.x version have compatibility safety net that runs Postfix programs with backwards-compatible default settings after an upgrade. |
postfix |
Configuration change |
In the Postfix MySQL database client, the default option_group value has changed to |
postfix |
Configuration change |
The postqueue command no longer forces all message arrival times to be reported in UTC.
To get the old behavior, set
|
postfix |
Configuration change |
ECDHE - |
postfix |
Configuration change |
Changed defaults for |
postfix |
Configuration change |
Changed defaults for |
postfix |
Configuration change |
The |
powertop |
Option removal |
|
powertop |
Option change |
|
powertop |
Option removal |
|
quagga |
Functionality removal |
|
sendmail |
Configuration change |
sendmail uses uncompressed IPv6 addresses by default, which permits a zero subnet to have a more specific match. Configuration data must use the same format, so make sure patterns such as |
spamassasin |
Command line option removal |
Removed |
spamassasin |
Command line option change |
In spamc, the command line option |
spamassasin |
Change in supported SSL versions |
In spamc and spamd, SSLv3 is no longer supported. |
spamassasin |
Functionality removal |
|
vim |
Default settings change |
Vim runs default.vim script, if no ~/.vimrc file is available. |
vim |
Default settings change |
Vim now supports bracketed paste from terminal. Include 'set t_BE=' in vimrc for the previous behavior. |
vsftpd |
Default configuration change |
|
vsftpd |
Default configuration change |
|
vsftpd |
Functionality removal |
|
vsftpd |
Default configuration change |
TLSv1 and TLSv1.1 are disabled by default |
wireshark |
Python bindings removal |
Dissectors can no longer be written in Python, use C instead. |
wireshark |
Option removal |
|
wireshark |
Ouput change |
With the |
wvdial |
Functionality removal |
Security
Changes in core cryptographic components
System-wide cryptographic policies are applied by default
Crypto-policies is a component in Red Hat Enterprise Linux 8, which configures the core cryptographic subsystems, covering the TLS, IPsec, DNSSEC, Kerberos protocols, and the OpenSSH suite. It provides a small set of policies, which the administrator can select using the update-crypto-policies
command.
The DEFAULT
system-wide cryptographic policy offers secure settings for current threat models. It allows the TLS 1.2 and 1.3 protocols, as well as the IKEv2 and SSH2 protocols. The RSA keys and Diffie-Hellman parameters are accepted if larger than 2047 bits.
See the Consistent security by crypto policies in Red Hat Enterprise Linux 8 article on the Red Hat Blog and the update-crypto-policies(8)
man page for more information.
Strong crypto defaults by removing insecure cipher suites and protocols
The following list contains cipher suites and protocols removed from the core cryptographic libraries in RHEL 8. They are not present in the sources, or their support is disabled during the build, so applications cannot use them.
-
DES (since RHEL 7)
-
All export grade cipher suites (since RHEL 7)
-
MD5 in signatures (since RHEL 7)
-
SSLv2 (since RHEL 7)
-
SSLv3 (since RHEL 8)
-
All ECC curves < 224 bits (since RHEL 6)
-
All binary field ECC curves (since RHEL 6)
Cipher suites and protocols disabled in all policy levels
The following cipher suites and protocols are disabled in all crypto policy levels. They can be enabled only by an explicit configuration of individual applications.
-
DH with parameters < 1024 bits
-
RSA with key size < 1024 bits
-
Camellia
-
ARIA
-
SEED
-
IDEA
-
Integrity-only cipher suites
-
TLS CBC mode cipher suites using SHA-384 HMAC
-
AES-CCM8
-
All ECC curves incompatible with TLS 1.3, including secp256k1
-
IKEv1 (since RHEL 8)
Switching the system to FIPS mode
The system-wide cryptographic policies contain a policy level that enables cryptographic modules self-checks in accordance with the requirements by Federal Information Processing Standard (FIPS) Publication 140-2. The fips-mode-setup
tool that enables or disables FIPS mode internally uses the FIPS
system-wide cryptographic policy level.
To switch the system to FIPS mode in RHEL 8, enter the following command and restart your system:
# fips-mode-setup --enable
See the fips-mode-setup(8)
man page for more information.
TLS 1.0 and TLS 1.1 are deprecated
The TLS 1.0 and TLS 1.1 protocols are disabled in the DEFAULT
system-wide cryptographic policy level. If your scenario, for example, a video conferencing application in the Firefox web browser, requires using the deprecated protocols, switch the system-wide cryptographic policy to the LEGACY
level:
# update-crypto-policies --set LEGACY
For more information, see the Strong crypto defaults in RHEL 8 and deprecation of weak crypto algorithms Knowledgebase article on the Red Hat Customer Portal and the update-crypto-policies(8)
man page.
TLS 1.3 support in cryptographic libraries
This update enables Transport Layer Security (TLS) 1.3 by default in all major back-end crypto libraries. This enables low latency across the operating system communications layer and enhances privacy and security for applications by taking advantage of new algorithms, such as RSA-PSS or X25519.
DSA is deprecated in RHEL 8
The Digital Signature Algorithm (DSA) is considered deprecated in Red Hat Enterprise Linux 8. Authentication mechanisms that depend on DSA keys do not work in the default configuration. Note that OpenSSH
clients do not accept DSA host keys even in the LEGACY
system-wide cryptographic policy level.
SSL2
Client Hello
has been deprecated in NSS
The Transport Layer Security (TLS
) protocol version 1.2 and earlier allow to start a negotiation with a Client Hello
message formatted in a way that is backward compatible with the Secure Sockets Layer (SSL
) protocol version 2. Support for this feature in the Network Security Services (NSS
) library has been deprecated and it is disabled by default.
Applications that require support for this feature need to use the new SSL_ENABLE_V2_COMPATIBLE_HELLO
API to enable it. Support for this feature may be removed completely in future releases of Red Hat Enterprise Linux 8.
NSS now use SQL by default
The Network Security Services (NSS) libraries now use the SQL file format for the trust database by default. The DBM file format, which was used as a default database format in previous releases, does not support concurrent access to the same database by multiple processes and it has been deprecated in upstream. As a result, applications that use the NSS trust database to store keys, certificates, and revocation information now create databases in the SQL format by default. Attempts to create databases in the legacy DBM format fail. The existing DBM databases are opened in read-only mode, and they are automatically converted to the SQL format. Note that NSS support the SQL file format since Red Hat Enterprise Linux 6.
SSH
OpenSSH
rebased to version 7.8p1
The openssh
packages have been upgraded to upstream version 7.8p1. Notable changes include:
-
Removed support for the
SSH version 1
protocol. -
Removed support for the
hmac-ripemd160
message authentication code. -
Removed support for RC4 (
arcfour
) ciphers. -
Removed support for
Blowfish
ciphers. -
Removed support for
CAST
ciphers. -
Changed the default value of the
UseDNS
option tono
. -
Disabled
DSA
public key algorithms by default. -
Changed the minimal modulus size for
Diffie-Hellman
parameters to 2048 bits. -
Changed semantics of the
ExposeAuthInfo
configuration option. -
The
UsePrivilegeSeparation=sandbox
option is now mandatory and cannot be disabled. -
Set the minimal accepted
RSA
key size to 1024 bits.
Rsyslog
The default rsyslog
configuration file format is now non-legacy
The configuration files in the rsyslog
packages now use the non-legacy format by default. The legacy format can be still used, although mixing current and legacy configuration statements has several constraints. Configurations carried from previous RHEL releases should be revised. See the rsyslog.conf(5)
man page for more information.
The imjournal
option and configuring system logging with minimized journald
usage
To avoid duplicate records that might appear when journald
rotated its files, the imjournal
option has been added. Note that use of this option can affect performance.
Note that the system with rsyslog
can be configured to provide better performance as described in the Configuring system logging without journald or with minimized journald usage Knowledgebase article.
Negative effects of the default logging setup on performance
The default logging environment setup might consume 4 GB of memory or even more and adjustments of rate-limit values are complex when systemd-journald
is running with rsyslog
.
See the Negative effects of the RHEL default logging setup on performance and their mitigations Knowledgebase article for more information.
OpenSCAP
OpenSCAP API consolidated
This update provides OpenSCAP shared library API that has been consolidated. 63 symbols have been removed, 14 added, and 4 have an updated signature. The removed symbols in OpenSCAP 1.3.0 include:
-
symbols that were marked as deprecated in version 1.2.0
-
SEAP protocol symbols
-
internal helper functions
-
unused library symbols
-
unimplemented symbols
oscap-podman
replaces oscap-docker
for security and compliance scanning of containers
In RHEL 8.2, a new utility for security and compliance scanning of containers has been introduced. The oscap-podman
tool provides an equivalent of the oscap-docker
utility that serves for scanning container and container images in RHEL 7.
For more information, see the Scanning container and container images for vulnerabilities section.
Audit
Audit 3.0 replaces audispd
with auditd
With this update, functionality of audispd
has been moved to auditd
. As a result, audispd
configuration options are now part of auditd.conf
. In addition, the plugins.d
directory has been moved under /etc/audit
. The current status of auditd
and its plug-ins can now be checked by running the service auditd state
command.
SELinux
SELinux packages migrated to Python 3
-
The
policycoreutils-python
has been replaced by thepolicycoreutils-python-utils
andpython3-policycoreutils
packages. -
The functionality of the
libselinux-python
package is now provided by thepython3-libselinux
package. -
The functionality of the
setools-libs
package is now provided by thepython3-setools
package. -
The functionality of the
libsemanage-python
package is now provided by thepython3-libsemanage
package.
Changes in SELinux sub-packages
-
The
libselinux-static
,libsemanage-static
,libsepol-static
, andsetools-libs-tcl
has been removed. -
The
setools-gui
andsetools-console-analyses
are not available in RHEL 8.0 and 8.1. RHEL 8.2 is the first minor version of RHEL 8 that contains these sub-packages.
Changes in SELinux policy
The init_t
domain type is no longer unconfined on RHEL 8. This might cause problems for third-party applications that use a different SELinux labeling approach.
To overcome SELinux labeling problems in the non-standard locations, you can configure file context equivalency for such locations.
-
Configure file context equivalency for the
/my/apps
and/
directories:# semanage fcontext -a -e / /my/apps
-
Verify file context equivalency by listing local customizations of the SELinux policy:
# semanage fcontext -l -C SELinux Local fcontext Equivalence /my/apps = /
-
Restore the context of
/my/apps
to the default, which is now equivalent to the context of/
:# restorecon -Rv /my/apps restorecon reset /my/apps context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:root_t:s0 restorecon reset /my/apps/bin context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:bin_t:s0 restorecon reset /my/apps/bin/executable context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:bin_t:s0
This approach assigns correct labels to the majority of files and directories installed in the non-standard location, which also leads to correctly labeled processes started by some of the executable files.
To remove file context equivalency, use the following command:
# semanage fcontext -d -e / /my/apps
-
For additional information, see the
semanage-fcontext
man page.
Changes in SELinux booleans
New SELinux booleans
This update of the SELinux system policy introduces the following booleans:
-
colord_use_nfs
-
deny_bluetooth
-
httpd_use_opencryptoki
-
logrotate_use_fusefs
-
mysql_connect_http
-
pdns_can_network_connect_db
-
ssh_use_tcpd
-
sslh_can_bind_any_port
-
sslh_can_connect_any_port
-
tor_can_onion_services
-
unconfined_dyntrans_all
-
use_virtualbox
-
virt_sandbox_share_apache_content
-
virt_use_pcscd
Removed SELinux booleans
The RHEL 8 SELinux policy does not provide the following booleans that were available in the previous release:
-
container_can_connect_any
-
ganesha_use_fusefs
Changes of default values
In RHEL 8, the following SELinux booleans are set to a different default value than in the previous release:
-
domain_can_map_files
is nowoff
by default. -
httpd_graceful_shutdown
is nowoff
by default. -
mozilla_plugin_can_network_connect
is nowon
by default. -
named_write_master_zones
is nowon
by default.
Additionally, the descriptions of the antivirus_use_jit
and ssh_chroot_rw_homedirs
booleans have been changed.
To get a list of booleans including their meaning, and to find out if they are enabled or disabled, install the selinux-policy-devel
package and use:
# semanage boolean -l
Changes in SELinux port types
The RHEL 8 SELinux policy provides the following additional port types:
-
appswitch_emp_port_t
-
babel_port_t
-
bfd_control_port_t
-
conntrackd_port_t
-
firepower_port_t
-
nmea_port_t
-
nsca_port_t
-
openqa_port_t
-
openqa_websockets_port_t
-
priority_e_com_port_t
-
qpasa_agent_port_t
-
rkt_port_t
-
smntubootstrap_port_t
-
statsd_port_t
-
versa_tek_port_t
Furthermore, the definitions of the dns_port_t
and ephemeral_port_t
port types have been changed, and the gluster_port_t
port type has been removed.
Removed security functionality
shadow-utils
no longer allow all-numeric user and group names
The useradd
and groupadd
commands disallow user and group names consisting purely of numeric characters. The reason for not allowing such names is that this can confuse potentially many tools that work with user and group names and user and group ids (which are numbers). Please note that the all-numeric user and group names are deprecated in Red Hat Enterprise Linux 7 and their support is completely removed in Red Hat Enterprise Linux 8.
securetty
is now disabled by default
Because of the dynamic nature of tty
device files on modern Linux systems, the securetty
PAM module has been disabled by default and the /etc/securetty
configuration file is no longer included in RHEL. Since /etc/securetty
listed many possible devices so that the practical effect in most cases was to allow by default, this change has only a minor impact. However, if you use a more restrictive configuration, you need to add a line enabling the pam_securetty.so
module to the appropriate files in the /etc/pam.d
directory, and create a new /etc/securetty
file.
The Clevis
HTTP pin has been removed
The Clevis
HTTP pin has been removed from RHEL 8, and the clevis encrypt http
sub-command is no longer available.
Coolkey
has been removed
The Coolkey
driver for smart cards has been removed from RHEL 8, and OpenSC
now provides its functionality.
Networking
NetworkManager
Legacy network scripts support
Network scripts are deprecated in Red Hat Enterprise Linux 8 and are no longer provided by default.
The basic installation provides a new version of the ifup
and ifdown
scripts which call NetworkManager through the nmcli tool.
In Red Hat Enterprise Linux 8, to run the ifup
and the ifdown
scripts, NetworkManager must be running.
|
Custom commands in If any of these scripts are required, the installation of the deprecated network scripts in the system is still possible with the following command: ~]# yum install network-scripts The Calling the legacy network scripts shows a warning about their deprecation. |
NetworkManager supports SR-IOV virtual functions
In Red Hat Enterprise Linux 8, NetworkManager allows configuring the number of virtual functions (VF) for interfaces that support single-root I/O virtualization (SR-IOV). Additionally, NetworkManager allows configuring some attributes of the VFs, such as the MAC address, VLAN, the spoof checking
setting and allowed bitrates. Note that all properties related to SR-IOV are available in the sriov
connection setting. For more details, see the nm-settings(5)
man page.
NetworkManager supports a wildcard interface name match for connections
Previously, it was possible to restrict a connection to a given interface using only an exact match on the interface name. With this update, connections have a new match.interface-name property which supports wildcards. This update enables users to choose the interface for a connection in a more flexible way using a wildcard pattern.
NetworkManager supports configuring ethtool offload features
With this enhancement, NetworkManager
supports configuring ethtool
offload features, and users no longer need to use init scripts or a NetworkManager
dispatcher script. As a result, users can now configure the offload feature as a part of the connection profile using one of the following methods:
-
By using the
nmcli
utility -
By editing key files in the
/etc/NetworkManager/system-connections/
directory -
By editing the
/etc/sysconfig/network-scripts/ifcfg-*
files
Note that this feature is currently not supported in graphical interfaces and in the nmtui
utility.
NetworkManager now uses the internal DHCP plug-in by default
NetworkManager supports the internal
and dhclient
DHCP plug-ins. By default, NetworkManager in Red Hat Enterprise Linux (RHEL) 7 uses the dhclient
and RHEL 8 the internal
plug-in. In certain situations, the plug-ins behave differently. For example, dhclient
can use additional settings specified in the /etc/dhcp/
directory.
If you upgrade from RHEL 7 to RHEL 8 and NetworkManager behaves differently, add the following setting to the [main]
section in the /etc/NetworkManager/NetworkManager.conf
file to use the dhclient
plug-in:
[main] dhcp=dhclient
The NetworkManager-config-server package is not installed by default in RHEL 8
The NetworkManager-config-server
package is only installed by default if you select either the Server
or Server with GUI
base environment during the setup. If you selected a different environment, use the yum install NetworkManager-config-server
command to install the package.
Packet filtering
nftables
replaces iptables
as the default network packet filtering framework
The nftables
framework provides packet classification facilities and it is the designated successor to the iptables
, ip6tables
, arptables
, ebtables
, and ipset
tools. It offers numerous improvements in convenience, features, and performance over previous packet-filtering tools, most notably:
-
lookup tables instead of linear processing
-
a single framework for both the
IPv4
andIPv6
protocols -
rules all applied atomically instead of fetching, updating, and storing a complete rule set
-
support for debugging and tracing in the rule set (
nftrace
) and monitoring trace events (in thenft
tool) -
more consistent and compact syntax, no protocol-specific extensions
-
a Netlink API for third-party applications
Similarly to iptables
, nftables
use tables for storing chains. The chains contain individual rules for performing actions. The nft
tool replaces all tools from the previous packet-filtering frameworks. The libnftables
library can be used for low-level interaction with nftables
Netlink API over the libmnl
library.
The iptables
, ip6tables
, ebtables
and arptables
tools are replaced by nftables-based drop-in replacements with the same name. While external behavior is identical to their legacy counterparts, internally they use nftables
with legacy netfilter
kernel modules through a compatibility interface where required.
Effect of the modules on the nftables
rule set can be observed using the nft list ruleset
command. Since these tools add tables, chains, and rules to the nftables
rule set, be aware that nftables
rule-set operations, such as the nft flush ruleset
command, might affect rule sets installed using the formerly separate legacy commands.
To quickly identify which variant of the tool is present, version information has been updated to include the back-end name. In RHEL 8, the nftables-based iptables
tool prints the following version string:
$ iptables --version iptables v1.8.0 (nf_tables)
For comparison, the following version information is printed if legacy iptables
tool is present:
$ iptables --version iptables v1.8.0 (legacy)
Arptables
FORWARD is removed from filter tables in RHEL 8
The arptables
FORWARD chain functionality has been removed in Red Hat Enterprise Linux (RHEL) 8. You can now use the FORWARD chain of the ebtables
tool adding the rules into it.
Output of iptables-ebtables
is not 100% compatible with ebtables
In RHEL 8, the ebtables
command is provided by the iptables-ebtables
package, which contains an nftables
-based reimplementation of the tool. This tool has a different code base, and its output deviates in aspects, which are either negligible or deliberate design choices.
Consequently, when migrating your scripts parsing some ebtables
output, adjust the scripts to reflect the following:
-
MAC address formatting has been changed to be fixed in length. Where necessary, individual byte values contain a leading zero to maintain the format of two characters per octet.
-
Formatting of IPv6 prefixes has been changed to conform with RFC 4291. The trailing part after the slash character no longer contains a netmask in the IPv6 address format but a prefix length. This change applies to valid (left-contiguous) masks only, while others are still printed in the old formatting.
New tools to convert iptables
to nftables
This update adds the iptables-translate
and ip6tables-translate
tools to convert the existing iptables
or ip6tables
rules into the equivalent ones for nftables
.
Note that some extensions lack translation support. If such an extension exists, the tool prints the untranslated rule prefixed with the #
sign. For example:
| % iptables-translate -A INPUT -j CHECKSUM --checksum-fill | nft # -A INPUT -j CHECKSUM --checksum-fill
Additionally, users can use the iptables-restore-translate
and ip6tables-restore-translate
tools to translate a dump of rules. Note that before that, users can use the iptables-save
or ip6tables-save
commands to print a dump of current rules. For example:
| % sudo iptables-save >/tmp/iptables.dump | % iptables-restore-translate -f /tmp/iptables.dump | # Translated by iptables-restore-translate v1.8.0 on Wed Oct 17 17:00:13 2018 | add table ip nat | ...
Changes in wpa_supplicant
journalctl
can now read the wpa_supplicant
log
In Red Hat Enterprise Linux (RHEL) 8, the wpa_supplicant
package is built with CONFIG_DEBUG_SYSLOG
enabled. This allows reading the wpa_supplicant
log using the journalctl
utility instead of checking the contents of the /var/log/wpa_supplicant.log
file.
The compile-time support for wireless extensions in wpa_supplicant
is disabled
The wpa_supplicant
package does not support wireless extensions. When a user is trying to use wext
as a command-line argument, or trying to use it on old adapters which only support wireless extensions, will not be able to run the wpa_supplicant
daemon.
A new data chunk type, I-DATA
, added to SCTP
This update adds a new data chunk type, I-DATA
, and stream schedulers to the Stream Control Transmission Protocol (SCTP). Previously, SCTP sent user messages in the same order as they were sent by a user. Consequently, a large SCTP user message blocked all other messages in any stream until completely sent. When using I-DATA
chunks, the Transmission Sequence Number (TSN) field is not overloaded. As a result, SCTP now can schedule the streams in different ways, and I-DATA
allows user messages interleaving (RFC 8260). Note that both peers must support the I-DATA
chunk type.
Notable TCP features in RHEL 8
Red Hat Enterprise Linux 8 is distributed with TCP networking stack version 4.18, which provides higher performances, better scalability, and more stability. Performances are boosted especially for busy TCP server with a high ingress connection rate.
Additionally, two new TCP congestion algorithms, BBR
and NV
, are available, offering lower latency, and better throughput than cubic in most scenarios.
TCP BBR support in RHEL 8
A new TCP congestion control algorithm, Bottleneck Bandwidth and Round-trip time (BBR) is now supported in Red Hat Enterprise Linux (RHEL) 8. BBR attempts to determine the bandwidth of the bottleneck link and the Round-trip time (RTT). Most congestion algorithms are based on packet loss (including CUBIC, the default Linux TCP congestion control algorithm), which have problems on high-throughput links. BBR does not react to loss events directly, it adjusts the TCP pacing rate to match it with the available bandwidth.
For more information about this, see the How to configure TCP BBR congestion control algorithm article.
VLAN-related changes
IPVLAN virtual network drivers are now supported
In Red Hat Enterprise Linux 8.0, the kernel includes support for IPVLAN virtual network drivers. With this update, IPVLAN virtual Network Interface Cards (NICs) enable the network connectivity for multiple containers exposing a single MAC address to the local network. This allows a single host to have a lot of containers overcoming the possible limitation on the number of MAC addresses supported by the peer networking equipment.
Certain network adapters require a firmware update to fully support 802.1ad
The firmware of certain network adapters does not fully support the 802.1ad standard, which is also called Q-in-Q or stacked virtual local area networks (VLANs). Contact your hardware vendor on details how to verify that your network adapter uses a firmware that supports the 802.1ad standard and how to update the firmware. As a result, with the correct firmware, configuring stacked VLANs on RHEL 8.0 work as expected.
Network interface name changes
In Red Hat Enterprise Linux 8, the same consistent network device naming scheme is used by default as in RHEL 7. However, certain kernel drivers, such as e1000e
, nfp
, qede
, sfc
, tg3
and bnxt_en
changed their consistent name on a fresh installation of RHEL 8. However, the names are preserved on upgrade from RHEL 7.
The ipv6
, netmask
, gateway
, and hostname
kernel parameters have been removed
The ipv6
, netmask
, gateway
, and hostname
kernel parameters to configure the network in the kernel command line are no longer available since RHEL 8.3. Instead, use the consolidated ip
parameter that accepts different formats, such as the following:
ip=IP_address:peer:gateway_IP_address:net_mask:host_name:interface_name:configuration_method
For further details about the individual fields and other formats this parameter accepts, see the description of the ip
parameter in the dracut.cmdline(7)
man page.
The -ok
option of the tc
command removed
The -ok
option of the tc
command has been removed in Red Hat Enterprise Linux 8. As a workaround, users can implement code to communicate directly via netlink with the kernel. Response messages received, indicate completion and status of sent requests. An alternative way for less time-critical applications is to call tc
for each command separately. This may happen with a custom script which simulates the tc -batch
behavior by printing OK
for each successful tc
invocation.
Kernel
Resource control
Control group v2 available as a Technology Preview in RHEL 8
Control group v2 mechanism is a unified hierarchy control group. Control group v2 organizes processes hierarchically and distributes system resources along the hierarchy in a controlled and configurable manner.
Unlike the previous version, control group v2 has only a single hierarchy. This single hierarchy enables the Linux kernel to:
-
Categorize processes based on the role of their owner.
-
Eliminate issues with conflicting policies of multiple hierarchies.
Control group v2 supports numerous controllers:
-
CPU controller regulates the distribution of CPU cycles. This controller implements:
-
Weight and absolute bandwidth limit models for normal scheduling policy.
-
Absolute bandwidth allocation model for real time scheduling policy.
-
-
Memory controller regulates the memory distribution. Currently, the following types of memory usages are tracked:
-
Userland memory - page cache and anonymous memory.
-
Kernel data structures such as dentries and inodes.
-
TCP socket buffers.
-
-
I/O controller regulates the distribution of I/O resources.
-
Remote Direct Memory Access (RDMA) controller limits RDMA/IB specific resources that certain processes can use. These processes are grouped through the RDMA controller.
-
Process number controller enables the control group to stop any new tasks from being
fork()
’d orclone()
’d after a certain limit. -
Writeback controller acts as a mechanism, which balances conflicts between I/O and the memory controllers.
The information above was based on cgroups-v2 online documentation. You can refer to the same link to obtain more information about particular control group v2 controllers.
Memory management
52-bit PA for 64-bit ARM available
With this update, support for 52-bit physical addressing (PA) for the 64-bit ARM architecture is available. This provides a larger physical address space than previous 48-bit PA.
5-level page tables x86_64
In Red Hat Enterprise Linux 7, existing memory bus had 48/46 bit of virtual/physical memory addressing capacity, and the Linux kernel implemented 4 levels of page tables to manage these virtual addresses to physical addresses. The physical bus addressing line put the physical memory upper limit capacity at 64 TB.
These limits have been extended to 57/52 bit of virtual/physical memory addressing with 128 PiB of virtual address space (64PB user/64PB kernel) and 4 PB of physical memory capacity.
With the extended address range, the memory management in Red Hat Enterprise Linux 8 adds support for 5-level page table implementation. This implementation is able to handle the expanded address range with up to 128 PiB of virtual address space and 4 PiB of physical address space.
The 5-level page table is enabled by default for hardware capable of supporting this feature even if the installed physical memory is less than 64 TiB. For systems with less than 64 TiB of memory, there is a small overhead increase in walking the 5-level page table. To avoid this overhead, users can disable 5-level page table by using the no5lvl
kernel command-line parameter to force the use of 4-level page table.
Performance analysis and observability tools
bpftool added to kernel
The bpftool
utility that serves for inspection and simple manipulation of programs and maps based on extended Berkeley Packet Filtering (eBPF) has been added into the Linux kernel. bpftool
is a part of the kernel source tree, and is provided by the bpftool package, which is included as a sub-package of the kernel package.
eBPF available as a Technology Preview
The extended Berkeley Packet Filtering (eBPF) feature is available as a Technology Preview for both networking and tracing. eBPF enables the user space to attach custom programs onto a variety of points (sockets, trace points, packet reception) to receive and process data. The feature includes a new system call bpf()
, which supports creating various types of maps, and also to insert various types of programs into the kernel. Note that the bpf()
syscall can be successfully used only by a user with the CAP_SYS_ADMIN
capability, such as a root user. See the bpf
(2) man page for more information.
BCC is available as a Technology Preview
BPF Compiler Collection (BCC)
is a user space tool kit for creating efficient kernel tracing and manipulation programs that is available as a Technology Preview in Red Hat Enterprise Linux 8. BCC
provides tools for I/O analysis, networking, and monitoring of Linux operating systems using the extended Berkeley Packet Filtering (eBPF)
.
Booting process
How to install and boot custom kernels in RHEL 8
The Boot Loader Specification (BLS) defines a scheme and file format to manage bootloader configurations for each boot option in a drop-in directory. There is no need to manipulate the individual drop-in configuration files. This premise is particularly relevant in Red Hat Enterprise Linux 8 because not all architectures use the same bootloader:
-
x86_64
,aarch64
andppc64le
with open firmware useGRUB2
-
ppc64le
with Open Power Abstraction Layer (OPAL) usesPetitboot
-
s390x
useszipl
Each bootloader has a different configuration file and format that has to be modified when a new kernel is installed or removed. In the previous versions of Red Hat Enterprise Linux the component that permitted this work was the grubby
utility. However, for Red Hat Enterprise Linux 8 the bootloader configuration was standardized by implementing the BLS file format, where grubby
works as a thin wrapper around the BLS operations.
Early kdump support in RHEL 8
Previously, the kdump
service started too late to register the kernel crashes that occurred in early stages of the booting process. As a result, the crash information together with a chance for troubleshooting was lost.
To address this problem, RHEL 8 introduced an early kdump
support. To learn more about this mechanism, see the /usr/share/doc/kexec-tools/early-kdump-howto.txt
file. See also What is early kdump support and how do I configure it?.
Hardware enablement
Removed hardware support
This section lists device drivers and adapters that were supported in RHEL 7 but are no longer available in RHEL 8.0.
Removed device drivers
Support for the following device drivers has been removed in RHEL 8:
-
3w-9xxx
-
3w-sas
-
aic79xx
-
aoe
-
arcmsr
-
ata drivers:
-
acard-ahci
-
sata_mv
-
sata_nv
-
sata_promise
-
sata_qstor
-
sata_sil
-
sata_sil24
-
sata_sis
-
sata_svw
-
sata_sx4
-
sata_uli
-
sata_via
-
sata_vsc
-
-
bfa
-
cxgb3
-
cxgb3i
-
e1000
-
floppy
-
hptiop
-
initio
-
isci
-
iw_cxgb3
-
mptbase - This driver is left in place for virtualization use case and easy developer transition. However it is not supported.
-
mptctl
-
mptsas - This driver is left in place for virtualization use case and easy developer transition. However it is not supported.
-
mptscsih - This driver is left in place for virtualization use case and easy developer transition. However it is not supported.
-
mptspi - This driver is left in place for virtualization use case and easy developer transition. However it is not supported.
-
mthca
-
mtip32xx
-
mvsas
-
mvumi
-
OSD drivers:
-
osd
-
libosd
-
-
osst
-
pata drivers:
-
pata_acpi
-
pata_ali
-
pata_amd
-
pata_arasan_cf
-
pata_artop
-
pata_atiixp
-
pata_atp867x
-
pata_cmd64x
-
pata_cs5536
-
pata_hpt366
-
pata_hpt37x
-
pata_hpt3x2n
-
pata_hpt3x3
-
pata_it8213
-
pata_it821x
-
pata_jmicron
-
pata_marvell
-
pata_netcell
-
pata_ninja32
-
pata_oldpiix
-
pata_pdc2027x
-
pata_pdc202xx_old
-
pata_piccolo
-
pata_rdc
-
pata_sch
-
pata_serverworks
-
pata_sil680
-
pata_sis
-
pata_via
-
pdc_adma
-
-
pm80xx(pm8001)
-
pmcraid
-
qla3xxx - This driver is left in place for virtualization use case and easy developer transition. However it is not supported.
-
qlcnic
-
qlge
-
stex
-
sx8
-
tulip
-
ufshcd
-
wireless drivers:
-
carl9170
-
iwl4965
-
iwl3945
-
mwl8k
-
rt73usb
-
rt61pci
-
rtl8187
-
wil6210
-
Removed adapters
Support for the adapters listed below has been removed in RHEL 8. Support for other than listed adapters from the mentioned drivers remains unchanged.
PCI IDs are in the format of vendor:device:subvendor:subdevice. If the subdevice or subvendor:subdevice entry is not listed, devices with any values of such missing entries have been removed.
To check the PCI IDs of the hardware on your system, run the lspci -nn
command.
-
The following adapters from the
aacraid
driver have been removed:-
PERC 2/Si (Iguana/PERC2Si), PCI ID 0x1028:0x0001:0x1028:0x0001
-
PERC 3/Di (Opal/PERC3Di), PCI ID 0x1028:0x0002:0x1028:0x0002
-
PERC 3/Si (SlimFast/PERC3Si), PCI ID 0x1028:0x0003:0x1028:0x0003
-
PERC 3/Di (Iguana FlipChip/PERC3DiF), PCI ID 0x1028:0x0004:0x1028:0x00d0
-
PERC 3/Di (Viper/PERC3DiV), PCI ID 0x1028:0x0002:0x1028:0x00d1
-
PERC 3/Di (Lexus/PERC3DiL), PCI ID 0x1028:0x0002:0x1028:0x00d9
-
PERC 3/Di (Jaguar/PERC3DiJ), PCI ID 0x1028:0x000a:0x1028:0x0106
-
PERC 3/Di (Dagger/PERC3DiD), PCI ID 0x1028:0x000a:0x1028:0x011b
-
PERC 3/Di (Boxster/PERC3DiB), PCI ID 0x1028:0x000a:0x1028:0x0121
-
catapult, PCI ID 0x9005:0x0283:0x9005:0x0283
-
tomcat, PCI ID 0x9005:0x0284:0x9005:0x0284
-
Adaptec 2120S (Crusader), PCI ID 0x9005:0x0285:0x9005:0x0286
-
Adaptec 2200S (Vulcan), PCI ID 0x9005:0x0285:0x9005:0x0285
-
Adaptec 2200S (Vulcan-2m), PCI ID 0x9005:0x0285:0x9005:0x0287
-
Legend S220 (Legend Crusader), PCI ID 0x9005:0x0285:0x17aa:0x0286
-
Legend S230 (Legend Vulcan), PCI ID 0x9005:0x0285:0x17aa:0x0287
-
Adaptec 3230S (Harrier), PCI ID 0x9005:0x0285:0x9005:0x0288
-
Adaptec 3240S (Tornado), PCI ID 0x9005:0x0285:0x9005:0x0289
-
ASR-2020ZCR SCSI PCI-X ZCR (Skyhawk), PCI ID 0x9005:0x0285:0x9005:0x028a
-
ASR-2025ZCR SCSI SO-DIMM PCI-X ZCR (Terminator), PCI ID 0x9005:0x0285:0x9005:0x028b
-
ASR-2230S + ASR-2230SLP PCI-X (Lancer), PCI ID 0x9005:0x0286:0x9005:0x028c
-
ASR-2130S (Lancer), PCI ID 0x9005:0x0286:0x9005:0x028d
-
AAR-2820SA (Intruder), PCI ID 0x9005:0x0286:0x9005:0x029b
-
AAR-2620SA (Intruder), PCI ID 0x9005:0x0286:0x9005:0x029c
-
AAR-2420SA (Intruder), PCI ID 0x9005:0x0286:0x9005:0x029d
-
ICP9024RO (Lancer), PCI ID 0x9005:0x0286:0x9005:0x029e
-
ICP9014RO (Lancer), PCI ID 0x9005:0x0286:0x9005:0x029f
-
ICP9047MA (Lancer), PCI ID 0x9005:0x0286:0x9005:0x02a0
-
ICP9087MA (Lancer), PCI ID 0x9005:0x0286:0x9005:0x02a1
-
ICP5445AU (Hurricane44), PCI ID 0x9005:0x0286:0x9005:0x02a3
-
ICP9085LI (Marauder-X), PCI ID 0x9005:0x0285:0x9005:0x02a4
-
ICP5085BR (Marauder-E), PCI ID 0x9005:0x0285:0x9005:0x02a5
-
ICP9067MA (Intruder-6), PCI ID 0x9005:0x0286:0x9005:0x02a6
-
Themisto Jupiter Platform, PCI ID 0x9005:0x0287:0x9005:0x0800
-
Themisto Jupiter Platform, PCI ID 0x9005:0x0200:0x9005:0x0200
-
Callisto Jupiter Platform, PCI ID 0x9005:0x0286:0x9005:0x0800
-
ASR-2020SA SATA PCI-X ZCR (Skyhawk), PCI ID 0x9005:0x0285:0x9005:0x028e
-
ASR-2025SA SATA SO-DIMM PCI-X ZCR (Terminator), PCI ID 0x9005:0x0285:0x9005:0x028f
-
AAR-2410SA PCI SATA 4ch (Jaguar II), PCI ID 0x9005:0x0285:0x9005:0x0290
-
CERC SATA RAID 2 PCI SATA 6ch (DellCorsair), PCI ID 0x9005:0x0285:0x9005:0x0291
-
AAR-2810SA PCI SATA 8ch (Corsair-8), PCI ID 0x9005:0x0285:0x9005:0x0292
-
AAR-21610SA PCI SATA 16ch (Corsair-16), PCI ID 0x9005:0x0285:0x9005:0x0293
-
ESD SO-DIMM PCI-X SATA ZCR (Prowler), PCI ID 0x9005:0x0285:0x9005:0x0294
-
AAR-2610SA PCI SATA 6ch, PCI ID 0x9005:0x0285:0x103C:0x3227
-
ASR-2240S (SabreExpress), PCI ID 0x9005:0x0285:0x9005:0x0296
-
ASR-4005, PCI ID 0x9005:0x0285:0x9005:0x0297
-
IBM 8i (AvonPark), PCI ID 0x9005:0x0285:0x1014:0x02F2
-
IBM 8i (AvonPark Lite), PCI ID 0x9005:0x0285:0x1014:0x0312
-
IBM 8k/8k-l8 (Aurora), PCI ID 0x9005:0x0286:0x1014:0x9580
-
IBM 8k/8k-l4 (Aurora Lite), PCI ID 0x9005:0x0286:0x1014:0x9540
-
ASR-4000 (BlackBird), PCI ID 0x9005:0x0285:0x9005:0x0298
-
ASR-4800SAS (Marauder-X), PCI ID 0x9005:0x0285:0x9005:0x0299
-
ASR-4805SAS (Marauder-E), PCI ID 0x9005:0x0285:0x9005:0x029a
-
ASR-3800 (Hurricane44), PCI ID 0x9005:0x0286:0x9005:0x02a2
-
Perc 320/DC, PCI ID 0x9005:0x0285:0x1028:0x0287
-
Adaptec 5400S (Mustang), PCI ID 0x1011:0x0046:0x9005:0x0365
-
Adaptec 5400S (Mustang), PCI ID 0x1011:0x0046:0x9005:0x0364
-
Dell PERC2/QC, PCI ID 0x1011:0x0046:0x9005:0x1364
-
HP NetRAID-4M, PCI ID 0x1011:0x0046:0x103c:0x10c2
-
Dell Catchall, PCI ID 0x9005:0x0285:0x1028
-
Legend Catchall, PCI ID 0x9005:0x0285:0x17aa
-
Adaptec Catch All, PCI ID 0x9005:0x0285
-
Adaptec Rocket Catch All, PCI ID 0x9005:0x0286
-
Adaptec NEMER/ARK Catch All, PCI ID 0x9005:0x0288
-
-
The following Mellanox Gen2 and ConnectX-2 adapters from the
mlx4_core
driver have been removed:-
PCI ID 0x15B3:0x1002
-
PCI ID 0x15B3:0x676E
-
PCI ID 0x15B3:0x6746
-
PCI ID 0x15B3:0x6764
-
PCI ID 0x15B3:0x675A
-
PCI ID 0x15B3:0x6372
-
PCI ID 0x15B3:0x6750
-
PCI ID 0x15B3:0x6368
-
PCI ID 0x15B3:0x673C
-
PCI ID 0x15B3:0x6732
-
PCI ID 0x15B3:0x6354
-
PCI ID 0x15B3:0x634A
-
PCI ID 0x15B3:0x6340
-
-
The following adapters from the
mpt2sas
driver have been removed:-
SAS2004, PCI ID 0x1000:0x0070
-
SAS2008, PCI ID 0x1000:0x0072
-
SAS2108_1, PCI ID 0x1000:0x0074
-
SAS2108_2, PCI ID 0x1000:0x0076
-
SAS2108_3, PCI ID 0x1000:0x0077
-
SAS2116_1, PCI ID 0x1000:0x0064
-
SAS2116_2, PCI ID 0x1000:0x0065
-
SSS6200, PCI ID 0x1000:0x007E
-
-
The following adapters from the
megaraid_sas
driver have been removed:-
Dell PERC5, PCI ID 0x1028:0x0015
-
SAS1078R, PCI ID 0x1000:0x0060
-
SAS1078DE, PCI ID 0x1000:0x007C
-
SAS1064R, PCI ID 0x1000:0x0411
-
VERDE_ZCR, PCI ID 0x1000:0x0413
-
SAS1078GEN2, PCI ID 0x1000:0x0078
-
SAS0079GEN2, PCI ID 0x1000:0x0079
-
SAS0073SKINNY, PCI ID 0x1000:0x0073
-
SAS0071SKINNY, PCI ID 0x1000:0x0071
-
-
The following adapters from the
qla2xxx
driver have been removed:-
ISP24xx, PCI ID 0x1077:0x2422
-
ISP24xx, PCI ID 0x1077:0x2432
-
ISP2422, PCI ID 0x1077:0x5422
-
QLE220, PCI ID 0x1077:0x5432
-
QLE81xx, PCI ID 0x1077:0x8001
-
QLE10000, PCI ID 0x1077:0xF000
-
QLE84xx, PCI ID 0x1077:0x8044
-
QLE8000, PCI ID 0x1077:0x8432
-
QLE82xx, PCI ID 0x1077:0x8021
-
-
The following adapters from the
qla4xxx
driver have been removed:-
QLOGIC_ISP8022, PCI ID 0x1077:0x8022
-
QLOGIC_ISP8324, PCI ID 0x1077:0x8032
-
QLOGIC_ISP8042, PCI ID 0x1077:0x8042
-
-
The following adapters from the
be2iscsi
driver have been removed:-
BladeEngine 2 (BE2) devices
-
BladeEngine2 10Gb iSCSI Initiator (generic), PCI ID 0x19a2:0x212
-
OneConnect OCe10101, OCm10101, OCe10102, OCm10102 BE2 adapter family, PCI ID 0x19a2:0x702
-
OCe10100 BE2 adapter family, PCI ID 0x19a2:0x703
-
-
BladeEngine 3 (BE3) devices
-
OneConnect TOMCAT iSCSI, PCI ID 0x19a2:0x0712
-
BladeEngine3 iSCSI, PCI ID 0x19a2:0x0222
-
-
-
The following Ethernet adapters controlled by the
be2net
driver have been removed:-
BladeEngine 2 (BE2) devices
-
OneConnect TIGERSHARK NIC, PCI ID 0x19a2:0x0700
-
BladeEngine2 Network Adapter, PCI ID 0x19a2:0x0211
-
-
BladeEngine 3 (BE3) devices
-
OneConnect TOMCAT NIC, PCI ID 0x19a2:0x0710
-
BladeEngine3 Network Adapter, PCI ID 0x19a2:0x0221
-
-
-
The following adapters from the
lpfc
driver have been removed:-
BladeEngine 2 (BE2) devices
-
OneConnect TIGERSHARK FCoE, PCI ID 0x19a2:0x0704
-
-
BladeEngine 3 (BE3) devices
-
OneConnect TOMCAT FCoE, PCI ID 0x19a2:0x0714
-
-
Fibre Channel (FC) devices
-
FIREFLY, PCI ID 0x10df:0x1ae5
-
PROTEUS_VF, PCI ID 0x10df:0xe100
-
BALIUS, PCI ID 0x10df:0xe131
-
PROTEUS_PF, PCI ID 0x10df:0xe180
-
RFLY, PCI ID 0x10df:0xf095
-
PFLY, PCI ID 0x10df:0xf098
-
LP101, PCI ID 0x10df:0xf0a1
-
TFLY, PCI ID 0x10df:0xf0a5
-
BSMB, PCI ID 0x10df:0xf0d1
-
BMID, PCI ID 0x10df:0xf0d5
-
ZSMB, PCI ID 0x10df:0xf0e1
-
ZMID, PCI ID 0x10df:0xf0e5
-
NEPTUNE, PCI ID 0x10df:0xf0f5
-
NEPTUNE_SCSP, PCI ID 0x10df:0xf0f6
-
NEPTUNE_DCSP, PCI ID 0x10df:0xf0f7
-
FALCON, PCI ID 0x10df:0xf180
-
SUPERFLY, PCI ID 0x10df:0xf700
-
DRAGONFLY, PCI ID 0x10df:0xf800
-
CENTAUR, PCI ID 0x10df:0xf900
-
PEGASUS, PCI ID 0x10df:0xf980
-
THOR, PCI ID 0x10df:0xfa00
-
VIPER, PCI ID 0x10df:0xfb00
-
LP10000S, PCI ID 0x10df:0xfc00
-
LP11000S, PCI ID 0x10df:0xfc10
-
LPE11000S, PCI ID 0x10df:0xfc20
-
PROTEUS_S, PCI ID 0x10df:0xfc50
-
HELIOS, PCI ID 0x10df:0xfd00
-
HELIOS_SCSP, PCI ID 0x10df:0xfd11
-
HELIOS_DCSP, PCI ID 0x10df:0xfd12
-
ZEPHYR, PCI ID 0x10df:0xfe00
-
HORNET, PCI ID 0x10df:0xfe05
-
ZEPHYR_SCSP, PCI ID 0x10df:0xfe11
-
ZEPHYR_DCSP, PCI ID 0x10df:0xfe12
-
-
Lancer FCoE CNA devices
-
OCe15104-FM, PCI ID 0x10df:0xe260
-
OCe15102-FM, PCI ID 0x10df:0xe260
-
OCm15108-F-P, PCI ID 0x10df:0xe260
-
-
Other removed hardware support
AGP graphics cards are no longer supported
Graphics cards using the Accelerated Graphics Port (AGP) bus are not supported in Red Hat Enterprise Linux 8. Use the graphics cards with the PCI Express bus as the recommended replacement.
FCoE software removal
Fibre Channel over Ethernet (FCoE) software has been removed from Red Hat Enterprise Linux 8. Specifically, the fcoe.ko
kernel module is no longer available for creating software FCoE interfaces over Ethernet adapters and drivers. This change is due to a lack of industry adoption for software-managed FCoE.
Specific changes to Red Hat Enterprise 8 include:
-
The
fcoe.ko
kernel module is no longer available. This removes support for software FCoE with Data Center Bridging enabled Ethernet adapters and drivers. -
Link-level software configuration via Data Center Bridging eXchange (DCBX) using
lldpad
is no longer supported for FCoE.-
The
fcoe-utils
tools (specificallyfcoemon
) is configured by default to not validate DCB configuration or communicate withlldpad
. -
The
lldpad
integration infcoemon
might be permanently disabled.
-
-
The
libhbaapi
andlibhbalinux
libraries are no longer used byfcoe-utils
, and will not undergo any direct testing from Red Hat.
Support for the following remains unchanged:
-
Currently supported offloading FCoE adapters that appear as Fibre Channel adapters to the operating system and do not use the
fcoe-utils
management tools, unless stated in a separate note. This applies to select adapters supported by thelpfc
FC driver. Note that thebfa
driver is not included in Red Hat Enterprise Linux 8. -
Currently supported offloading FCoE adapters that do use the
fcoe-utils
management tools but have their own kernel drivers instead offcoe.ko
and manage DCBX configuration in their drivers and/or firmware, unless stated in a separate note. Thefnic
,bnx2fc
, andqedf
drivers will continue to be fully supported in Red Hat Enterprise Linux 8. -
The
libfc.ko
andlibfcoe.ko
kernel modules that are required for some of the supported drivers covered by the previous statement.
For more information, see Software FCoE and Fibre Channel no longer support the target mode.
The e1000 network driver is not supported in RHEL 8
In Red Hat Enterprise Linux 8, the e1000 network driver is not supported. This affects both bare metal and virtual environments. However, the newer e1000e network driver continues to be fully supported in RHEL 8.
RHEL 8 does not support the tulip driver
With this update, the tulip network driver is no longer supported. As a consequence, when using RHEL 8 on a Generation 1 virtual machine (VM) on the Microsoft Hyper-V hypervisor, the "Legacy Network Adapter" device does not work, which causes PXE installation of such VMs to fail.
For the PXE installation to work, install RHEL 8 on a Generation 2 Hyper-V VM. If you require a RHEL 8 Generation 1 VM, use ISO installation.
The qla2xxx
driver no longer supports target mode
Support for target mode with the qla2xxx
QLogic Fibre Channel driver has been disabled. The effects of this change are:
-
The kernel no longer provides the
tcm_qla2xxx
module. -
The
rtslib
library and thetargetcli
utility no longer supportqla2xxx
.
Initiator mode with qla2xxx
is still supported.
File systems and storage
File systems
Btrfs has been removed
The Btrfs file system has been removed in Red Hat Enterprise Linux 8. This includes the following components:
-
The
btrfs.ko
kernel module -
The
btrfs-progs
package -
The
snapper
package
You can no longer create, mount, or install on Btrfs file systems in Red Hat Enterprise Linux 8. The Anaconda installer and the Kickstart commands no longer support Btrfs.
XFS now supports shared copy-on-write data extents
The XFS file system supports shared copy-on-write data extent functionality. This feature enables two or more files to share a common set of data blocks. When either of the files sharing common blocks changes, XFS breaks the link to common blocks and creates a new file. This is similar to the copy-on-write (COW) functionality found in other file systems.
Shared copy-on-write data extents are:
- Fast
-
Creating shared copies does not utilize disk I/O.
- Space-efficient
-
Shared blocks do not consume additional disk space.

Userspace utilities can use shared copy-on-write data extents for:
-
Efficient file cloning, such as with the
cp --reflink
command -
Per-file snapshots
This functionality is also used by kernel subsystems such as Overlayfs and NFS for more efficient operation.
Shared copy-on-write data extents are now enabled by default when creating an XFS file system, starting with the xfsprogs
package version 4.17.0-2.el8
.
Note that Direct Access (DAX) devices currently do not support XFS with shared copy-on-write data extents. To create an XFS file system without this feature, use the following command:
# mkfs.xfs -m reflink=0 block-device
Red Hat Enterprise Linux 7 can mount XFS file systems with shared copy-on-write data extents only in the read-only mode.
The ext4 file system now supports metadata checksums
With this update, ext4 metadata is protected by checksums. This enables the file system to recognize the corrupt metadata, which avoids damage and increases the file system resilience.
The /etc/sysconfig/nfs
file and legacy NFS service names are no longer available
In Red Hat Enterprise Linux 8.0, the NFS configuration has moved from the /etc/sysconfig/nfs
configuration file, which was used in Red Hat Enterprise Linux 7, to /etc/nfs.conf
.
The /etc/nfs.conf
file uses a different syntax. Red Hat Enterprise Linux 8 attempts to automatically convert all options from /etc/sysconfig/nfs
to /etc/nfs.conf
when upgrading from Red Hat Enterprise Linux 7.
Both configuration files are supported in Red Hat Enterprise Linux 7. Red Hat recommends that you use the new /etc/nfs.conf
file to make NFS configuration in all versions of Red Hat Enterprise Linux compatible with automated configuration systems.
Additionally, the following NFS service aliases have been removed and replaced by their upstream names:
-
nfs.service
, replaced bynfs-server.service
-
nfs-secure.service
, replaced byrpc-gssd.service
-
rpcgssd.service
, replaced byrpc-gssd.service
-
nfs-idmap.service
, replaced bynfs-idmapd.service
-
rpcidmapd.service
, replaced bynfs-idmapd.service
-
nfs-lock.service
, replaced byrpc-statd.service
-
nfslock.service
, replaced byrpc-statd.service
Storage
The BOOM boot manager simplifies the process of creating boot entries
BOOM is a boot manager for Linux systems that use boot loaders supporting the BootLoader Specification for boot entry configuration. It enables flexible boot configuration and simplifies the creation of new or modified boot entries: for example, to boot snapshot images of the system created using LVM.
BOOM does not modify the existing boot loader configuration, and only inserts additional entries. The existing configuration is maintained, and any distribution integration, such as kernel installation and update scripts, continue to function as before.
BOOM has a simplified command-line interface (CLI) and API that ease the task of creating boot entries.
Stratis is now available
Stratis is a new local storage manager. It provides managed file systems on top of pools of storage with additional features to the user.
Stratis enables you to more easily perform storage tasks such as:
-
Manage snapshots and thin provisioning
-
Automatically grow file system sizes as needed
-
Maintain file systems
To administer Stratis storage, use the stratis
utility, which communicates with the stratisd
background service.
Stratis is provided as a Technology Preview.
For more information, see the Stratis documentation: Managing layered local storage with Stratis.
LUKS2 is now the default format for encrypting volumes
In RHEL 8, the LUKS version 2 (LUKS2) format replaces the legacy LUKS (LUKS1) format. The dm-crypt
subsystem and the cryptsetup
tool now uses LUKS2 as the default format for encrypted volumes. LUKS2 provides encrypted volumes with metadata redundancy and auto-recovery in case of a partial metadata corruption event.
Due to the internal flexible layout, LUKS2 is also an enabler of future features. It supports auto-unlocking through the generic kernel-keyring token built in libcryptsetup
that allow users unlocking of LUKS2 volumes using a passphrase stored in the kernel-keyring retention service.
Other notable enhancements include:
-
The protected key setup using the wrapped key cipher scheme.
-
Easier integration with Policy-Based Decryption (Clevis).
-
Up to 32 key slots - LUKS1 provides only 8 key slots.
For more details, see the cryptsetup(8)
and cryptsetup-reencrypt(8)
man pages.
Multiqueue scheduling on block devices
Block devices now use multiqueue scheduling in Red Hat Enterprise Linux 8. This enables the block layer performance to scale well with fast solid-state drives (SSDs) and multi-core systems.
The SCSI Multiqueue (scsi-mq
) driver is now enabled by default, and the kernel boots with the scsi_mod.use_blk_mq=Y
option. This change is consistent with the upstream Linux kernel.
Device Mapper Multipath (DM Multipath) requires the scsi-mq
driver to be active.
VDO now supports all architectures
Virtual Data Optimizer (VDO) is now available on all of the architectures supported by RHEL 8.
VDO no longer supports read cache
The read cache functionality has been removed from Virtual Data Optimizer (VDO). The read cache is always disabled on VDO volumes, and you can no longer enable it using the --readCache
option of the vdo
utility.
Red Hat might reintroduce the VDO read cache in a later Red Hat Enterprise Linux release, using a different implementation.
The dmraid
package has been removed
The dmraid
package has been removed from Red Hat Enterprise Linux 8. Users requiring support for combined hardware and software RAID host bus adapters (HBA) should use the mdadm
utility, which supports native MD software RAID, the SNIA RAID Common Disk Data Format (DDF), and the Intel® Matrix Storage Manager (IMSM) formats.
Software FCoE and Fibre Channel no longer support the target mode
-
Software FCoE: NIC Software FCoE target functionality is removed in Red Hat Enterprise Linux 8.0.
-
Fibre Channel no longer supports the target mode. Target mode is disabled for the
qla2xxx
QLogic Fibre Channel driver in Red Hat Enterprise Linux 8.0.
For more information, see FCoE software removal.
The detection of marginal paths in DM Multipath has been improved
The multipathd
service now supports improved detection of marginal paths. This helps multipath devices avoid paths that are likely to fail repeatedly, and improves performance. Marginal paths are paths with persistent but intermittent I/O errors.
The following options in the /etc/multipath.conf
file control marginal paths behavior:
-
marginal_path_double_failed_time
-
marginal_path_err_sample_time
-
marginal_path_err_rate_threshold
-
marginal_path_err_recheck_gap_time
DM Multipath disables a path and tests it with repeated I/O for the configured sample time if:
-
the listed
multipath.conf
options are set, -
a path fails twice in the configured time, and
-
other paths are available.
If the path has more than the configured err rate during this testing, DM Multipath ignores it for the configured gap time, and then retests it to see if it is working well enough to be reinstated.
For more information, see the multipath.conf
man page.
New overrides
section of the DM Multipath configuration file
The /etc/multipath.conf
file now includes an overrides
section that allows you to set a configuration value for all of your devices. These attributes are used by DM Multipath for all devices unless they are overwritten by the attributes specified in the multipaths
section of the /etc/multipath.conf
file for paths that contain the device. This functionality replaces the all_devs
parameter of the devices
section of the configuration file, which is no longer supported.
NVMe/FC is fully supported on Broadcom Emulex and Marvell Qlogic Fibre Channel adapters
The NVMe over Fibre Channel (NVMe/FC) transport type is now fully supported in Initiator mode when used with Broadcom Emulex and Marvell Qlogic Fibre Channel 32Gbit adapters that feature NVMe support.
NVMe over Fibre Channel is an additional fabric transport type for the Nonvolatile Memory Express (NVMe) protocol, in addition to the Remote Direct Memory Access (RDMA) protocol that was previously introduced in Red Hat Enterprise Linux.
Enabling NVMe/FC:
-
To enable NVMe/FC in the
lpfc
driver, edit the/etc/modprobe.d/lpfc.conf
file and add the following option:lpfc_enable_fc4_type=3
-
To enable NVMe/FC in the
qla2xxx
driver, edit the/etc/modprobe.d/qla2xxx.conf
file and add the following option:qla2xxx.ql2xnvmeenable=1
Additional restrictions:
-
Multipath is not supported with NVMe/FC.
-
NVMe clustering is not supported with NVMe/FC.
-
With Marvell Qlogic adapters, Red Hat Enterprise Linux does not support using NVMe/FC and SCSI/FC on an initiator port at the same time.
-
kdump
is not supported with NVMe/FC. -
Booting from Storage Area Network (SAN) NVMe/FC is not supported.
Support for Data Integrity Field/Data Integrity Extension (DIF/DIX)
DIF/DIX is an addition to the SCSI Standard. It remains in Technology Preview for all HBAs and storage arrays, except for those specifically listed as supported.
DIF/DIX increases the size of the commonly used 512 byte disk block from 512 to 520 bytes, adding the Data Integrity Field (DIF). The DIF stores a checksum value for the data block that is calculated by the Host Bus Adapter (HBA) when a write occurs. The storage device then confirms the checksum on receipt, and stores both the data and the checksum. Conversely, when a read occurs, the checksum can be verified by the storage device, and by the receiving HBA.
libstoragemgmt-netapp-plugin
has been removed
The libstoragemgmt-netapp-plugin
package used by the libStorageMgmt
library has been removed. It is no longer supported because:
-
The package requires the NetApp 7-mode API, which is being phased out by NetApp.
-
RHEL 8 has removed default support for the TLSv1.0 protocol with the
TLS_RSA_WITH_3DES_EDE_CBC_SHA
cipher, using this plug-in with TLS does not work.
Removal of Cylinder-Head-Sector addressing from sfdisk
and cfdisk
Cylinder-Head-Sector (CHS) addressing is no longer useful for modern storage devices. It has been removed as an option from the sfdisk
and cfdisk
commands. Since RHEL 8, you cannot use the following options:
-
-C, --cylinders number
-
-H, --heads number
-
-S, --sectors number
For more information, see the sfdisk(8)
and cfdisk(8)
man pages.
LVM
Removal of clvmd
for managing shared storage devices
LVM no longer uses clvmd
(cluster lvm daemon) for managing shared storage devices. Instead, LVM now uses lvmlockd
(lvm lock daemon).
-
For details about using
lvmlockd
, see thelvmlockd(8)
man page. For details about using shared storage in general, see thelvmsystemid(7)
man page. -
For information on using LVM in a Pacemaker cluster, see the help screen for the
LVM-activate
resource agent. -
For an example of a procedure to configure a shared logical volume in a Red Hat High Availability cluster, see Configuring a GFS2 file system in a cluster.
Removal of lvmetad
daemon
LVM no longer uses the lvmetad
daemon for caching metadata, and will always read metadata from disk. LVM disk reading has been reduced, which reduces the benefits of caching.
Previously, autoactivation of logical volumes was indirectly tied to the use_lvmetad
setting in the lvm.conf
configuration file. The correct way to disable autoactivation continues to be setting auto_activation_volume_list
in the lvm.conf
file.
LVM can no longer manage devices formatted with the GFS pool volume manager or the lvm1
metadata format.
LVM can no longer manage devices formatted with the GFS pool volume manager or the`lvm1` metadata format. if you created your logical volume before Red Hat Enterprise Linux 4 was introduced, then this may affect you. Volume groups using the lvm1
format should be converted to the lvm2
format using the vgconvert
command.
LVM libraries and LVM Python bindings have been removed
The lvm2app
library and LVM Python bindings, which were provided by the lvm2-python-libs
package, have been removed. Red Hat recommends the following solutions instead:
-
The LVM D-Bus API in combination with the
lvm2-dbusd
service. This requires using Python version 3. -
The LVM command-line utilities with JSON formatting; this formatting has been available since the
lvm2
package version 2.02.158. -
The
libblockdev
library, included in AppStream, for C/C++
You must port any applications using the removed libraries and bindings to the D-Bus API before upgrading to Red Hat Enterprise Linux 8.
The ability to mirror the log for LVM mirrors has been removed
The mirrored log feature of mirrored LVM volumes has been removed. Red Hat Enterprise Linux (RHEL) 8 no longer supports creating or activating LVM volumes with a mirrored mirror log.
The recommended replacements are:
-
RAID1 LVM volumes. The main advantage of RAID1 volumes is their ability to work even in degraded mode and to recover after a transient failure.
-
Disk mirror log. To convert a mirrored mirror log to disk mirror log, use the following command:
lvconvert --mirrorlog disk my_vg/my_lv
.
High availability and clusters
In Red Hat Enterprise Linux 8, pcs
fully supports the Corosync 3 cluster engine and the Kronosnet (knet) network abstraction layer for cluster communication. When planning an upgrade to a RHEL 8 cluster from an existing RHEL 7 cluster, some of the considerations you must take into account are as follows:
-
Application versions: What version of the highly-available application will the RHEL 8 cluster require?
-
Application process order: What may need to change in the start and stop processes of the application?
-
Cluster infrastructure: Since
pcs
supports multiple network connections in RHEL 8, does the number of NICs known to the cluster change? -
Needed packages: Do you need to install all of the same packages on the new cluster?
Because of these and other considerations for running a Pacemaker cluster in RHEL 8, it is not possible to perform in-place upgrades from RHEL 7 to RHEL 8 clusters and you must configure a new cluster in RHEL 8. You cannot run a cluster that includes nodes running both RHEL 7 and RHEL 8.
Additionally, you should plan for the following before performing an upgrade:
-
Final cutover: What is the process to stop the application running on the old cluster and start it on the new cluster to reduce application downtime?
-
Testing: Is it possible to test your upgrade strategy ahead of time in a development/test environment?
The major differences in cluster creation and administration between RHEL 7 and RHEL 8 are listed in the following sections.
New formats for pcs cluster setup
, pcs cluster node add
and pcs cluster node remove
commands
In Red Hat Enterprise Linux 8, pcs
fully supports the use of node names, which are now required and replace node addresses in the role of node identifier. Node addresses are now optional.
-
In the
pcs host auth
command, node addresses default to node names. -
In the
pcs cluster setup
andpcs cluster node add
commands, node addresses default to the node addresses specified in thepcs host auth
command.
With these changes, the formats for the commands to set up a cluster, add a node to a cluster, and remove a node from a cluster have changed. For information on these new command formats, see the help display for the pcs cluster setup
, pcs cluster node add
and pcs cluster node remove
commands.
Master resources renamed to promotable clone resources
Red Hat Enterprise Linux (RHEL) 8 supports Pacemaker 2.0, in which a master/slave resource is no longer a separate type of resource but a standard clone resource with a promotable
meta-attribute set to true
. The following changes have been implemented in support of this update:
-
It is no longer possible to create master resources with the
pcs
command. Instead, it is possible to createpromotable
clone resources. Related keywords and commands have been changed frommaster
topromotable
. -
All existing master resources are displayed as promotable clone resources.
-
When managing a RHEL7 cluster in the Web UI, master resources are still called master, as RHEL7 clusters do not support promotable clones.
New commands for authenticating nodes in a cluster
Red Hat Enterprise Linux (RHEL) 8 incorporates the following changes to the commands used to authenticate nodes in a cluster.
-
The new command for authentication is
pcs host auth
. This command allows users to specify host names, addresses andpcsd
ports. -
The
pcs cluster auth
command authenticates only the nodes in a local cluster and does not accept a node list -
It is now possible to specify an address for each node.
pcs
/pcsd
will then communicate with each node using the specified address. These addresses can be different than the onescorosync
uses internally. -
The
pcs pcsd clear-auth
command has been replaced by thepcs pcsd deauth
andpcs host deauth
commands. The new commands allow users to deauthenticate a single host as well as all hosts. -
Previously, node authentication was bidirectional, and running the
pcs cluster auth
command caused all specified nodes to be authenticated against each other. Thepcs host auth
command, however, causes only the local host to be authenticated against the specified nodes. This allows better control of what node is authenticated against what other nodes when running this command. On cluster setup itself, and also when adding a node,pcs
automatically synchronizes tokens on the cluster, so all nodes in the cluster are still automatically authenticated as before and the cluster nodes can communicate with each other.
Note that these changes are not backward compatible. Nodes that were authenticated on a RHEL 7 system will need to be authenticated again.
LVM volumes in a Red Hat High Availability active/passive cluster
When configuring LVM volumes as resources in a Red Hat HA active/passive cluster in RHEL 8, you configure the volumes as an LVM-activate
resource. In RHEL 7, you configured the volumes as an LVM
resource. For an example of a cluster configuration procedure that includes configuring an LVM volume as a resource in an active/passive cluster in RHEL 8, see
Configuring an active/passive Apache HTTP server in a Red Hat High Availability cluster.
Shared LVM volumes in a Red Hat High Availability active/active cluster
In RHEL 8, LVM uses the LVM lock daemon lvmlockd
instead of clvmd
for managing shared storage devices in an active/active cluster. This requires that you configure the logical volumes on which you mount a GFS2 file system as shared logical volumes.
Additionally, this requires that you use the LVM-activate
resource agent to manage an LVM volume and that you use the lvmlockd
resource agent to manage the lvmlockd
daemon.
For a full procedure for configuring a RHEL 8 Pacemaker cluster that includes GFS2 file systems using shared logical volumes, see Configuring a GFS2 file system in a cluster.
GFS2 file systems in a RHEL 8 Pacemaker cluster
In RHEL 8, LVM uses the LVM lock daemon lvmlockd
instead
of clvmd
for managing shared storage devices in an active/active cluster
as described in
Removal of clvmd
for managing shared storage devices.
To use GFS2 file systems that were created on a RHEL 7 system in a RHEL 8 cluster, you must configure the logical volumes on which they are mounted as shared logical volumes in a RHEL 8 system, and you must start locking for the volume group. For an example of the procedure that configures existing RHEL 7 logical volumes as shared logical volumes for use in a RHEL 8 Pacemaker cluster, see Migrating a GFS2 file system from RHEL7 to RHEL8.
Shells and command-line tools
Localization is distributed in multiple packages
In RHEL 8, locales and translations are no longer provided by the single glibc-common
package. Instead, every locale and language is available in a glibc-langpack-CODE
package. Additionally, not all locales are installed by default, only these selected in the installer. Users must install all further locale packages that they need separately.
The meta-packages which install extra add-on packages containing translations, dictionaries and locales for every package installed on the system are called langpacks.
For more information see Installing and using langpacks.
Removed support for all-numeric user and group names
In Red Hat Enterprise Linux (RHEL) 8, the useradd
and groupadd
commands does not allow you to use user and group names consisting purely of numeric characters. The reason for not allowing such names is that this can confuse tools that work with user and group names and user and group ids, which are numbers.
See more information about Managing users using command-line tools.
The nobody user replaces nfsnobody
Red Hat Enterprise Linux (RHEL) 7 used the nobody
user and group pair with the ID of 99 and the nfsnobody
user and group pair with the ID of 65534, which is also the default kernel overflow ID.
In RHEL 8, both of these pair have been merged into the nobody
user and group pair, which uses the ID of 65534. The nfsnobody
pair is not created in RHEL 8.
This change reduces the confusion about files that are owned by nobody
but are not related to NFS.
Version control systems
RHEL 8 provides the following version control systems:
-
Git 2.18
, a distributed revision control system with a decentralized architecture. -
Mercurial 4.8
, a lightweight distributed version control system, designed for efficient handling of large projects. -
Subversion 1.10
, a centralized version control system.
Note that the Concurrent Versions System (CVS) and Revision Control System (RCS), available in RHEL 7, are not distributed with RHEL 8.
Notable changes in Subversion 1.10
Subversion 1.10
introduces a number of new features since the version 1.7 distributed in RHEL 7, as well as the following compatibility changes:
-
Due to incompatibilities in the
Subversion
libraries used for supporting language bindings,Python 3
bindings forSubversion 1.10
are unavailable. As a consequence, applications that requirePython
bindings forSubversion
are unsupported. -
Repositories based on
Berkeley DB
are no longer supported. Before upgrading, back up repositories created withSubversion 1.7
by using thesvnadmin dump
command. After installing RHEL 8, restore the repositories using thesvnadmin load
command. -
Existing working copies checked out by the
Subversion 1.7
client in RHEL 7 must be upgraded to the new format before they can be used fromSubversion 1.10
. After installing RHEL 8, run thesvn upgrade
command in each working copy. -
Smartcard authentication for accessing repositories using
https://
is no longer supported.
Dynamic programming languages, web servers, database servers
Dynamic programming languages
Notable changes in Python
Python 3
is the default Python
implementation in RHEL 8
Red Hat Enterprise Linux 8 is distributed with several versions of Python 3
. Python 3.6
is going to be supported for the whole life cycle of RHEL 8. The respective package might not be installed by default.
Python 2.7
is available in the python2
package. However, Python 2
will have a shorter life cycle and its aim is to facilitate a smoother transition to Python 3
for customers.
For details, see Python versions.
Neither the default python
package nor the unversioned /usr/bin/python
executable is distributed with RHEL 8. Customers are advised to use python3
or python2
directly. Alternatively, administrators can configure the unversioned python
command using the alternatives
command. See Configuring the unversioned Python.
Migrating from Python 2 to Python 3
As a developer, you may want to migrate your former code that is written in Python 2 to Python 3.
For more information on how to migrate large code bases to Python 3, see The Conservative Python 3 Porting Guide.
Note that after this migration, the original Python 2 code becomes interpretable by the Python 3 interpreter and stays interpretable for the Python 2 interpreter as well.
Unresolved include directive in modules/ROOT/partials/core-services/ref_dynamic-programming-languages.adoc - include::../../../assemblies/assembly_configuring-the-unversioned-python.adoc[]
Unresolved include directive in modules/ROOT/partials/core-services/ref_dynamic-programming-languages.adoc - include::../../../assemblies/assembly_handling-interpreter-directives-in-python-scripts.adoc[]
Notable changes in PHP
Red Hat Enterprise Linux 8 is distributed with PHP 7.2
. This version introduces the following major changes over PHP 5.4
, which is available in RHEL 7:
-
PHP
uses FastCGI Process Manager (FPM) by default (safe for use with a threadedhttpd
) -
The
php_value
andphp-flag
variables should no longer be used in thehttpd
configuration files; they should be set in pool configuration instead:/etc/php-fpm.d/*.conf
-
PHP
script errors and warnings are logged to the/var/log/php-fpm/www-error.log
file instead of/var/log/httpd/error.log
-
When changing the PHP
max_execution_time
configuration variable, thehttpd
ProxyTimeout
setting should be increased to match -
The user running
PHP
scripts is now configured in the FPM pool configuration (the/etc/php-fpm.d/www.conf
file; theapache
user is the default) -
The
php-fpm
service needs to be restarted after a configuration change or after a new extension is installed -
The
zip
extension has been moved from thephp-common
package to a separate package,php-pecl-zip
The following extensions have been removed:
-
aspell
-
mysql
(note that themysqli
andpdo_mysql
extensions are still available, provided byphp-mysqlnd
package) -
memcache
Notable changes in Perl
Perl 5.26
, distributed with RHEL 8, introduces the following changes over the version available in RHEL 7:
-
Unicode 9.0
is now supported. -
New
op-entry
,loading-file
, andloaded-file
SystemTap
probes are provided. -
Copy-on-write mechanism is used when assigning scalars for improved performance.
-
The
IO::Socket::IP
module for handling IPv4 and IPv6 sockets transparently has been added. -
The
Config::Perl::V
module to accessperl -V
data in a structured way has been added. -
A new
perl-App-cpanminus
package has been added, which contains thecpanm
utility for getting, extracting, building, and installing modules from the Comprehensive Perl Archive Network (CPAN) repository. -
The current directory
.
has been removed from the@INC
module search path for security reasons. -
The
do
statement now returns a deprecation warning when it fails to load a file because of the behavioral change described above. -
The
do subroutine(LIST)
call is no longer supported and results in a syntax error. -
Hashes are randomized by default now. The order in which keys and values are returned from a hash changes on each
perl
run. To disable the randomization, set thePERL_PERTURB_KEYS
environment variable to0
. -
Unescaped literal
{
characters in regular expression patterns are no longer permissible. -
Lexical scope support for the
$_
variable has been removed. -
Using the
defined
operator on an array or a hash results in a fatal error. -
Importing functions from the
UNIVERSAL
module results in a fatal error. -
The
find2perl
,s2p
,a2p
,c2ph
, andpstruct
tools have been removed. -
The
${^ENCODING}
facility has been removed. Theencoding
pragma’s default mode is no longer supported. To write source code in other encoding thanUTF-8
, use the encoding’sFilter
option. -
The
perl
packaging is now aligned with upstream. Theperl
package installs also core modules, while the/usr/bin/perl
interpreter is provided by theperl-interpreter
package. In previous releases, theperl
package included just a minimal interpreter, whereas theperl-core
package included both the interpreter and the core modules. -
The
IO::Socket::SSL
Perl module no longer loads a certificate authority certificate from the./certs/my-ca.pem
file or the./ca
directory, a server private key from the./certs/server-key.pem
file, a server certificate from the./certs/server-cert.pem
file, a client private key from the./certs/client-key.pem
file, and a client certificate from the./certs/client-cert.pem
file. Specify the paths to the files explicitly instead.
Notable changes in Ruby
RHEL 8 provides Ruby 2.5
, which introduces numerous new features and enhancements over Ruby 2.0.0
available in RHEL 7. Notable changes include:
-
Incremental garbage collector has been added.
-
The
Refinements
syntax has been added. -
Symbols are now garbage collected.
-
The
$SAFE=2
and$SAFE=3
safe levels are now obsolete. -
The
Fixnum
andBignum
classes have been unified into theInteger
class. -
Performance has been improved by optimizing the
Hash
class, improved access to instance variables, and theMutex
class being smaller and faster. -
Certain old APIs have been deprecated.
-
Bundled libraries, such as
RubyGems
,Rake
,RDoc
,Psych
,Minitest
, andtest-unit
, have been updated. -
Other libraries, such as
mathn
,DL
,ext/tk
, andXMLRPC
, which were previously distributed withRuby
, are deprecated or no longer included. -
The
SemVer
versioning scheme is now used forRuby
versioning.
Notable changes in SWIG
RHEL 8 includes the Simplified Wrapper and Interface Generator (SWIG) version 3.0, which provides numerous new features, enhancements, and bug fixes over the version 2.0 distributed in RHEL 7. Most notably, support for the C++11 standard has been implemented. SWIG
now supports also Go 1.6
, PHP 7
, Octave 4.2
, and Python 3.5
.
Node.js
new in RHEL
Node.js
, a software development platform for building fast and scalable network applications in the JavaScript programming language, is provided for the first time in RHEL. It was previously available only as a Software Collection. RHEL 8 provides Node.js 10
.
Unresolved include directive in modules/ROOT/partials/core-services/ref_dynamic-programming-languages.adoc - include::../../assembly_tcl.adoc[]
Web servers
Notable changes in the Apache HTTP Server
The Apache HTTP Server, has been updated from version 2.4.6 to version 2.4.37 between RHEL 7 and RHEL 8. This updated version includes several new features, but maintains backwards compatibility with the RHEL 7 version at the level of configuration and Application Binary Interface (ABI) of external modules.
New features include:
-
HTTP/2
support is now provided by themod_http2
package, which is a part of thehttpd
module. -
systemd socket activation is supported. See
httpd.socket(8)
man page for more details.
-
Multiple new modules have been added:
-
mod_proxy_hcheck
- a proxy health-check module -
mod_proxy_uwsgi
- a Web Server Gateway Interface (WSGI) proxy -
mod_proxy_fdpass
- provides support for the passing the socket of the client to another process -
mod_cache_socache
- an HTTP cache using, for example, memcache backend -
mod_md
- an ACME protocol SSL/TLS certificate service
-
-
The following modules now load by default:
-
mod_request
-
mod_macro
-
mod_watchdog
-
-
A new subpackage,
httpd-filesystem
, has been added, which contains the basic directory layout for the Apache HTTP Server including the correct permissions for the directories. -
Instantiated service support,
<EMAIL_ADDRESS>has been introduced. See thehttpd.service
man page for more information.
-
A new
httpd-init.service
replaces the%post script
to create a self-signedmod_ssl
key pair.
-
Automated TLS certificate provisioning and renewal using the Automatic Certificate Management Environment (ACME) protocol is now supported with the
mod_md
package (for use with certificate providers such asLet’s Encrypt
). -
The Apache HTTP Server now supports loading TLS certificates and private keys from hardware security tokens directly from
PKCS#11
modules. As a result, amod_ssl
configuration can now usePKCS#11
URLs to identify the TLS private key, and, optionally, the TLS certificate in theSSLCertificateKeyFile
andSSLCertificateFile
directives. -
A new
ListenFree
directive in the/etc/httpd/conf/httpd.conf
file is now supported.Similarly to the
Listen
directive,ListenFree
provides information about IP addresses, ports, or IP address-and-port combinations that the server listens to. However, withListenFree
, theIP_FREEBIND
socket option is enabled by default. Hence,httpd
is allowed to bind to a nonlocal IP address or to an IP address that does not exist yet. This allowshttpd
to listen on a socket without requiring the underlying network interface or the specified dynamic IP address to be up at the time whenhttpd
is trying to bind to it.Note that the
ListenFree
directive is currently available only in RHEL 8.For more details on
ListenFree
, see the following table:Table 2. ListenFree directive’s syntax, status, and modules Syntax Status Modules ListenFree [IP-address:]portnumber [protocol]
MPM
event, worker, prefork, mpm_winnt, mpm_netware, mpmt_os2
Other notable changes include:
-
The following modules have been removed:
-
mod_file_cache
-
mod_nss
Use
mod_ssl
as a replacement. For details about migrating frommod_nss
, see the Exporting a private key and certificates from an NSS database to use them in an Apache web server configuration section in theDeploying different types of servers
documentation. -
mod_perl
-
-
The default type of the DBM authentication database used by the Apache HTTP Server in RHEL 8 has been changed from
SDBM
todb5
. -
The
mod_wsgi
module for the Apache HTTP Server has been updated to Python 3. WSGI applications are now supported only with Python 3, and must be migrated from Python 2. -
The multi-processing module (MPM) configured by default with the Apache HTTP Server has changed from a multi-process, forked model (known as
prefork
) to a high-performance multi-threaded model,event
.Any third-party modules that are not thread-safe need to be replaced or removed. To change the configured MPM, edit the
/etc/httpd/conf.modules.d/00-mpm.conf
file. See thehttpd.service(8)
man page for more information. -
The minimum UID and GID allowed for users by suEXEC are now 1000 and 500, respectively (previously 100 and 100).
-
The
/etc/sysconfig/httpd
file is no longer a supported interface for setting environment variables for thehttpd
service. Thehttpd.service(8)
man page has been added for the systemd service. -
Stopping the
httpd
service now uses a “graceful stop” by default. -
The
mod_auth_kerb
module has been replaced by themod_auth_gssapi
module.
For instructions on deploying, see Setting up the Apache HTTP web server.
The nginx
web server new in RHEL
RHEL 8 introduces nginx 1.14
, a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. nginx
was previously available only as a Software Collection.
The nginx
web server now supports loading TLS private keys from hardware security tokens directly from PKCS#11
modules. As a result, an nginx
configuration can use PKCS#11
URLs to identify the TLS private key in the ssl_certificate_key
directive.
Apache Tomcat has been removed
The Apache Tomcat server has been removed from Red Hat Enterprise Linux. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Red Hat recommends that users requiring a servlet container use the JBoss Web Server.
Proxy caching servers
Varnish Cache
new in RHEL
Varnish Cache
, a high-performance HTTP reverse proxy, is provided for the first time in RHEL. It was previously available only as a Software Collection. Varnish Cache
stores files or fragments of files in memory that are used to reduce the response time and network bandwidth consumption on future equivalent requests. RHEL 8.0 is distributed with Varnish Cache 6.0
.
Notable changes in Squid
RHEL 8.0 is distributed with Squid 4.4
, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. This release provides numerous new features, enhancements, and bug fixes over the version 3.5 available in RHEL 7.
Notable changes include:
-
Configurable helper queue size
-
Changes to helper concurrency channels
-
Changes to the helper binary
-
Secure Internet Content Adaptation Protocol (ICAP)
-
Improved support for Symmetric Multi Processing (SMP)
-
Improved process management
-
Removed support for SSL
-
Removed Edge Side Includes (ESI) custom parser
-
Multiple configuration changes
Database servers
RHEL 8 provides the following database servers:
-
MySQL 8.0
, a multi-user, multi-threaded SQL database server. It consists of theMySQL
server daemon,mysqld
, and many client programs. -
MariaDB 10.3
, a multi-user, multi-threaded SQL database server. For all practical purposes,MariaDB
is binary-compatible withMySQL
. -
PostgreSQL 10
andPostgreSQL 9.6
, an advanced object-relational database management system (DBMS). -
Redis 5
, an advanced key-value store. It is often referred to as a data structure server because keys can contain strings, hashes, lists, sets, and sorted sets.Redis
is provided for the first time in RHEL.
Note that the NoSQL MongoDB
database server is not included in RHEL 8.0 because it uses the Server Side Public License (SSPL).
Database servers are not installable in parallel
The mariadb
and mysql
modules cannot be installed in parallel in RHEL 8.0 due to conflicting RPM packages.
By design, it is impossible to install more than one version (stream) of the same module in parallel. For example, you need to choose only one of the available streams from the postgresql
module, either 10
(default) or 9.6
. Parallel installation of components is possible in Red Hat Software Collections for RHEL 6 and RHEL 7. In RHEL 8, different versions of database servers can be used in containers.
Notable changes in MariaDB 10.3
MariaDB 10.3
provides numerous new features over the version 5.5 distributed in RHEL 7, such as:
-
Common table expressions
-
System-versioned tables
-
FOR
loops -
Invisible columns
-
Sequences
-
Instant
ADD COLUMN
forInnoDB
-
Storage-engine independent column compression
-
Parallel replication
-
Multi-source replication
In addition, the new mariadb-connector-c
packages provide a common client library for MySQL
and MariaDB
. This library is usable with any version of the MySQL
and MariaDB
database servers. As a result, the user is able to connect one build of an application to any of the MySQL
and MariaDB
servers distributed with RHEL 8.
Other notable changes include:
-
MariaDB Galera Cluster
, a synchronous multi-master cluster, is now a standard part ofMariaDB
. -
InnoDB
is used as the default storage engine instead ofXtraDB
. -
The mariadb-bench subpackage has been removed.
-
The default allowed level of the plug-in maturity has been changed to one level less than the server maturity. As a result, plug-ins with a lower maturity level that were previously working, will no longer load.
Notable changes in MySQL 8.0
RHEL 8 is distributed with MySQL 8.0
, which provides, for example, the following enhancements:
-
MySQL
now incorporates a transactional data dictionary, which stores information about database objects. -
MySQL
now supports roles, which are collections of privileges. -
The default character set has been changed from
latin1
toutf8mb4
. -
Support for common table expressions, both nonrecursive and recursive, has been added.
-
MySQL
now supports window functions, which perform a calculation for each row from a query, using related rows. -
InnoDB
now supports theNOWAIT
andSKIP LOCKED
options with locking read statements. -
GIS-related functions have been improved.
-
JSON functionality has been enhanced.
-
The new
mariadb-connector-c
packages provide a common client library forMySQL
andMariaDB
. This library is usable with any version of theMySQL
andMariaDB
database servers. As a result, the user is able to connect one build of an application to any of theMySQL
andMariaDB
servers distributed with RHEL 8.
In addition, the MySQL 8.0
server distributed with RHEL 8 is configured to use mysql_native_password
as the default authentication plug-in because client tools and libraries in RHEL 8 are incompatible with the caching_sha2_password
method, which is used by default in the upstream MySQL 8.0
version.
To change the default authentication plug-in to caching_sha2_password
, edit the /etc/my.cnf.d/mysql-default-authentication-plugin.cnf
file as follows:
[mysqld] default_authentication_plugin=caching_sha2_password
Notable changes in PostgreSQL
RHEL 8.0 provides two versions of the PostgreSQL
database server, distributed in two streams of the postgresql
module: PostgreSQL 10
(the default stream) and PostgreSQL 9.6
. RHEL 7 includes PostgreSQL
version 9.2.
Notable changes in PostgreSQL 9.6
are, for example:
-
Parallel execution of the sequential operations:
scan
,join
, andaggregate
-
Enhancements to synchronous replication
-
Improved full-text search enabling users to search for phrases
-
The
postgres_fdw
data federation driver now supports remotejoin
,sort
,UPDATE
, andDELETE
operations -
Substantial performance improvements, especially regarding scalability on multi-CPU-socket servers
Major enhancements in PostgreSQL 10
include:
-
Logical replication using the
publish
andsubscribe
keywords -
Stronger password authentication based on the
SCRAM-SHA-256
mechanism -
Declarative table partitioning
-
Improved query parallelism
-
Significant general performance improvements
-
Improved monitoring and control
Compilers and development tools
Unresolved include directive in modules/ROOT/partials/assembly_compilers-and-development-tools.adoc - include::assembly_changes-in-toolchain-since-rhel-7.adoc[] :leveloffset: +1
Compiler toolsets
RHEL 8 provides the following compiler toolsets as Application Streams:
-
LLVM Toolset 11.0.0, which provides the LLVM compiler infrastructure framework, the Clang compiler for the C and C++ languages, the LLDB debugger, and related tools for code analysis. See the Using LLVM Toolset guide.
-
Rust Toolset 1.49.0, which provides the Rust programming language compiler
rustc
, thecargo
build tool and dependency manager, thecargo-vendor
plugin, and required libraries. See the Using Rust Toolset guide. -
Go Toolset 1.15.7, which provides the Go programming language tools and libraries. Go is alternatively known as
golang
. See the Using Go Toolset guide.
Java implementations and Java tools in RHEL 8
The RHEL 8 AppStream repository includes:
-
The
java-11-openjdk
packages, which provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. -
The
java-1.8.0-openjdk
packages, which provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. -
The
icedtea-web
packages, which provide an implementation of Java Web Start. -
The
ant
module, providing a Java library and command-line tool for compiling, assembling, testing, and running Java applications.Ant
has been updated to version 1.10. -
The
maven
module, providing a software project management and comprehension tool.Maven
was previously available only as a Software Collection or in the unsupported Optional channel. -
The
scala
module, providing a general purpose programming language for the Java platform.Scala
was previously available only as a Software Collection.
In addition, the java-1.8.0-ibm
packages are distributed through the Supplementary repository. Note that packages in this repository are unsupported by Red Hat.
Compatibility-breaking changes in GDB
The version of GDB provided in Red Hat Enterprise Linux 8 contains a number of changes that break compatibility, especially for cases where the GDB output is read directly from the terminal. The following sections provide more details about these changes.
Parsing output of GDB is not recommended. Prefer scripts using the Python GDB API or the GDB Machine Interface (MI).
GDBserver now starts inferiors with shell
To enable expansion and variable substitution in inferior command line arguments, GDBserver now starts the inferior in a shell, same as GDB.
To disable using the shell:
-
When using the
target extended-remote
GDB command, disable shell with theset startup-with-shell off
command. -
When using the
target remote
GDB command, disable shell with the--no-startup-with-shell
option of GDBserver.
This example shows how running the /bin/echo /*
command through GDBserver differs on Red Hat Enterprise Linux versions 7 and 8:
-
On RHEL 7:
$ gdbserver --multi :1234 $ gdb -batch -ex 'target extended-remote :1234' -ex 'set remote exec-file /bin/echo' -ex 'file /bin/echo' -ex 'run /*' /*
-
On RHEL 8:
$ gdbserver --multi :1234 $ gdb -batch -ex 'target extended-remote :1234' -ex 'set remote exec-file /bin/echo' -ex 'file /bin/echo' -ex 'run /*' /bin /boot (...) /tmp /usr /var
gcj
support removed
Support for debugging Java programs compiled with the GNU Compiler for Java (gcj
) has been removed.
New syntax for symbol dumping maintenance commands
The symbol dumping maintenance commands syntax now includes options before file names. As a result, commands that worked with GDB in RHEL 7 do not work in RHEL 8.
As an example, the following command no longer stores symbols in a file, but produces an error message:
(gdb) maintenance print symbols /tmp/out main.c
The new syntax for the symbol dumping maintenance commands is:
maint print symbols [-pc address] [--] [filename] maint print symbols [-objfile objfile] [-source source] [--] [filename] maint print psymbols [-objfile objfile] [-pc address] [--] [filename] maint print psymbols [-objfile objfile] [-source source] [--] [filename] maint print msymbols [-objfile objfile] [--] [filename]
Thread numbers are no longer global
Previously, GDB used only global thread numbering. The numbering has been extended to be displayed per inferior in the form inferior_num.thread_num
, such as 2.1
. As a consequence, thread numbers in the $_thread
convenience variable and in the InferiorThread.num
Python attribute are no longer unique between inferiors.
GDB now stores a second thread ID per thread, called the global thread ID, which is the new equivalent of thread numbers in previous releases. To access the global thread number, use the $_gthread
convenience variable and InferiorThread.global_num
Python attribute.
For backwards compatibility, the Machine Interface (MI) thread IDs always contains the global IDs.
On Red Hat Enterprise Linux 7:
# debuginfo-install coreutils $ gdb -batch -ex 'file echo' -ex start -ex 'add-inferior' -ex 'inferior 2' -ex 'file echo' -ex start -ex 'info threads' -ex 'pring $_thread' -ex 'inferior 1' -ex 'pring $_thread' (...) Id Target Id Frame * 2 process 203923 "echo" main (argc=1, argv=0x7fffffffdb88) at src/echo.c:109 1 process 203914 "echo" main (argc=1, argv=0x7fffffffdb88) at src/echo.c:109 $1 = 2 (...) $2 = 1
On Red Hat Enterprise Linux 8:
# dnf debuginfo-install coreutils $ gdb -batch -ex 'file echo' -ex start -ex 'add-inferior' -ex 'inferior 2' -ex 'file echo' -ex start -ex 'info threads' -ex 'pring $_thread' -ex 'inferior 1' -ex 'pring $_thread' (...) Id Target Id Frame 1.1 process 4106488 "echo" main (argc=1, argv=0x7fffffffce58) at ../src/echo.c:109 * 2.1 process 4106494 "echo" main (argc=1, argv=0x7fffffffce58) at ../src/echo.c:109 $1 = 1 (...) $2 = 1
Memory for value contents can be limited
Previously, GDB did not limit the amount of memory allocated for value contents. As a consequence, debugging incorrect programs could cause GDB to allocate too much memory. The max-value-size
setting has been added to enable limiting the amount of allocated memory. The default value of this limit is 64 KiB. As a result, GDB in Red Hat Enterprise Linux 8 will not display too large values, but report that the value is too large instead.
As an example, printing a value defined as char s[128*1024];
produces different results:
-
On Red Hat Enterprise Linux 7,
$1 = 'A' <repeats 131072 times>
-
On Red Hat Enterprise Linux 8,
value requires 131072 bytes, which is more than max-value-size
Sun version of stabs format no longer supported
Support for the Sun version of the stabs
debug file format has been removed. The stabs
format produced by GCC in RHEL with the gcc -gstabs
option is still supported by GDB.
Sysroot handling changes
The set sysroot path
command specifies system root when searching for files needed for debugging. Directory names supplied to this command may now be prefixed with the string target:
to make GDB read the shared libraries from the target system (both local and remote). The formerly available remote:
prefix is now treated as target:
. Additionally, the default system root value has changed from an empty string to target:
for backward compatibility.
The specified system root is prepended to the file name of the main executable, when GDB starts processes remotely, or when it attaches to already running processes (both local and remote). This means that for remote processes, the default value target:
makes GDB always try to load the debugging information from the remote system. To prevent this, run the set sysroot
command before the target remote
command so that local symbol files are found before the remote ones.
HISTSIZE no longer controls GDB command history size
Previously, GDB used the HISTSIZE
environment variable to determine how long command history should be kept. GDB has been changed to use the GDBHISTSIZE
environment variable instead. This variable is specific only to GDB. The possible values and their effects are:
-
a positive number - use command history of this size,
-
-1
or an empty string - keep history of all commands, -
non-numeric values - ignored.
Completion limiting added
The maximum number of candidates considered during completion can now be limited using the set max-completions
command. To show the current limit, run the show max-completions
command. The default value is 200. This limit prevents GDB from generating excessively large completion lists and becoming unresponsive.
As an example, the output after the input p <tab><tab>
is:
-
on RHEL 7:
Display all 29863 possibilities? (y or n)
-
on RHEL 8:
Display all 200 possibilities? (y or n)
HP-UX XDB compatibility mode removed
The -xdb
option for the HP-UX XDB compatibility mode has been removed from GDB.
Handling signals for threads
Previously, GDB could deliver a signal to the current thread instead of the thread for which the signal was actually sent. This bug has been fixed, and GDB now always passes the signal to the correct thread when resuming execution.
Additionally, the signal
command now always correctly delivers the requested signal to the current thread. If the program is stopped for a signal and the user switched threads, GDB asks for confirmation.
Breakpoint modes always-inserted off and auto merged
The breakpoint always-inserted
setting has been changed. The auto
value and corresponding behavior has been removed. The default value is now off
. Additionally, the off
value now causes GDB to not remove breakpoints from the target until all threads stop.
remotebaud commands no longer supported
The set remotebaud
and show remotebaud
commands are no longer supported. Use the set serial baud
and show serial baud
commands instead.
Compatibility-breaking changes in compilers and development tools
librtkaio removed
With this update, the librtkaio library has been removed. This library provided high-performance real-time asynchronous I/O access for some files, which was based on Linux kernel Asynchronous I/O support (KAIO).
As a result of the removal:
-
Applications using the
LD_PRELOAD
method to load librtkaio display a warning about a missing library, load the librt library instead and run correctly. -
Applications using the
LD_LIBRARY_PATH
method to load librtkaio load the librt library instead and run correctly, without any warning. -
Applications using the
dlopen()
system call to access librtkaio directly load the librt library instead.
Users of librtkaio have the following options:
-
Use the fallback mechanism described above, without any changes to their applications.
-
Change code of their applications to use the librt library, which offers a compatible POSIX-compliant API.
-
Change code of their applications to use the libaio library, which offers a compatible API.
Both librt and libaio can provide comparable features and performance under specific conditions.
Note that the libaio package has Red Hat compatibility level of 2, while librtk and the removed librtkaio level 1.
For more details, see https://fedoraproject.org/wiki/Changes/GLIBC223_librtkaio_removal
Sun RPC and NIS interfaces removed from glibc
The glibc
library no longer provides Sun RPC and NIS interfaces for new applications. These interfaces are now available only for running legacy applications. Developers must change their applications to use the libtirpc
library instead of Sun RPC and libnsl2
instead of NIS. Applications can benefit from IPv6 support in the replacement libraries.
The nosegneg
libraries for 32-bit Xen have been removed
Previously, the glibc
i686 packages contained an alternative glibc
build, which avoided the use of the thread descriptor segment register with negative offsets (nosegneg
). This alternative build was only used in the 32-bit version of the Xen Project hypervisor without hardware virtualization support, as an optimization to reduce the cost of full paravirtualization. These alternative builds are no longer used and they have been removed.
make
new operator !=
causes a different interpretation of certain existing makefile syntax
The !=
shell assignment operator has been added to GNU make
as an alternative to the $(shell …)
function to increase compatibility with BSD makefiles. As a consequence, variables with name ending in exclamation mark and immediately followed by assignment such as variable!=value
are now interpreted as the shell assignment. To restore the previous behavior, add a space after the exclamation mark, such as variable! =value
.
For more details and differences between the operator and the function, see the GNU make
manual.
Valgrind library for MPI debugging support removed
The libmpiwrap.so
wrapper library for Valgrind provided by the valgrind-openmpi
package has been removed. This library enabled Valgrind to debug programs using the Message Passing Interface (MPI). This library was specific to the Open MPI implementation version in previous versions of Red Hat Enterprise Linux.
Users of libmpiwrap.so
are encouraged to build their own version from upstream sources specific to their MPI implementation and version. Supply these custom-built libraries to Valgrind using the LD_PRELOAD
technique.
Development headers and static libraries removed from valgrind-devel
Previously, the valgrind-devel
sub-package used to include development files for developing custom valgrind tools. This update removes these files because they do not have a guaranteed API, have to be linked statically, and are unsupported. The valgrind-devel
package still does contain the development files for valgrind-aware programs and header files such as valgrind.h
, callgrind.h
, drd.h
, helgrind.h
, and memcheck.h
, which are stable and well-supported.
Identity Management
Identity Management packages are installed as a module
In RHEL 8, the packages necessary for installing an Identity Management (IdM) server and client are distributed as a module. The client
stream is the default stream of the idm
module, and you can download the packages necessary for installing the client without enabling the stream.
The IdM server module stream is called DL1
and contains multiple profiles that correspond to the different types of IdM servers:
-
server
: an IdM server without integrated DNS -
dns
: an IdM server with integrated DNS -
adtrust
: an IdM server that has a trust agreement with Active Directory -
client
: an IdM client
To download the packages in a specific profile of the DL1
stream:
-
Enable the stream:
# yum module enable idm:DL1
-
Switch to the RPMs delivered through the stream:
# yum distro-sync
-
Install the selected profile:
# yum module install idm:DL1/profile
Replace profile with one of the specific profiles defined above.
Active Directory users can now administer Identity Management
In Red Hat Enterprise Linux (RHEL) 7, external group membership allows AD users and groups to access IdM resources in a POSIX environment with the help of the System Security Services Daemon (SSSD).
The IdM LDAP server has its own mechanisms to grant access control. RHEL 8 introduces an update that allows adding an ID user override for an AD user as a member of an IdM group. An ID override is a record describing what a specific Active Directory user or group properties should look like within a specific ID view, in this case the Default Trust View. As a consequence of the update, the IdM LDAP server is able to apply access control rules for the IdM group to the AD user.
AD users are now able to use the self service features of IdM UI, for example to upload their SSH keys, or change their personal data. An AD administrator is able to fully administer IdM without having two different accounts and passwords.
|
Currently, selected features in IdM may still be unavailable to AD users. For example, setting passwords for IdM users as an AD user from the IdM |
Session recording solution for RHEL 8 added