Considerations in adopting RHEL 8 (2024)

The Open Security Content Automation Protocol (OSCAP) add-on is enabled by default in RHEL 8.

The Kdump add-on adds support for configuring kernel crash dumping during installation. This add-on has full support in Kickstart (using the %addon com_redhat_kdump command and its options), and is fully integrated as an additional window in the graphical and text-based user interfaces.

Since RedHat EnterpriseLinux 8.2, you can register your system, attach RHEL subscriptions, and install from the Red Hat Content Delivery Network (CDN) before package installation. Interactive GUI installations, as well as automated Kickstart installations, support this feature. For more information, see the RHEL 8.2 Release Notes document.

Red Hat Insights is a managed service that gathers and analyzes platform and application data to predict risk, recommend actions, and track costs. Insights alerts you about warnings or optimizations that are relevant to several operational areas: system availability (including potential outages), security (for example, a new CVE is discovered for your systems), and business (such as overspending). Insights is included as part of your Red Hat subscription and is accessible through the Red Hat Hybrid Cloud Console. See also the Red Hat Insights documentation.

Since RedHat EnterpriseLinux 8.2, you can register your system to Red Hat Insights during installation. Interactive GUI installations, as well as automated Kickstart installations, support this feature. For more information, see the RHEL 8.2 Release Notes document.

In RedHat EnterpriseLinux 8, a unified ISO automatically loads the BaseOS and AppStream installation source repositories. This feature works for the first base repository that is loaded during installation. For example, if you boot the installation with no repository configured and have the unified ISO as the base repository in the graphical user interface (GUI), or if you boot the installation using the inst.repo= option that points to the unified ISO.

As a result, the AppStream repository is enabled under the Additional Repositories section of the Installation Source GUI window. You cannot remove the AppStream repository or change its settings but you can disable it in Installation Source. This feature does not work if you boot the installation using a different base repository and then change it to the unified ISO. If you do that, the base repository is replaced. However, the AppStream repository is not replaced and points to the original file.

In RedHat EnterpriseLinux 8, multiple network locations of stage2 or Kickstart files can be specified to prevent installation failure. This update enables the specification of multiple inst.stage2 and inst.ks boot options with network locations of stage2 and a Kickstart file. This avoids the situation in which the requested files cannot be reached and the installation fails because the contacted server with the stage2 or the Kickstart file is inaccessible.

With this new update, the installation failure can be avoided if multiple locations are specified. If all the defined locations are URLs, namely HTTP, HTTPS, or FTP, they will be tried sequentially until the requested file is fetched successfully. If there is a location that is not a URL, only the last specified location is tried. The remaining locations are ignored.

Previously, you could only specify a base repository from the kernel boot parameters. In RedHat EnterpriseLinux 8, a new kernel parameter, inst.addrepo=<name>,<url>, allows you to specify an additional repository during installation. This parameter has two mandatory values: the name of the repository and the URL that points to the repository. For more information, see the inst-addrepo usage.

RedHat EnterpriseLinux 8 supports installing from a repository on a local hard drive. Previously, the only installation method from a hard drive was using an ISO image as the installation source. However, the RedHat EnterpriseLinux 8 ISO image might be too big for some file systems; for example, the FAT32 file system cannot store files larger than 4 GiB. In RedHat EnterpriseLinux 8, you can enable installation from a repository on a local hard drive; you only need to specify the directory instead of the ISO image. For example: inst.repo=hd:<device>:<path to the repository>.

For more information about the RedHat EnterpriseLinux 8 BaseOS and AppStream repositories, see the Repositories section of this document.

The Installation Summary window of the RedHat EnterpriseLinux 8 graphical installation has been updated to a new three-column layout that provides improved organization of graphical installation settings.

Previously, the RedHat EnterpriseLinux installation program did not provide system purpose information to Subscription Manager. In RedHat EnterpriseLinux 8, you can set the intended purpose of the system during a graphical installation by using the System Purpose window, or in a Kickstart configuration file by using the syspurpose command. When you set a system’s purpose, the entitlement server receives information that helps auto-attach a subscription that satisfies the intended use of the system.

Previously, it was not possible for the pykickstart library to provide system purpose information to Subscription Manager. In RedHat EnterpriseLinux 8, pykickstart parses the new syspurpose command and records the intended purpose of the system during automated and partially-automated installation. The information is then passed to the installation program, saved on the newly-installed system, and available for Subscription Manager when subscribing the system.

In RedHat EnterpriseLinux 8, the installation program has been extended to handle all modular features. Kickstart scripts can now enable module and stream combinations, install module profiles, and install modular packages.

The following Kickstart commands and options have been deprecated in RedHat EnterpriseLinux8.

Where only specific options are listed, the base command and its other options are still available and not deprecated.

Except the auth or authconfig command, using the commands in Kickstart files prints a warning in the logs.

You can turn the deprecated command warnings into errors with the inst.ksstrict boot option, except for the auth or authconfig command.

The following Kickstart commands and options have been completely removed in RedHat EnterpriseLinux8. Using them in Kickstart files will cause an error.

Where only specific options and values are listed, the base command and its other options are still available and not removed.

The Image Builder tool enables users to create customized RHEL images. As of Red Hat Enterprise Linux 8.3, Image Builder runs as a system service osbuild-composer package.

With Image Builder, users can create custom system images which include additional packages. Image Builder functionality can be accessed through:

Image Builder output formats include, among others:

To learn more about Image Builder, see the documentation title Composing a customized RHEL system image.

On RedHat EnterpriseLinux 8, installing software is ensured by the YUM tool, which is based on the DNF technology (YUM v4). We deliberately adhere to usage of the yum term for consistency with previous major versions of RHEL. However, if you type dnf instead of yum, the command works as expected because yum is an alias to dnf for compatibility.

For more details, see Installing, managing, and removing user-space components.

YUM v4 has the following advantages over the previous YUM v3 used on RHEL 7:

For detailed information about differences between the new YUM v4 tool and the previous version YUM v3 from RHEL 7, see Changes in DNF CLI compared to YUM.

Installing software

YUM v4 is compatible with YUM v3 when using from the command line, editing or creating configuration files.

For installing software, you can use the yum command and its particular options in the same way as on RHEL 7.

See more detailed information about Installing software packages.

Availability of plug-ins

Legacy YUM v3 plug-ins are incompatible with the new version of YUM v4. Selected yum plug-ins and utilities have been ported to the new DNF back end, and can be installed under the same names as in RHEL 7. They also provide compatibility symlinks, so the binaries, configuration files and directories can be found in usual locations.

In the event that a plug-in is no longer included, or a replacement does not meet a usability need, please reach out to Red Hat Support to request a Feature Enhancement as described in How do I open and manage a support case on the Customer Portal?

For more information, see Plugin Interface.

Availability of APIs

Note that the legacy Python API provided by YUM v3 is no longer available. Users are advised to migrate their plug-ins and scripts to the new API provided by YUM v4 (DNF Python API), which is stable and fully supported. The upstream project documents the new DNF Python API - see the DNF API Reference.

The Libdnf and Hawkey APIs (both C and Python) are to be considered unstable, and will likely change during RHEL 8 life cycle.

The changes in configuration file options between RHEL 7 and RHEL 8 for the /etc/yum.conf and /etc/yum.repos.d/*.repo files are documented in the following summary.

Some of the YUM v3 features may behave differently in YUM v4. If any such change negatively impacts your workflows, please open a case with Red Hat Support, as described in How do I open and manage a support case on the Customer Portal?

[…​]package-1.2 repo1package-1.2 repo2[…​]

[…​]package-1.2 repo1[…​]

The changes in the transaction history log files between RHEL 7 and RHEL 8 are documented in the following summary.

In RHEL 7, the /var/log/yum.log file stores:

In RHEL 8, there is no direct equivalent to the /var/log/yum.log file. To display the information about the transactions, including the PackageKit and microdnf, use the yum history command.

Alternatively, you can search the /var/log/dnf.rpm.log file, but this log file does not include the transactions from PackageKit and microdnf, and it has a log rotation which provides the periodic removal of the stored information.

RHEL 8 no longer supports the use of delta rpms. To utilize delta rpms, a user must install the deltarpm package which is no longer available. The deltarpm replacement, drpm, does not provide the same functionality. Thus, the RHEL 8 content is not delivered in the deltarpm format. Note that this functionality will be completely removed in future RHEL releases.

RHEL 7 supported two implementations of the NTP protocol: ntp and chrony.

In RHEL 8, the NTP protocol is implemented only by the chronyd daemon, provided by the chrony package.

The ntp daemon is no longer available. If you used ntp on your RHEL 7 system, you might need to migrate to chrony.

Possible replacements for previous ntp features that are not supported by chrony are documented in Achieving some settings previously supported by ntp in chrony.

chrony is an implementation of NTP, which performs well in a wide range of conditions, including intermittent network connections, heavily congested networks, changing temperatures (ordinary computer clocks are sensitive to temperature), and systems that do not run continuously, or run on a virtual machine.

You can use chrony:

For more information about chrony, see Configuring basic system settings.

For more information about how to configure NTP using the chrony suite, see Configuring time synchronization.

The Print Settings configuration tool, which was used in RHEL 7, is no longer available.

To achieve various tasks related to printing, you can choose one of the following tools:

For more information about print setting tools in RHEL 8, see Configuring printing.

CUPS provides three kinds of logs:

In RHEL 8, the logs are no longer stored in specific files within the /var/log/cups directory, which was used in RHEL 7. Instead, all three types are logged centrally in systemd-journald together with logs from other programs.

For more information about how to use CUPS logs in RHEL 8, see Accessing the CUPS logs in the systemd journal.

For more information about how to configure printing in RHEL 8, see Configuring printing.

In RHEL 8, the recommended TuneD profile, reported by the tuned-adm recommend command, is selected based on the following rules:

Note that the first rule that matches takes effect.

Crypto-policies is a component in Red Hat Enterprise Linux 8, which configures the core cryptographic subsystems, covering the TLS, IPsec, DNSSEC, Kerberos protocols, and the OpenSSH suite. It provides a small set of policies, which the administrator can select using the update-crypto-policies command.

The DEFAULT system-wide cryptographic policy offers secure settings for current threat models. It allows the TLS 1.2 and 1.3 protocols, as well as the IKEv2 and SSH2 protocols. The RSA keys and Diffie-Hellman parameters are accepted if larger than 2047 bits.

See the Consistent security by crypto policies in Red Hat Enterprise Linux 8 article on the Red Hat Blog and the update-crypto-policies(8) man page for more information.

The following list contains cipher suites and protocols removed from the core cryptographic libraries in RHEL 8. They are not present in the sources, or their support is disabled during the build, so applications cannot use them.

The following cipher suites and protocols are disabled in all crypto policy levels. They can be enabled only by an explicit configuration of individual applications.

The system-wide cryptographic policies contain a policy level that enables cryptographic modules self-checks in accordance with the requirements by Federal Information Processing Standard (FIPS) Publication 140-2. The fips-mode-setup tool that enables or disables FIPS mode internally uses the FIPS system-wide cryptographic policy level.

To switch the system to FIPS mode in RHEL 8, enter the following command and restart your system:

# fips-mode-setup --enable

See the fips-mode-setup(8) man page for more information.

The TLS 1.0 and TLS 1.1 protocols are disabled in the DEFAULT system-wide cryptographic policy level. If your scenario, for example, a video conferencing application in the Firefox web browser, requires using the deprecated protocols, switch the system-wide cryptographic policy to the LEGACY level:

# update-crypto-policies --set LEGACY

For more information, see the Strong crypto defaults in RHEL 8 and deprecation of weak crypto algorithms Knowledgebase article on the Red Hat Customer Portal and the update-crypto-policies(8) man page.

This update enables Transport Layer Security (TLS) 1.3 by default in all major back-end crypto libraries. This enables low latency across the operating system communications layer and enhances privacy and security for applications by taking advantage of new algorithms, such as RSA-PSS or X25519.

The Digital Signature Algorithm (DSA) is considered deprecated in Red Hat Enterprise Linux 8. Authentication mechanisms that depend on DSA keys do not work in the default configuration. Note that OpenSSH clients do not accept DSA host keys even in the LEGACY system-wide cryptographic policy level.

The Transport Layer Security (TLS) protocol version 1.2 and earlier allow to start a negotiation with a Client Hello message formatted in a way that is backward compatible with the Secure Sockets Layer (SSL) protocol version 2. Support for this feature in the Network Security Services (NSS) library has been deprecated and it is disabled by default.

Applications that require support for this feature need to use the new SSL_ENABLE_V2_COMPATIBLE_HELLO API to enable it. Support for this feature may be removed completely in future releases of Red Hat Enterprise Linux 8.

The Network Security Services (NSS) libraries now use the SQL file format for the trust database by default. The DBM file format, which was used as a default database format in previous releases, does not support concurrent access to the same database by multiple processes and it has been deprecated in upstream. As a result, applications that use the NSS trust database to store keys, certificates, and revocation information now create databases in the SQL format by default. Attempts to create databases in the legacy DBM format fail. The existing DBM databases are opened in read-only mode, and they are automatically converted to the SQL format. Note that NSS support the SQL file format since Red Hat Enterprise Linux 6.

The openssh packages have been upgraded to upstream version 7.8p1. Notable changes include:

This change introduces libssh as a core cryptographic component in Red Hat Enterprise Linux 8. The libssh library implements the Secure SHell (SSH) protocol.

The deprecated libssh2 library misses features, such as support for elliptic curves or Generic Security Service Application Program Interface (GSSAPI), and it has been removed from RHEL 8 in favor of libssh

The configuration files in the rsyslog packages now use the non-legacy format by default. The legacy format can be still used, although mixing current and legacy configuration statements has several constraints. Configurations carried from previous RHEL releases should be revised. See the rsyslog.conf(5) man page for more information.

To avoid duplicate records that might appear when journald rotated its files, the imjournal option has been added. Note that use of this option can affect performance.

Note that the system with rsyslog can be configured to provide better performance as described in the Configuring system logging without journald or with minimized journald usage Knowledgebase article.

The default logging environment setup might consume 4 GB of memory or even more and adjustments of rate-limit values are complex when systemd-journald is running with rsyslog.

See the Negative effects of the RHEL default logging setup on performance and their mitigations Knowledgebase article for more information.

This update provides OpenSCAP shared library API that has been consolidated. 63 symbols have been removed, 14 added, and 4 have an updated signature. The removed symbols in OpenSCAP 1.3.0 include:

In RHEL 8.2, a new utility for security and compliance scanning of containers has been introduced. The oscap-podman tool provides an equivalent of the oscap-docker utility that serves for scanning container and container images in RHEL 7.

For more information, see the Scanning container and container images for vulnerabilities section.

With this update, functionality of audispd has been moved to auditd. As a result, audispd configuration options are now part of auditd.conf. In addition, the plugins.d directory has been moved under /etc/audit. The current status of auditd and its plug-ins can now be checked by running the service auditd state command.

The init_t domain type is no longer unconfined on RHEL 8. This might cause problems for third-party applications that use a different SELinux labeling approach.

To overcome SELinux labeling problems in the non-standard locations, you can configure file context equivalency for such locations.

This approach assigns correct labels to the majority of files and directories installed in the non-standard location, which also leads to correctly labeled processes started by some of the executable files.

To remove file context equivalency, use the following command:

# semanage fcontext -d -e / /my/apps

The RHEL 8 SELinux policy provides the following additional port types:

Furthermore, the definitions of the dns_port_t and ephemeral_port_t port types have been changed, and the gluster_port_t port type has been removed.

The useradd and groupadd commands disallow user and group names consisting purely of numeric characters. The reason for not allowing such names is that this can confuse potentially many tools that work with user and group names and user and group ids (which are numbers). Please note that the all-numeric user and group names are deprecated in Red Hat Enterprise Linux 7 and their support is completely removed in Red Hat Enterprise Linux 8.

Because of the dynamic nature of tty device files on modern Linux systems, the securetty PAM module has been disabled by default and the /etc/securetty configuration file is no longer included in RHEL. Since /etc/securetty listed many possible devices so that the practical effect in most cases was to allow by default, this change has only a minor impact. However, if you use a more restrictive configuration, you need to add a line enabling the pam_securetty.so module to the appropriate files in the /etc/pam.d directory, and create a new /etc/securetty file.

The Clevis HTTP pin has been removed from RHEL 8, and the clevis encrypt http sub-command is no longer available.

Network scripts are deprecated in Red Hat Enterprise Linux 8 and are no longer provided by default. The basic installation provides a new version of the ifup and ifdown scripts which call NetworkManager through the nmcli tool. In RedHat EnterpriseLinux8, to run the ifup and the ifdown scripts, NetworkManager must be running.

#yum install network-scripts

In Red Hat Enterprise Linux 8, NetworkManager allows configuring the number of virtual functions (VF) for interfaces that support single-root I/O virtualization (SR-IOV). Additionally, NetworkManager allows configuring some attributes of the VFs, such as the MAC address, VLAN, the spoof checking setting and allowed bitrates. Note that all properties related to SR-IOV are available in the sriov connection setting. For more details, see the nm-settings(5) man page.

Previously, it was possible to restrict a connection to a given interface using only an exact match on the interface name. With this update, connections have a new match.interface-name property which supports wildcards. This update enables users to choose the interface for a connection in a more flexible way using a wildcard pattern.

With this enhancement, NetworkManager supports configuring ethtool offload features, and users no longer need to use init scripts or a NetworkManager dispatcher script. As a result, users can now configure the offload feature as a part of the connection profile using one of the following methods:

Note that this feature is currently not supported in graphical interfaces and in the nmtui utility.

For further details, see Configuring an ethtool offload feature by using nmcli.

NetworkManager supports the internal and dhclient DHCP plug-ins. By default, NetworkManager in Red Hat Enterprise Linux (RHEL) 7 uses the dhclient and RHEL 8 the internal plug-in. In certain situations, the plug-ins behave differently. For example, dhclient can use additional settings specified in the /etc/dhcp/ directory.

If you upgrade from RHEL 7 to RHEL 8 and NetworkManager behaves differently, add the following setting to the [main] section in the /etc/NetworkManager/NetworkManager.conf file to use the dhclient plug-in:

[main]dhcp=dhclient

The NetworkManager-config-server package is only installed by default if you select either the Server or Server with GUI base environment during the setup. If you selected a different environment, use the yum install NetworkManager-config-server command to install the package.

The nftables framework provides packet classification facilities and it is the designated successor to the iptables, ip6tables, arptables, ebtables, and ipset tools. It offers numerous improvements in convenience, features, and performance over previous packet-filtering tools, most notably:

Similarly to iptables, nftables use tables for storing chains. The chains contain individual rules for performing actions. The nft tool replaces all tools from the previous packet-filtering frameworks. The libnftables library can be used for low-level interaction with nftables Netlink API over the libmnl library.

The iptables, ip6tables, ebtables and arptables tools are replaced by nftables-based drop-in replacements with the same name. While external behavior is identical to their legacy counterparts, internally they use nftables with legacy netfilter kernel modules through a compatibility interface where required.

Effect of the modules on the nftables rule set can be observed using the nft list ruleset command. Since these tools add tables, chains, and rules to the nftables rule set, be aware that nftables rule-set operations, such as the nft flush ruleset command, might affect rule sets installed using the formerly separate legacy commands.

To quickly identify which variant of the tool is present, version information has been updated to include the back-end name. In RHEL 8, the nftables-based iptables tool prints the following version string:

$ iptables --versioniptables v1.8.0 (nf_tables)

For comparison, the following version information is printed if legacy iptables tool is present:

$ iptables --versioniptables v1.8.0 (legacy)

The arptables FORWARD chain functionality has been removed in Red Hat Enterprise Linux (RHEL) 8. You can now use the FORWARD chain of the ebtables tool adding the rules into it.

In RHEL 8, the ebtables command is provided by the iptables-ebtables package, which contains an nftables-based reimplementation of the tool. This tool has a different code base, and its output deviates in aspects, which are either negligible or deliberate design choices.

Consequently, when migrating your scripts parsing some ebtables output, adjust the scripts to reflect the following:

This update adds the iptables-translate and ip6tables-translate tools to convert the existing iptables or ip6tables rules into the equivalent ones for nftables. Note that some extensions lack translation support. If such an extension exists, the tool prints the untranslated rule prefixed with the # sign. For example:

| % iptables-translate -A INPUT -j CHECKSUM --checksum-fill| nft # -A INPUT -j CHECKSUM --checksum-fill

Additionally, users can use the iptables-restore-translate and ip6tables-restore-translate tools to translate a dump of rules. Note that before that, users can use the iptables-save or ip6tables-save commands to print a dump of current rules. For example:

| % sudo iptables-save >/tmp/iptables.dump| % iptables-restore-translate -f /tmp/iptables.dump| # Translated by iptables-restore-translate v1.8.0 on Wed Oct 17 17:00:13 2018| add table ip nat| ...

In Red Hat Enterprise Linux (RHEL) 8, the wpa_supplicant package is built with CONFIG_DEBUG_SYSLOG enabled. This allows reading the wpa_supplicant log using the journalctl utility instead of checking the contents of the /var/log/wpa_supplicant.log file.

The wpa_supplicant package does not support wireless extensions. When a user is trying to use wext as a command-line argument, or trying to use it on old adapters which only support wireless extensions, will not be able to run the wpa_supplicant daemon.

A new TCP congestion control algorithm, Bottleneck Bandwidth and Round-trip time (BBR) is now supported in Red Hat Enterprise Linux (RHEL) 8. BBR attempts to determine the bandwidth of the bottleneck link and the Round-trip time (RTT). Most congestion algorithms are based on packet loss, including CUBIC, the default Linux TCP congestion control algorithm, which have problems on high-throughput links. BBR does not react to loss events directly, it adjusts the TCP pacing rate to match it with the available bandwidth.

For more information about this, see the How to configure TCP BBR congestion control algorithm article.

In Red Hat Enterprise Linux 8.0, the kernel includes support for IPVLAN virtual network drivers. With this update, IPVLAN virtual Network Interface Cards (NICs) enable the network connectivity for multiple containers exposing a single MAC address to the local network. This allows a single host to have a lot of containers overcoming the possible limitation on the number of MAC addresses supported by the peer networking equipment.

The firmware of certain network adapters does not fully support the 802.1ad standard, which is also called Q-in-Q or stacked virtual local area networks (VLANs). Contact your hardware vendor on details how to verify that your network adapter uses a firmware that supports the 802.1ad standard and how to update the firmware. As a result, with the correct firmware, configuring stacked VLANs on RHEL 8.0 work as expected.

Control group v2 mechanism is a unified hierarchy control group. Control group v2 organizes processes hierarchically and distributes system resources along the hierarchy in a controlled and configurable manner.

Unlike the previous version, control group v2 has only a single hierarchy. This single hierarchy enables the Linux kernel to:

Control group v2 supports numerous controllers:

The information above was based on cgroups-v2 online documentation. You can refer to the same link to obtain more information about particular control group v2 controllers.

With this update, support for 52-bit physical addressing (PA) for the 64-bit ARM architecture is available. This provides a larger physical address space than previous 48-bit PA.

In RHEL 7, existing memory bus had 48/46 bit of virtual/physical memory addressing capacity, and the Linux kernel implemented 4 levels of page tables to manage these virtual addresses to physical addresses. The physical bus addressing line put the physical memory upper limit capacity at 64 TB.

These limits have been extended to 57/52 bit of virtual/physical memory addressing with 128 PiB of virtual address space (64PB user/64PB kernel) and 4 PB of physical memory capacity.

With the extended address range, the memory management in RHEL 8 adds support for 5-level page table implementation. This implementation is able to handle the expanded address range with up to 128 PiB of virtual address space and 4 PiB of physical address space.

The 5-level page table is enabled by default for hardware capable of supporting this feature even if the installed physical memory is less than 64 TiB. For systems with less than 64 TiB of memory, there is a small overhead increase in walking the 5-level page table. To avoid this overhead, users can disable 5-level page table by using the no5lvl kernel command-line parameter to force the use of 4-level page table.

The bpftool utility that serves for inspection and simple manipulation of programs and maps based on extended Berkeley Packet Filtering (eBPF) has been added into the Linux kernel. bpftool is a part of the kernel source tree, and is provided by the bpftool package, which is included as a sub-package of the kernel package.

The extended Berkeley Packet Filtering (eBPF) feature is available as a Technology Preview for both networking and tracing. eBPF enables the user space to attach custom programs onto a variety of points (sockets, trace points, packet reception) to receive and process data. The feature includes a new system call bpf(), which supports creating various types of maps, and also to insert various types of programs into the kernel. Note that the bpf() syscall can be successfully used only by a user with the CAP_SYS_ADMIN capability, such as a root user. See the bpf(2) man page for more information.

BPF Compiler Collection (BCC) is a user space tool kit for creating efficient kernel tracing and manipulation programs that is available as a Technology Preview in RHEL 8. BCC provides tools for I/O analysis, networking, and monitoring of Linux operating systems using the extended Berkeley Packet Filtering (eBPF).

The Boot Loader Specification (BLS) defines a scheme and file format to manage bootloader configurations for each boot option in a drop-in directory. There is no need to manipulate the individual drop-in configuration files. This premise is particularly relevant in RHEL 8 because not all architectures use the same bootloader:

Each bootloader has a different configuration file and format that has to be modified when a new kernel is installed or removed. In the previous versions of RHEL, the component that permitted this work was the grubby utility. However, for RHEL8 the bootloader configuration was standardized by implementing the BLS file format, where grubby works as a thin wrapper around the BLS operations.

Previously, the kdump service started too late to register the kernel crashes that occurred in early stages of the booting process. As a result, the crash information together with a chance for troubleshooting was lost.

To address this problem, RHEL8 introduced an early kdump support. To learn more about this mechanism, see the /usr/share/doc/kexec-tools/early-kdump-howto.txt file. See also What is early kdump support and how do I configure it?.

Support for the following device drivers has been removed in RHEL 8:

Support for the adapters listed below has been removed in RHEL 8. Support for other than listed adapters from the mentioned drivers remains unchanged.

PCI IDs are in the format of vendor:device:subvendor:subdevice. If the subdevice or subvendor:subdevice entry is not listed, devices with any values of such missing entries have been removed.

To check the PCI IDs of the hardware on your system, run the lspci -nn command.

The Btrfs file system has been removed in Red Hat Enterprise Linux 8. This includes the following components:

You can no longer create, mount, or install on Btrfs file systems in Red Hat Enterprise Linux 8. The Anaconda installer and the Kickstart commands no longer support Btrfs.

With this update, ext4 metadata is protected by checksums. This enables the file system to recognize the corrupt metadata, which avoids damage and increases the file system resilience.

In Red Hat Enterprise Linux 8.0, the NFS configuration has moved from the /etc/sysconfig/nfs configuration file, which was used in Red Hat Enterprise Linux 7, to /etc/nfs.conf.

The /etc/nfs.conf file uses a different syntax. Red Hat Enterprise Linux 8 attempts to automatically convert all options from /etc/sysconfig/nfs to /etc/nfs.conf when upgrading from Red Hat Enterprise Linux 7.

Both configuration files are supported in Red Hat Enterprise Linux 7. Red Hat recommends that you use the new /etc/nfs.conf file to make NFS configuration in all versions of Red Hat Enterprise Linux compatible with automated configuration systems.

Additionally, the following NFS service aliases have been removed and replaced by their upstream names:

BOOM is a boot manager for Linux systems that use boot loaders supporting the BootLoader Specification for boot entry configuration. It enables flexible boot configuration and simplifies the creation of new or modified boot entries: for example, to boot snapshot images of the system created using LVM.

BOOM does not modify the existing boot loader configuration, and only inserts additional entries. The existing configuration is maintained, and any distribution integration, such as kernel installation and update scripts, continue to function as before.

BOOM has a simplified command-line interface (CLI) and API that ease the task of creating boot entries.

Stratis is a new local storage manager. It provides managed file systems on top of pools of storage with additional features to the user.

Stratis enables you to more easily perform storage tasks such as:

To administer Stratis storage, use the stratis utility, which communicates with the stratisd background service.

Stratis is provided as a Technology Preview.

For more information, see the Stratis documentation: Setting up Stratis file systems.

In RHEL 8, the LUKS version 2 (LUKS2) format replaces the legacy LUKS (LUKS1) format. The dm-crypt subsystem and the cryptsetup tool now uses LUKS2 as the default format for encrypted volumes. LUKS2 provides encrypted volumes with metadata redundancy and auto-recovery in case of a partial metadata corruption event.

Due to the internal flexible layout, LUKS2 is also an enabler of future features. It supports auto-unlocking through the generic kernel-keyring token built in libcryptsetup that allow users unlocking of LUKS2 volumes using a passphrase stored in the kernel-keyring retention service.

Other notable enhancements include:

For more details, see the cryptsetup(8) and cryptsetup-reencrypt(8) man pages.

Block devices now use multiqueue scheduling in Red Hat Enterprise Linux 8. This enables the block layer performance to scale well with fast solid-state drives (SSDs) and multi-core systems.

The SCSI Multiqueue (scsi-mq) driver is now enabled by default, and the kernel boots with the scsi_mod.use_blk_mq=Y option. This change is consistent with the upstream Linux kernel.

Device Mapper Multipath (DM Multipath) requires the scsi-mq driver to be active.

Virtual Data Optimizer (VDO) is now available on all of the architectures supported by RHEL 8.

The read cache functionality has been removed from Virtual Data Optimizer (VDO). The read cache is always disabled on VDO volumes, and you can no longer enable it using the --readCache option of the vdo utility.

Red Hat might reintroduce the VDO read cache in a later Red Hat Enterprise Linux release, using a different implementation.

The dmraid package has been removed from Red Hat Enterprise Linux 8. Users requiring support for combined hardware and software RAID host bus adapters (HBA) should use the mdadm utility, which supports native MD software RAID, the SNIA RAID Common Disk Data Format (DDF), and the Intel® Matrix Storage Manager (IMSM) formats.

For more information, see FCoE software removal.

The multipathd service now supports improved detection of marginal paths. This helps multipath devices avoid paths that are likely to fail repeatedly, and improves performance. Marginal paths are paths with persistent but intermittent I/O errors.

The following options in the /etc/multipath.conf file control marginal paths behavior:

DM Multipath disables a path and tests it with repeated I/O for the configured sample time if:

If the path has more than the configured err rate during this testing, DM Multipath ignores it for the configured gap time, and then retests it to see if it is working well enough to be reinstated.

For more information, see the multipath.conf man page.

The /etc/multipath.conf file now includes an overrides section that allows you to set a configuration value for all of your devices. These attributes are used by DM Multipath for all devices unless they are overwritten by the attributes specified in the multipaths section of the /etc/multipath.conf file for paths that contain the device. This functionality replaces the all_devs parameter of the devices section of the configuration file, which is no longer supported.

The NVMe over Fibre Channel (NVMe/FC) transport type is now fully supported in Initiator mode when used with Broadcom Emulex and Marvell Qlogic Fibre Channel 32Gbit adapters that feature NVMe support.

NVMe over Fibre Channel is an additional fabric transport type for the Nonvolatile Memory Express (NVMe) protocol, in addition to the Remote Direct Memory Access (RDMA) protocol that was previously introduced in Red Hat Enterprise Linux.

Enabling NVMe/FC:

Additional restrictions:

DIF/DIX is an addition to the SCSI Standard. It remains in Technology Preview for all HBAs and storage arrays, except for those specifically listed as supported.

DIF/DIX increases the size of the commonly used 512 byte disk block from 512 to 520 bytes, adding the Data Integrity Field (DIF). The DIF stores a checksum value for the data block that is calculated by the Host Bus Adapter (HBA) when a write occurs. The storage device then confirms the checksum on receipt, and stores both the data and the checksum. Conversely, when a read occurs, the checksum can be verified by the storage device, and by the receiving HBA.

The libstoragemgmt-netapp-plugin package used by the libStorageMgmt library has been removed. It is no longer supported because:

Cylinder-Head-Sector (CHS) addressing is no longer useful for modern storage devices. It has been removed as an option from the sfdisk and cfdisk commands. Since RHEL 8, you cannot use the following options:

For more information, see the sfdisk(8) and cfdisk(8) man pages.

LVM no longer uses the lvmetad daemon for caching metadata, and will always read metadata from disk. LVM disk reading has been reduced, which reduces the benefits of caching.

Previously, autoactivation of logical volumes was indirectly tied to the use_lvmetad setting in the lvm.conf configuration file. The correct way to disable autoactivation continues to be setting auto_activation_volume_list in the lvm.conf file.

LVM can no longer manage devices formatted with the GFS pool volume manager or the`lvm1` metadata format. if you created your logical volume before Red Hat Enterprise Linux 4 was introduced, then this may affect you. Volume groups using the lvm1 format should be converted to the lvm2 format using the vgconvert command.

The lvm2app library and LVM Python bindings, which were provided by the lvm2-python-libs package, have been removed. Red Hat recommends the following solutions instead:

You must port any applications using the removed libraries and bindings to the D-Bus API before upgrading to Red Hat Enterprise Linux 8.

The mirrored log feature of mirrored LVM volumes has been removed. Red Hat Enterprise Linux (RHEL) 8 no longer supports creating or activating LVM volumes with a mirrored mirror log.

The recommended replacements are:

Subversion 1.10 introduces a number of new features since the version 1.7 distributed in RHEL 7, as well as the following compatibility changes:

Red Hat Enterprise Linux 8 is distributed with PHP 7.2. This version introduces the following major changes over PHP 5.4, which is available in RHEL 7:

The following extensions have been removed:

Perl 5.26, distributed with RHEL 8, introduces the following changes over the version available in RHEL 7:

RHEL 8 provides Ruby 2.5, which introduces numerous new features and enhancements over Ruby 2.0.0 available in RHEL 7. Notable changes include:

RHEL 8 includes the Simplified Wrapper and Interface Generator (SWIG) version 3.0, which provides numerous new features, enhancements, and bug fixes over the version 2.0 distributed in RHEL 7. Most notably, support for the C++11 standard has been implemented. SWIG now supports also Go 1.6, PHP 7, Octave 4.2, and Python 3.5.

Node.js, a software development platform for building fast and scalable network applications in the JavaScript programming language, is provided for the first time in RHEL. It was previously available only as a Software Collection. RHEL 8 provides Node.js 10.

RHEL 8 is distributed with Tcl/Tk version 8.6, which provides multiple notable changes over Tcl/Tk version 8.5:

For more detailed information about Tcl/Tk version 8.6 changes and new feaures, see the following resources:

If you need to migrate to Tcl/Tk 8.6, see Migration path for users scripting their tasks with Tcl/Tk.

The Apache HTTP Server has been updated from version 2.4.6 in RHEL 7 to version 2.4.37 in RHEL 8. This updated version includes several new features, but maintains backwards compatibility with the RHEL 7 version at the level of configuration and Application Binary Interface (ABI) of external modules.

New features include:

Other notable changes include:

For instructions on deploying, see Setting up the Apache HTTP web server.

RHEL 8 introduces nginx 1.14, a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. nginx was previously available only as a Software Collection.

The nginx web server now supports loading TLS private keys from hardware security tokens directly from PKCS#11 modules. As a result, an nginx configuration can use PKCS#11 URLs to identify the TLS private key in the ssl_certificate_key directive.

The Apache Tomcat server was removed from Red Hat Enterprise Linux 8.0 and reintroduced in RHEL 8.8. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0.

Users of earlier minor versions than RHEL 8.8 who require a servlet container can use the JBoss Web Server.

Varnish Cache, a high-performance HTTP reverse proxy, is provided for the first time in RHEL. It was previously available only as a Software Collection. Varnish Cache stores files or fragments of files in memory that are used to reduce the response time and network bandwidth consumption on future equivalent requests. RHEL 8.0 is distributed with Varnish Cache 6.0.

RHEL 8.0 is distributed with Squid 4.4, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. This release provides numerous new features, enhancements, and bug fixes over the version 3.5 available in RHEL 7.

Notable changes include:

MariaDB 10.3 provides numerous new features over the version 5.5 distributed in RHEL 7, such as:

In addition, the new mariadb-connector-c packages provide a common client library for MySQL and MariaDB. This library is usable with any version of the MySQL and MariaDB database servers. As a result, the user is able to connect one build of an application to any of the MySQL and MariaDB servers distributed with RHEL 8.

Other notable changes include:

See also Using MariaDB on Red Hat Enterprise Linux 8.

RHEL 8 is distributed with MySQL 8.0, which provides, for example, the following enhancements:

In addition, the MySQL 8.0 server distributed with RHEL 8 is configured to use mysql_native_password as the default authentication plug-in because client tools and libraries in RHEL 8 are incompatible with the caching_sha2_password method, which is used by default in the upstream MySQL 8.0 version.

To change the default authentication plug-in to caching_sha2_password, edit the /etc/my.cnf.d/mysql-default-authentication-plugin.cnf file as follows:

[mysqld]default_authentication_plugin=caching_sha2_password

RHEL 8.0 provides two versions of the PostgreSQL database server, distributed in two streams of the postgresql module: PostgreSQL 10 (the default stream) and PostgreSQL 9.6. RHEL 7 includes PostgreSQL version 9.2.

Notable changes in PostgreSQL 9.6 are, for example:

Major enhancements in PostgreSQL 10 include:

See also Using PostgreSQL on Red Hat Enterprise Linux 8.

In RedHat EnterpriseLinux8, the GCC toolchain is based on the GCC 8.2 release series. Notable changes since RedHat EnterpriseLinux7 include:

This following are changes in GCC related to security and added since the release of RedHat EnterpriseLinux7.0.

C++ ABI change in std::string and std::list

The Application Binary Interface (ABI) of the std::string and std::list classes from the libstdc++ library changed between RHEL 7 (GCC 4.8) and RHEL 8 (GCC 8) to conform to the C++11 standard. The libstdc++ library supports both the old and new ABI, but some other C++ system libraries do not. As a consequence, applications that dynamically link against these libraries will need to be rebuilt. This affects all C++ standard modes, including C++98. It also affects applications built with Red Hat Developer Toolset compilers for RHEL 7, which kept the old ABI to maintain compatibility with the system libraries.

GCC no longer builds Ada, Go, and Objective C/C++ code

Capability for building code in the Ada (GNAT), GCC Go, and Objective C/C++ languages has been removed from the GCC compiler.

To build Go code, use the Go Toolset instead.

Because ntpd has been deprecated in favor of chronyd in RHEL 8, IdM servers are no longer configured as Network Time Protocol (NTP) servers and are only configured as NTP clients. The RHEL 7 NTP Server IdM server role has also been deprecated in RHEL 8.

The OpenLDAP suite in previous versions of Red Hat Enterprise Linux (RHEL) used the Mozilla Network Security Services (NSS) for cryptographic purposes. With RHEL 8, OpenSSL, which is supported by the OpenLDAP community, replaces NSS. OpenSSL does not support NSS databases for storing certificates and keys. However, it still supports privacy enhanced mail (PEM) files that serve the same purpose.

In Red Hat Enterprise Linux (RHEL) 8, the python-gssapi package has replaced Python Kerberos packages such as python-krbV, python-kerberos, python-requests-kerberos, and python-urllib2_kerberos. Notable benefits include:

The GSSAPI-based packages allow the use of other Generic Security Services API (GSSAPI) mechanisms in addition to Kerberos, such as the NT LAN Manager NTLM for backward compatibility reasons.

This update improves the maintainability and debuggability of GSSAPI in RHEL 8.

In RHEL 8, the default setting for the ad_gpo_access_control option is enforcing, which ensures that access control rules based on Active Directory Group Policy Objects (GPOs) are evaluated and enforced.

In contrast, the default for this option in RHEL 7 is permissive, which evaluates but does not enforce GPO-based access control rules. With permissive mode, a syslog message is recorded every time a user would be denied access by a GPO, but those users are still allowed to log in.

For more information about GPOs, see Applying Group Policy Object access control in RHEL and the ad_gpo_access_control entry in the sssd-ad Manual page.

In RHEL 8, the authselect utility replaces the authconfig utility. authselect comes with a safer approach to PAM stack management that makes the PAM configuration changes simpler for system administrators. authselect can be used to configure authentication methods such as passwords, certificates, smart cards and fingerprint. authselect does not configure services required to join remote domains. This task is performed by specialized tools, such as realmd or ipa-client-install.

In RHEL 8, the default credential cache storage is the Kerberos Credential Manager (KCM) which is backed by the sssd-kcm deamon. KCM overcomes the limitations of the previously used KEYRING, such as its being difficult to use in containerized environments because it is not namespaced, and to view and manage quotas.

With this update, RHEL 8 contains a credential cache that is better suited for containerized environments and that provides a basis for building more features in future releases.

With this update, the sssctl utility of the System Security Services Daemon (SSSD) can print an access control report for an Identity Management (IdM) domain. This feature meets the need of certain environments to see, for regulatory reasons, a list of users and groups that can access a specific client machine. Running sssctl access-report domain_name on an IdM client prints the parsed subset of host-based access control (HBAC) rules in the IdM domain that apply to the client machine.

Note that no other providers than IdM support this feature.

In RHEL 8.8 and later, the System Security Services Daemon (SSSD) files provider, which serves users and groups from the /etc/passwd and /etc/group files, is disabled by default. The default value of the enable_files_domain setting in the /etc/sssd/sssd.conf configuration file is false.

For RHEL 8.7 and earlier versions, the SSSD files provider is enabled by default. The default value of the enable_files_domain setting in the sssd.conf configuration file is true, and the sss nsswitch module precedes files in the /etc/nsswitch.conf file.

By default, the System Security Services Daemon (SSSD) tries to detect a device for smart-card authentication automatically. If there are multiple devices connected, SSSD selects the first one it detects. Consequently, you cannot select a particular device, which sometimes leads to failures.

With this update, you can configure a new p11_uri option for the [pam] section of the sssd.conf configuration file. This option enables you to define which device is used for smart-card authentication.

For example, to select a reader with the slot id 2 detected by the OpenSC PKCS#11 module, add:

p11_uri = library-description=OpenSC%20smartcard%20framework;slot-id=2

to the [pam] section of sssd.conf.

For details, see the man sssd.conf page.

The sssd-secrets component of the System Security Services Daemon (SSSD) has been removed in Red Hat Enterprise Linux 8. This is because Custodia, a secrets service provider, is no longer actively developed. Use other Identity Management tools to store secrets, for example the Identity Management Vault.

The SSSD implementation of the libwbclient package allowed the Samba smbd service to retrieve user and group information from AD without the need to run the winbind service. As Samba now requires that the winbind service is running and handling communication with AD, the related code has been removed from smdb for security reasons. As this additional required functionality is not part of SSSD and the SSSD implementation of libwbclient cannot be used with recent versions of Samba, the SSSD implementation of libwbclient has been removed in RHEL 8.5.

GNOME Shell, version 3.28 is available in RHEL 8. Notable enhancements include:

GNOME 3 provides two essential environments:

Both environments can use two different protocols to build a graphical user interface:

The default combination in RHEL 8 is GNOME Standard environment using GNOME Shell on Wayland as the display server.

However, you may want to switch to another combination of GNOME Shell environment and graphics protocol stack. For more information, see Section21.3, “Selecting GNOME environment and display protocol”.

In RHEL 8, the Desktop icons functionality is no longer provided by the Nautilus file manager, but by the desktop icons gnome-shell extension.

To be able to use the extension, you must install the gnome-shell-extension-desktop-icons package available in the Appstream repository.

On a GNOME Shell on Wayland session, the fractional scaling feature is available. The feature makes it possible to scale the GUI by fractions, which improves the appearance of scaled GUI on certain displays.

Note that the feature is currently considered experimental and is, therefore, disabled by default.

To enable fractional scaling, run the following command:

# gsettings set org.gnome.mutter experimental-features "['scale-monitor-framebuffer']"

The gnome-packagekit package that provided a collection of tools for package management in graphical environment on RHEL 7 is no longer available.

On RHEL 8, similar functionality is provided by the GNOME Software utility, which enables you to install and update applications and gnome-shell extensions. GNOME Software is distributed in the gnome-software package.

When attempting to open a graphical application in a terminal using the sudo command, you must do the following:

X11 applications

If the application uses the X11 display protocol, add the local user root in the X server access control list. As a result, root is allowed to connect to Xwayland, which translates the X11 protocol into the Wayland protocol and reversely.

Wayland applications

If the application is Wayland native, include the -E option.

Otherwise, if you type just sudo and the name of the application, the operation of opening the application fails with the following error message:

No protocol specifiedUnable to init server: could not connect: connection refused# Failed to parse arguments: Cannot open display

The following packages were added in RHEL 8 minor relases starting from RHEL 8.1: