2. Changes in Fedora for System Administrators
2.2.1. Password Quality Checking
Fedora now has a single configurable library,
libpwquality, for checking the quality of new passwords used for system accounts. The system wide password quality checks provided by this library are configured by modifying the
/etc/security/pwquality.conf
configuration file.
Developers wishing to call this API from their applications will find the API description in the pwquality.h
file provided by the libpwquality-devel package. A python wrapper, python-pwquality, is also provided.
2.2.2. Firewalld : default firewalld solution
With Fedora 15 the dynamic firewall with firewalld was introduced with the proof of concept implementation in Python as an optional component. The purpose of this feature request is to make firewalld the default firewall solution for Fedora 17.
The dynamic firewall mode with firewalld will make it possible to change firewall settings without the need to restart the firewall and will make persistent connections possible. This is for example very useful for services, that need to add additional firewall rules. libvirtd is one of them and also openvpn in the future. With the static firewall model these rules are lost if the firewall gets modified or restarted. The firewall daemon holds the current configuration internally and is able to modify the firewall without the need to recreate the complete firewall configuration; it is also able to restore the configuration in a service restart and reload case. Another use case for the dynamic firewall mode is printer discovery. For this the discovery program will be started locally that sends out a broadcast message. It will most likely get an answer from an unknown address (the new printer). This answer will be filtered by the firewall, because the answer is not related to the broadcast and the port of the program that was sending out the message is dynamic and therefore a fixed rule can not be created for this. With the dynamic firewall mode a time limited rule could be requested by the discovery program to allow the receival of the answer.
The iptables and ip6tables services will not be enabled by default anymore. The required changes in the init scripts are simple. system-config-firewall will not be installed by default anymore, but firewalld with the user land tools will be installed by default. The needed changes in comps are simple.
Services which are adding firewall rules directly with iptables commands need to be changed to benefit from firewalld. These are: libvirtd, NetworkManager, system-config-printer, gnome printer settings.
An explicit transition is planned after Fedora 18 with dropping support for the static firewall with system-config-firewal/lokkit. A migration from the static firewall model will be needed then.
How to test
Install firewalld and firewall-applet
Start the firewalld service
Start the tray applet firewall-applet
Use firewall-cmd to enable for example ssh:
# firewall-cmd --add --service=ssh
Enable
samba for 10 seconds:
# firewall-cmd --add --service=samba --timeout=10
Enable
ipp-client:
# firewall-cmd --add --service=ipp-client
Disable
ipp-client:
# firewall-cmd --remove --service=ipp-client
To restore the static firewall with
lokkit again simply use:
# lokkit --enabled
The D-BUS interface can also be used directly.
2.2.3. SELinux Deny Ptrace
A new SELinux boolean, deny_ptrace
, has been added. It is recommended that users who do not plan to debug applications on their machine turn this boolean on. The boolean prevents rogue processes from being able to read the memory of, or otherwise attack, other processes using debugging tools including ptrace and gdb.
Such attacks are prevented even where the rogue process is running as the root user or attacking a process running with the same SELinux context and label. To permanently enable the protection provided by the
deny_ptrace
boolean, execute the following command as root:
# setsebool -P deny_ptrace 1
To disable the protection provided by the deny_ptrace
boolean temporarily, execute the following command as root:
# setsebool deny_ptrace 0
2.2.4. Services Private /tmp
A number of services managed by systemd have been modified to make use of its ability to provide them with a private /tmp
directory. Privileged services using /tmp
and /var/tmp
have previously been found to be open to being interfered with by unprivileged users, potentially leading to privilege escalation. Using private /tmp
directories for services prevents this style of exploit.
The directive added to the
systemd unit files for the modified services is:
[Service]
PrivateTmp=true
A new tool, sandbox, has been created to streamline creation of secure libvirt containers. When provided with an executable sandbox determines the mount points and libvirt container information required to run the application in a container. The container is then launched by libvirt with an SELinux context that will prevent it interacting with other processes on the system, including other containers, while still being able to share system data.
This allows an administrator to run multiple instances of a service simultaneously, while preventing them from breaking the host machine or other processes on the system, even when run as root. To use sandbox, install the libvirt-sandbox package.
2.2.5.1. krb5-workstation
Fedora 17 upgrades the Kerberos authentication system to version 1.10. This adds support for changing passwords over a NAT and support for localization. The kswitch
command is added to switch between credential caches. Additional cache support has been added to other commands. Credential choice can be controlled with the file $HOME/.k5identity
.
Fedora 17 will support file systems larger than 16 terabytes on the default file system (ext4). With the latest version of e2fsprogs, ext4 file systems can now be up to 100 TB.
2.3.2. Encrypted filesystems
Fedora 17 uses version 1.4.1 of the cryptsetup package, which removes deprecated API calls. In addittion, it supports placing LUKS headers on separate devices and the creation of shared, non-overlapping encrypted segments on a single device.
btrfs is not available as a target file system during installation. This is a temporary situation and will be resolved in Fedora 18. btrfs is still available after installation.
Fedora 17 will include the CloudStack package, which provides a mature Infrastructure as a Service (IaaS) platform.
Also new to Fedora 17 is OpenNebula. OpenNebula provides an IaaS platform geared toward data center virtualization. Management of the environment can be done through command line or graphical interfaces. Compatibility with Amazon EC2 the Open Cloud Computing Interface (OCCI) is included.
Fedora 17 includes the latest version of the OpenStack suite, code named "Essex". Included in this new release are the latest versions of the web management interface ("Horizon") and virtual networking ("Quantum"). The use of Qpid as an alternative to RabbitMQ for the AQMP backend is new in Fedora 17. In addition, the availability of libguestfs to support multiple virtual disk formats will make Fedora's OpenStack offering more flexible.
Fedora 17 includes Open vSwitch, a software-based network switch used to provide networking services to virtual machines. Open vSwitch supports OpenFlow for ease-of-management.
Fedora 17 includes mysql 5.5.20, updated from 5.5.14 in Fedora 16.
postgresql has been upgraded to 9.1.2
This is primarily a bugfix release.
sqlite has been upgraded to 3.7.9
If a search token (on the right-hand side of the MATCH
operator) in FTS4 begins with "^" then that token must be the first in its field of the document.
There are many changes and improvements:
Orders of magnitude performance improvement for CREATE INDEX
on very large tables.
Improved the windows VFS to better defend against interference from anti-virus software.
Improved query plan optimization when the DISTINCT
keyword is present.
Allow more system calls to be overridden in the unix VFS - to provide better support for chromium sandboxes.
Increase the default size of a lookahead cache line from 100 to 128 bytes.
Enhancements to the test_quota.c
module so that it can track preexisting files.
Added options SQLITE_DBSTATUS_CACHE_HIT
and SQLITE_DBSTATUS_CACHE_MISS
to the sqlite3_db_status()
interface.
Removed support for SQLITE_ENABLE_STAT2
, replacing it with the much more capable SQLITE_ENABLE_STAT3
option.
Enhancements to the sqlite3_analyzer utility program, including the --pageinfo
and --stats
options and support for multiplexed databases.
Enhance the sqlite3_data_count()
interface so that it can be used to determine if SQLITE_DONE
has been seen on the prepared statement.
Added the SQLITE_FCNTL_OVERWRITE
file-control by which the SQLite core indicates to the VFS that the current transaction will overwrite the entire database file.
Increase the default lookaside memory allocator allocation size from 100 to 128 bytes.
Enhanced the query planner so that it can factor terms in and out of OR
expressions in the WHERE
clause in an effort to find better indices.
Added the SQLITE_DIRECT_OVERFLOW_READ
compile-time option, causing overflow pages to be read directly from the database file, bypassing the page cache.
Remove limits on the magnitude of precision and width value in the format specifiers of the sqlite3_mprintf()
family of string rendering routines.
The pciutils package, which provides tools for inspecting and configuring PCI devices, has been upgraded to version 3.1.9 in Fedora 17. This adds support for reading speed and link status fields for PCI Express Generation 3 hardware.
Fedora 17 includes version 4.3 of brltty, the Braille display daemon. Version 4.3 includes new logging and configuration options as well as support for additional devices.
2.8.1. Software Rendering for GNOME Shell
The GNOME Shell experience is now available on all hardware, including devices that use software rendering. Users still wishing to use GNOME's fallback mode can enable it manually by accessing the System Info control panel applet, selecting Graphics, and setting the Forced Fallback Mode option to ON.
2.8.2. Multi-touch Support
The X server and libraries in Fedora 17 support version 2.2 of the XInput extension, this includes multi-touch support. Applications that choose to will now be able to take advantage of multi-touch support on Fedora.
2.8.3. Smooth Scrolling Support
The updated X server also provides smooth scrolling for drivers, and devices, that support it. Scroll data is now exported as axis values in addition to the legacy button press events. This allows applications to take velocity into account and provide a smoother scrolling experience. Like multi-touch, to take advantage of smooth scrolling support for it must also be actively written into client applications themselves.
The i810, mga, r128, savage, sis, tdfx, and unichrome DRI drivers are no longer supplied, as they are no longer included by Mesa. Impacted hardware includes variants of the following devices:
Intel i810 and i815 motherboard chipsets
Matrox MGA G200, G400, G450 and G550 cards
ATI Rage 128 cards
S3 Savage 3D and Savage 4 cards
SiS 300, 540, 630, and 730 chipsets
3dfx Voodoo 3, Voodoo 4, and Voodoo 5 cards
VIA Unichrome and Unichrome Pro chipsets
This hardware is now supported by the llvmpipe software 3D driver which, unlike the older DRI drivers, exposes OpenGL 2.x functionality.