New Features and Changes

System Requirements

You can install Oracle Linux 7 on x86-64 systems with up to 2048 logical CPUs and 64 TB of memory. The theoretical upper limit is 5120 logical CPUs and 64 TB of memory, but this configuration is not supported. A minimum of 2 logical CPUs and 1 GB of memory per logical CPU is recommended. Although the minimum disk space required for installation is 1GB, a minimum of 5 GB is recommended.

File System, Storage, and Address Space Limitations

The following table lists the maximum file size and maximum file system size for the btrfs, ext4, and XFS file systems.

File System Type	Maximum File Size	Maximum File System Size
btrfs	50 TB	50 TB
ext4	50 TB	50 TB
XFS	16 TB	500 TB

The maximum supported size for a bootable LUN is 50 TB. GPT and UEFI support are required for LUNs larger than 2 TB.

The maximum size of the address space that is available to each process is 128 TB.

Shipped Kernels

Oracle Linux 7 is shipped with the following kernels:

Red Hat Compatible Kernel (RHCK), based on mainline Linux version 3.10.
Unbreakable Enterprise Kernel Release 3 (UEK R3), starting with 3.8.13, based on mainline Linux version 3.8. This is the default kernel.

Note:

UEFI Secure Boot is not currently supported with UEK R3.

Installer Features

The Anaconda installer has been enhanced and includes the following notable features:

An enhanced graphical interface.
A new text interface that can be used in a write-only mode.
Support for non-partitioned, directly-formatted devices.
tmpfs configuration.
LVM thin provisioning.
Configuration of btrfs or XFS for the root file system. Note that the file system type for /boot cannot be btrfs.
The default file system type is XFS, which replaces ext4.
Encryption of swap and all file systems except for /boot. For a btrfs file system, the encryption applies to all subvolumes.
Bonding and teaming of network interfaces.

Apache Web Server Features

Apache HTTP Server version 2.4 provides the following notable features:

The event Multi-Processing Module (MPM) and integrated proxy module support for the FastCGI protocol allow the server to serve more concurrent requests.
Improvements to asynchronous read and write handling.
Embedded Lua scripting.

For more information see https://httpd.apache.org/docs/2.4/new_features_2_4.html.

Authentication Features

Oracle Linux 7 introduces the following notable authentication features:

If POSIX attributes are defined, authentication can obtain a user or group ID from Active Directory instead of using an ID generated from a Security Identifier. Clients must be running Oracle Linux 5 Update 9 and later, Oracle Linux 6 Update 3 and later, or Oracle Linux 7.
The slapi-nis package contains the following plug-ins:
- nisserver-plugin enables a directory server to act as a NIS server.
- schemacompat-plugin enables a directory server to modify how entries in the directory information tree (DIT) are presented to clients.
These plug-ins are designed to help transition a network from NIS to LDAP.

Boot Loader Features

The GRUB2 boot loader in Oracle Linux 7 provides the following notable enhancements over the previous version of GRUB:

Support for the BIOS, EFI, and Open Firmware.
Support for GPT.
Support for additional file system types, including HFS+ and NTFS.

Note:

The installer does not permit you to configure GRUB2 in partitions as some file systems do not allow enough space for the boot loader.

Linux Containers

The Linux Containers (LXC) feature allows you to safely and securely run multiple applications or instances of an operating system on a single host without risking them interfering with each other. Containers are lightweight and resource-friendly, which saves both rack space and power. For more information, see Oracle Linux 7: Administrator's Guide.

LXC is supported for both UEK R3 and RHCK. You can configure both 32-bit and 64-bit guest containers. However, some applications might not be supported for use with these features.

Load Balancing and High Availability

Oracle Linux 7 includes the Keepalived and HAProxy technologies for balancing access to network services while maintaining continuous access to those services.

Keepalived uses the IP Virtual Server (IPVS) kernel module to provide transport layer (Layer 4) load balancing, redirecting requests for network-based services to individual members of a server cluster. IPVS monitors the status of each server and uses the Virtual Router Redundancy Protocol (VRRP) to implement high availability.

HAProxy is an application layer (Layer 7) load balancing and high availability solution that you can use to implement a reverse proxy for HTTP and TCP-based Internet services.

For more information, see Oracle Linux 7: Administrator's Guide.

MySQL Community and MariaDB Packages

In the initial release of Oracle Linux 7, the MySQL Community 5.6 packages were provided on the Oracle Linux 7 full installation DVD image but were not installable using the Anaconda installer or kickstart. The ISO image for update 1 to Oracle Linux 7 provides support for installing either MySQL 5.6 or MariaDB by using either the Anaconda installer or kickstart. For more information, see Oracle Linux 7: Release Notes for Oracle Linux 7.1 .

Networking Features

Oracle Linux 7 provides the following notable enhancements to support networking:

The chronyd service enables mobile systems and virtual machines to update their system clock after a period of suspension or disconnection from a network. You can use the chronyc command to manage the chronyd service. For more information, see the chronyc(1) manual page.
Domain Name System Security Extensions (DNSSEC) allow a DNS client to verify the authenticity of a DNS server and to check that responses to DNS queries have not been modified.
The firewalld service provides a dynamically managed firewall that allows applications and system services to add firewall rules. By default, the firewalld service is enabled and the iptables and ip6tables services are disabled. For more information, see https://fedoraproject.org/wiki/FirewallD.
The nmcli utility notifies the NetworkManager about configuration changes. By default, NetworkManager now does not monitor configuration file for changes. However, it still responds to any changes made using the D-Bus API. For more information, see the nmcli(1) manual page.
OpenLMI provides an infrastructure for configuring, managing, and monitoring hardware, operating system software, and services on Linux systems, including bare-metal servers and virtual machine guests, as well as storage systems and networks. OpenLMI abstracts the complexity of system management and presents a simpler administration interface. The Open LMI agents on a managed system are accessible via the OpenLMI controller, which also provides access to client applications using C/C++, Java, Python, or the CLI. For more information, see http://www.openlmi.org.

Red Hat Compatible Kernel Features

The Red Hat Compatible Kernel (RHCK) is based on mainline Linux version 3.10 and provides the following notable features:

Compression of swap memory to reduce I/O overhead (zram).
Crash dumps can be recorded on systems with up to 3 TB of memory.
DynTick support for suspending the system tick when there is only a single runnable task.
Hardware Error Reporting Mechanism (HERM), which replaces mcelog and EDAC.
NUMA-aware scheduling and memory allocation for improving the performance of NUMA systems.

Security Features

Oracle Linux 7 introduces the following notable security features:

The SSH 2 AuthenticationMethods option specifies one or more comma-separated lists of authentication methods. If only one list is specified, a user is granted access if he or she successfully completes all of the methods in the list. If several lists are specified, a user must complete at least one of the lists. Each listed authentication method must be enabled in /etc/ssh/sshd_config.

The available methods are hostbased, keyboard-interactive, password, and publickey. You can use the keyboard-interactive method to invoke authentication mechanisms such as Pluggable Authentication Modules (PAM). You can configure PAM modules that use authentication methods such as GSSAPI, Kerberos, hardware tokens, or biometric matching.

The following example configuration requires either public-key authentication followed by PAM-defined authentication or connection from a trusted host followed by public-key authentication:
```
AuthenticationMethods "publickey,keyboard-interactive:pam hostbased,publickey"
```
To overcome the inherent vulnerability of processes sharing a system key table, applications can use the GSS Proxy system service to set up a unique Kerberos context.
The selinuxuser_use_ssh_chroot variable must be set for confined SELinux users (for example, guest_u, staff_u, or user_u). To ensure high security when specifying the Open SSH ChrootDirectory option, configure chrooted users as the confined user guest_u.
Version 3.15.2 and later of the nss packages support the following AES-GCM cipher suites with TLS 1.2:
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_128_GCM_SHA256
OCSP and CRLs no longer accept MD2, MD4, and MD5 signatures.

Storage and File System Features

Oracle Linux 7 introduces the following notable features for managing storage and file systems:

Oracle Linux 7 with both UEK R3 and RHCK uses the Linux-IO (LIO) Target to provide the block-storage SCSI target for FCoE, iSCSI, and Mellanox InfiniBand (iSER and SRP). To manage LIO, you can use the targetcli shell, which accepts plug-ins that support additional fabric types and functionality. For more information, see the targetcli(8) manual page and http://linux-iscsi.org/wiki/Targetcli. Note that Mellanox InfiniBand is only supported with UEK.
The System Storage Manager command-line utility (ssm) unifies the configuration and management of storage and file systems by subsuming the functionality of commands such as btrfs, cryptsetup, dmsetup, fsck, lv*, mdadm, mkfs, mount, pv*, tune2fs, vg*, and xfs_*. For more information, see the ssm(8) manual page and http://storagemanager.sourceforge.net.
Oracle Linux 7 provides the temporary file system (tmpfs), which is configured in volatile memory and whose contents do not persist after a system reboot. To mount this file system on /tmp, use the systemctl command to enable the tmp.mount systemd mount point unit. The tmpfs file system is suitable for use by non-privileged processes that need to store small quantities of temporary data.
The snapper command allows you to manage read-only snapshots of btrfs file systems and thinly-provisioned LVM logical volumes. For more information, see the snapper(8) manual page and http://snapper.io/documentation.html.

Technology Preview

The following features are still under development, but are made available for testing and evaluation purposes with UEK R3.

DRBD (Distributed Replicated Block Device)

A shared-nothing, synchronously replicated block device (RAID1 over network), designed to serve as a building block for high availability (HA) clusters. It requires a cluster manager (for example, pacemaker) for automatic failover.
Transcendent memory

Transcendent Memory (tmem) provides a new approach for improving the utilization of physical memory in a virtualized environment by claiming underutilized memory in a system and making it available where it is most needed. From the perspective of an operating system, tmem is fast pseudo-RAM of indeterminate and varying size that is useful primarily when real RAM is in short supply. To learn more about this technology and its use cases, see the Transcendent Memory project page at https://oss.oracle.com/projects/tmem/.

For the RHCK, the following features are currently under technology preview:

Active Directory and LDAP sudo providers.
Block and object storage layouts for parallel NFS (pNFS).
Block device caching by LVM, which allows small, fast devices to act as caches for large, slow devices.
btrfs file system. Oracle supports btrfs with UEK R3.
Crash kernel can be configured to boot with more than a single CPU.
DIF/DIX for data integrity checking on SCSI devices.
LSI Syncro CS feature in the megaraid_sas driver to support High-Availability Direct-Attached storage (HA-DAS) adapters.
LVM API.
More than 32 PCI slots can be configured with PCI Bridge in QEMU.
OpenLMI Software Provider.
PCI Express Bus, AHCI Bus, and USB 3.0 host adapter emulation are provided for KVM guests.
SCAP Workbench and the OSCAP Anaconda add-on.
Single-Root I/O virtualization (SR-IOV) in the qlcnic driver.
Storage array management, which includes a command-line interface and the libStorageMgmt API.
The dm-era device-mapper target records changes made to blocks over a specified time period.
Trusted Network Connect.
virtio-blk-data-plane in Quick EMUlator (QEMU) improves block I/O performance.

Note:

The upstream Kpatch RPM has been removed from Oracle Linux. Customers who wish to patch their running kernel with zero downtime should evaluate Oracle's Ksplice technology, which is included at no additional cost with Oracle Linux Premier support.

Compatibility

Oracle Linux maintains user-space compatibility with Red Hat Enterprise Linux, which is independent of the kernel version that underlies the operating system. Existing applications in user space will continue to run unmodified on the Unbreakable Enterprise Kernel Release 3 (UEK R3) and no re-certifications are needed for RHEL certified applications.

To minimize impact on interoperability during releases, the Oracle Linux team works closely with third-party vendors whose hardware and software have dependencies on kernel modules. The kernel ABI for UEK R3 will remain unchanged in all subsequent updates to the initial release. UEK R3 contains changes to the kernel ABI relative to UEK R2 that require recompilation of third-party kernel modules on the system. Before installing UEK R3, verify its support status with your application vendor.

Unsupported Emulex Devices

The following Emulex LightPulse HBA devices are being desupported by Emulex and are not supported for use with Oracle Linux 7:

LP10000 (VID:10DF, DID:FA00)
LP10000S (VID:10DF, DID:FC00)
LP101 (VID:10DF, DID:F0A1)
LP1050 (VID:10DF, DID:F0A5)
LP11000S (VID:10DF, DID:FC10)
LP11000-S (VID:10DF, DID:FD11)
LP111 (VID:10DF, DID:F0D1)
LP6000 (VID:10DF, DID:1AE5)
LP7000 (VID:10DF, DID:F700)
LP8000 (VID:10DF, DID:F800)
LP9002 (VID:10DF, DID:F900)
LP952 (VID:10DF, DID:F095)
LP9802 (VID:10DF, DID:F980)
LP982 (VID:10DF, DID:F098)
LPe1000 (VID:10DF, DID:F0F5)
LPe1000-SP (VID:10DF, DID:F0F5)
LPe1002-SP (VID:10DF, DID:F0F7)
LPe11000S (VID:10DF, DID:FC20)
LPx1000 (VID:10DF, DID:FB00)
LPx1000 (VID:10DF, DID:FB00)

Notable Changes from Oracle Linux 6

The following sections describe the most notable changes in Oracle Linux 7 from Oracle Linux 6.

Exporting System Configuration Parameters

Parameters defined in /etc/sysconfig files are automatically exported in Oracle Linux 7. You no longer need to use the export command.

Host Name Configuration

The host name is now defined in /etc/hostname instead of /etc/sysconfig/network.

Predictable Network Interface Naming

Network interface names are now based on information derived from the system BIOS or alternatively from a device's firmware, system path, or MAC address. This feature ensures that interface names persist across system reboots, hardware reconfiguration, and updates to device drivers and the kernel.

If you enable the biosdevname boot option (biosdevname=1), the biosdevname plugin (provided in the biosdevname package) to the udev device manager assigns names to network interfaces as follows:

em N: Ethernet interface on the motherboard, where N is the number of the interface starting from 1.
p S p P: Network interface on a PCI card, where S is the slot number and P is the port number.
p S p P _ V: Virtual interface, where S is the slot number, P is the port number, and V is the virtual interface number.

If biosdevname is set to 0 (the default), systemd naming assigns the prefixes, en, wl, and ww to Ethernet, wireless LAN, and wireless WAN interfaces respectively. The prefix is followed by a suffix based on the hardware configuration, system bus configuration, or MAC address of the device:

o N: Onboard device with index number N.
pBsS[fF][dD]: PCI device with bus number B, slot number S, function number F, and device ID D.
pBsS[fF][uP]...[cC][iI]: USB device with bus number B, slot number S, function number F, port number P, configuration number C, and interface number I.
sS[fF][dD]: Hot-plug device with slot number S, function number F, and device ID D.
x M: Device with MAC address M.

For example, an Ethernet port on the motherboard might be named eno1 or em1, depending on whether the value of biosdevname is 0 or 1.

The kernel assigns a legacy, unpredictable network interface name (eth N and wlan N) only if it cannot discover any information about the device that would allow it to disambiguate the device from other such devices. You can use the net.ifnames=0 boot parameter to reinstate the legacy naming scheme.

To define the name of an interface manually:

Use the ip link command to display the MAC address of the existing interface, for example:
```
sudo ip link show enp0s3 | grep link
```
```
link/ether 08:00:27:16:c3:33 brd ff:ff:ff:ff:ff:ff
```
Change the name of the existing configuration file for the interface (/etc/sysconfig/network-scripts/ifcfg-ifname) so that the ifname suffix has the same value as the desired interface name, for example:
```
cd /etc/sysconfig/network-scripts
mv ifcfg-enp0s3 ifcfg-net1
```
Edit the renamed configuration file:
1. Verify that the value of the HWADDR parameter is the same as the interface's MAC address as shown by the ip link command, for example:
```
HWADDR=08:00:27:16:c3:33
```
2. Set the value of the DEVICE parameter to the desired interface name, for example:
```
DEVICE=net1
```
  Add this parameter if it is not already present in the file.
3. Set the value of the NAME parameter to the desired interface name, for example:
```
NAME=net1
```
  This parameter defines the name of the interface as displayed in the Network Connections editor.
Reboot the system:
```
sudo systemctl reboot
```

Caution:

Changing a network interface name or the naming scheme can make existing firewall rules invalid. It can also affect other software that refers to network interface names.

NFS v2

NFS v2 is not supported for use with Oracle Linux 7. You should use NFS v3 or NFS v4 instead.

ifconfig Output

The output of the ifconfig command has changed format. You might need to amend any programs that parse the output of this command. For future compatibility, it is recommended that you modify such programs to use the ip command instead of ifconfig.

Initial Setup Supersedes Firstboot

Although legacy support for firstboot allows third-party modules to continue to function, it is recommended that you rewrite these modules to work with the installer and Initial Setup.

Layout of the root File System

As initrd is now able to mount the /usr file system at boot time, the files in /bin, /lib, /lib64, and /sbin have been moved to /usr/bin, /usr/lib, /usr/lib64, and /usr/sbin. Symbolic links in / provide backward compatibility for programs.

Localization Settings

System-wide default localization settings such as the default language, keyboard, and console font are now defined in /etc/locale.conf and /etc/vconsole.conf instead of /etc/sysconfig/i18n.

System Logging

The new logging daemon, journald, records system messages in non-persistent journal files in memory and in /run/log/journal. journald forwards messages to rsyslog, which processes and archives only syslog messages by default. If required, you can configure rsyslog to archive any other messages that journald forwards, including kernel, boot, initrd, stdout, and stderr messages.

systemd Replaces Upstart and init

The systemd daemon replaces Upstart for managing system run levels and services. Replacing init, systemd is the first process that starts after the system boots, and is the final process that is running when the system shuts down. systemd controls the final stages of booting and prepares the system for use. systemd also speeds up booting by loading services concurrently.

Table 1-1 shows the nearest equivalent systemctl command for various system management commands used in Oracle Linux 6.

Table 1-1 systemctl Command Equivalents

Legacy Command	Nearest Equivalent systemctl Command	Description
`chkconfig --list name`	`systemctl is-enabled`name[`.service`]	Check whether a service is enabled to start at boot time. The `.service` tag is optional.
`chkconfig name off`	`systemctl disable`name[`.service`]	Disable a service from starting at boot time.
`chkconfig name on`	`systemctl enable`name[`.service`]	Enable a service to start at boot time.
`halt`	`systemctl halt`	Halt the system.
`pm-hibernate`	`systemctl hibernate`	Put the system into hibernation.
`pm-suspend`	`systemctl suspend`	Suspend the system.
`pm-suspend-hybrid`	`systemctl hybrid-sleep`	Put the system into hibernation and suspend its operation.
`poweroff`	`systemctl poweroff`	Power off the system.
`reboot`	`systemctl reboot`	Reboot the system.
`runlevel`	`systemctl list-units --type target`	Display the currently active targets, which taken as a group constitute the nearest equivalent that `systemd` has to a run level.
`service name start`	`systemctl start`name[`.service`]	Start a service.
`service name status`	`systemctl status`name[`.service`]	Display the status of a service.
`service name stop`	`systemctl stop`name[`.service`]	Stop a service.
`telinit runlevel`	`systemctl isolate` name `.target`	Change the `systemd` target.

As well as services (name .service) and targets (name .target), other types of unit that you can manage in systemd include devices (name .device), file system mount points (name .mount), and sockets (name .socket). For example, the following command instructs the system to mount the temporary file system (tmpfs) on /tmp at boot time:

# systemctl enable tmp.mount

Table 1-2 shows the nearest equivalent systemd targets to the run levels that are used in Oracle Linux 6.

Table 1-2 systemd Target Equivalents

Run Level in Oracle Linux 6	Nearest Equivalent systemd Targets in Oracle Linux 7	Description
0	`poweroff.target` `runlevel0.target`	Shut down and power off the system.
1	`rescue.target` `runlevel1.target`	Set up a rescue shell.
2	`multi-user.target` `runlevel2.target`	Set up a non-graphical, multi-user system.
3	`multi-user.target` `runlevel3.target`	Set up a non-graphical, multi-user system with networking.
4	`multi-user.target` `runlevel4.target`	User defined or not used.
5	`graphical.target` `runlevel5.target`	Set up a multi-user system with networking and display manager.
6	`reboot.target` `runlevel6.target`	Shut down and reboot the system.

The runlevel* targets are implemented as symbolic links.

The nearest equivalent systemd target to the Oracle Linux 6 run levels 2, 3, and 4 is multi-user.target.

You can use the following commands to display the current default systemd target and to configure a new default target:

sudo systemctl get-default
sudo systemctl set-default name.target

If required, you can create customized versions of the targets that are defined in /usr/lib/systemd/system.

For more information, see the systemctl(1) and systemd.unit(5) manual pages and https://freedesktop.org/wiki/Software/systemd/.

Compatibility Limitations of systemd

systemd has the following limitations that can affect the compatibility of legacy programs running under Oracle Linux 7:

All service script actions time out after 5 minutes to prevent the system hanging indefinitely.
By default, systemd assigns each system service to a dedicated cpu control group, which prevents services from accessing real-time scheduling. For details of workarounds, see https://www.freedesktop.org/wiki/Software/systemd/MyServiceCantGetRealtime/.
If a systemd target does not have an equivalent Oracle Linux 6 run level, legacy commands such as runlevel return N to indicate an unknown run level.
Services cannot inherit user context so some legacy service initialization scripts might not work correctly.
systemd can interpret and use the headers in Linux Standard Base service scripts.
systemd does not attempt to stop services that are not running.
systemd supports the disable, enable, restart, start, status, and stop actions for services. To support other service functions, you must use a separate program such as a service script.
The chkconfig command might display incorrect information about run levels and services.
The legacy service command forwards service action requests to systemd but /etc/init.d service scripts do not.