mtpti5iD/redhat-docs_dataset huggingface dataset:
Chapter 21. SELinux Security-Enhanced Linux , or SELinux , is a security architecture integrated into the current kernel using the linux security modules ( LSM ). It is a project of the United States National Security Agency (NSA) and the SELinux community. SELinux integration into Red Hat Enterprise Linux was a joint effort between the NSA and Red Hat. 21.1. Introduction to SELinux SELinux provides a flexible mandatory access control ( MAC ) system built into the Linux kernel. Under standard Linux discretionary access control ( DAC ), an application or process running as a user (UID or SUID) has the user's permissions to objects such as files, sockets, and other processes. Running an SELinux MAC kernel protects the system from malicious or flawed applications that can damage or destroy the system. SELinux defines the access and transition rights of every user, application, process, and file on the system. SELinux then governs the interactions of these subjects and objects using a security policy that specifies how strict or lenient a given Red Hat Enterprise Linux installation should be. For the most part, SELinux is almost completely invisible to system users. Only system administrators must worry about how strict a policy to implement for their server environment. The policy can be as strict or lenient as needed, and is very finely detailed. This detail gives the SELinux kernel complete, granular control over the entire system. When a subject such as an application attempts to access an object such as a file, the policy enforcement server in the kernel checks an access vector cache ( AVC ), where subject and object permissions are cached. If a decision cannot be made based on data in the AVC, the request continues to the security server, which looks up the security context of the application and the file in a matrix. Permission is then granted or denied, with an avc: denied message detailed in /var/log/messages . Subjects and objects gain their security context from installed policy, which also provides the information to populate the security server's matrix. In addition to running in an enforcing mode, SELinux can run in a permissive mode, where the AVC is checked and denials are logged, but SELinux does not enforce the policy. For more information about how SELinux works, refer to Section 21.3, " Additional Resources " .

Commands:
2.4. Authentication Support for central management of SSH keys, BZ# 803822 Previously, it was not possible to centrally manage host and user SSH public keys. Red Hat Enterprise Linux 6.3 includes SSH public key management for Identity Management servers as a Technology Preview. OpenSSH on Identity Management clients is automatically configured to use public keys which are stored on the Identity Management server. SSH host and user identities can now be managed centrally in Identity Management. Package: sssd-1.8.0-32 SELinux user mapping, BZ# 803821 Red Hat Enterprise Linux 6.3 introduces the ability to control the SELinux context of a user on a remote system. SELinux user map rules can be defined and, optionally, associated with HBAC rules. These maps define the context a user receives depending on the host they are logging into and the group membership. When a user logs into a remote host which is configured to use SSSD with the Identity Management backend, the user's SELinux context is automatically set according to mapping rules defined for that user. For more information, refer to http://freeipa.org/page/SELinux_user_mapping . This feature is considered a Technology Preview. Package: sssd-1.8.0-32 SSSD support for automount map caching, BZ# 761570 In Red Hat Enterprise Linux 6.3, SSSD includes a new Technology Preview feature: support for caching automount maps. This feature provides several advantages to environments that operate with autofs : Cached automount maps make it easy for a client machine to perform mount operations even when the LDAP server is unreachable, but the NFS server remains reachable. When the autofs daemon is configured to look up automount maps via SSSD, only a single file has to be configured: /etc/sssd/sssd.conf . Previously, the /etc/sysconfig/autofs file had to be configured to fetch autofs data. Caching the automount maps results in faster performance on the client and lower traffic on the LDAP server. Package: sssd-1.8.0-32

Commands:
Chapter 5. Configuring Red Hat Cluster With system-config-cluster This chapter describes how to configure Red Hat Cluster software using system-config-cluster , and consists of the following sections: Section 5.1, "Configuration Tasks" Section 5.2, "Starting the Cluster Configuration Tool " Section 5.3, "Configuring Cluster Properties" Section 5.4, "Configuring Fence Devices" Section 5.5, "Adding and Deleting Members" Section 5.6, "Configuring a Failover Domain" Section 5.7, "Adding Cluster Resources" Section 5.8, "Adding a Cluster Service to the Cluster" Section 5.9, "Propagating The Configuration File: New Cluster" Section 5.10, "Starting the Cluster Software" Note While system-config-cluster provides several convenient tools for configuring and managing a Red Hat Cluster, the newer, more comprehensive tool, Conga , provides more convenience and flexibility than system-config-cluster . You may want to consider using Conga instead (refer to Chapter 3, Configuring Red Hat Cluster With Conga and Chapter 4, Managing Red Hat Cluster With Conga ). 5.1. Configuration Tasks Configuring Red Hat Cluster software with system-config-cluster consists of the following steps: Starting the Cluster Configuration Tool , system-config-cluster . Refer to Section 5.2, "Starting the Cluster Configuration Tool " . Configuring cluster properties. Refer to Section 5.3, "Configuring Cluster Properties" . Creating fence devices. Refer to Section 5.4, "Configuring Fence Devices" . Creating cluster members. Refer to Section 5.5, "Adding and Deleting Members" . Creating failover domains. Refer to Section 5.6, "Configuring a Failover Domain" . Creating resources. Refer to Section 5.7, "Adding Cluster Resources" . Creating cluster services. Refer to Section 5.8, "Adding a Cluster Service to the Cluster" . Propagating the configuration file to the other nodes in the cluster. Refer to Section 5.9, "Propagating The Configuration File: New Cluster" . Starting the cluster software. Refer to Section 5.10, "Starting the Cluster Software" .

Commands:
20.6. Compatibility with Older Systems If an ACL has been set on any file on a given file system, that file system has the ext_attr attribute. This attribute can be seen using the following command: A file system that has acquired the ext_attr attribute can be mounted with older kernels, but those kernels do not enforce any ACLs which have been set. Versions of the e2fsck utility included in version 1.22 and higher of the e2fsprogs package (including the versions in Red Hat Enterprise Linux 2.1 and 4) can check a file system with the ext_attr attribute. Older versions refuse to check it.

Commands:
tune2fs -l filesystem-device
4.176. mesa 4.176.1. RHBA-2011:1616 - mesa bug fix and enhancement update Updated mesa packages that fix multiple bugs and add various enhancements are now available for Red Hat Enterprise Linux 6. Mesa provides a 3D graphics application programming interface (API) that is compatible with OpenGL (Open Graphics Library). It also provides hardware-accelerated drivers for many popular graphics chips. The mesa packages have been upgraded to upstream version 7.11, which provides a number of bug fixes and enhancements over the version. (BZ# 713772 ) Bug Fixes BZ# 677470 Prior to this update, the OpenGL output was corrupted due to problems with the rendering in guests. This update modifies the software rendering so that the OpenGL output is no longer corrupted. BZ# 745686 Prior to this update,the nouveau gallium driver was wrongly included in the mesa-dri-drivers package which could lead to conflicts. This update corrects this error and removes the nouveau gallium driver from the package. All Mesa users are advised to upgrade to these updated packages, which fix these bugs add these enhancements.

Commands:
8.163. python-urlgrabber 8.163.1. RHBA-2013:1117 - python-urlgrabber bug fix update Updated python-urlgrabber packages that fix one bug are now available. The python-urlgrabber package provides urlgrabber, a high-level url-fetching package for the Python programming language and a corresponding utility of the same name. The urlgrabber package allows Python scripts to fetch data using the HTTP and FTP protocols, as well as from a local file system. Bug Fix BZ#807030 Previously, a flaw in the source code resulted in a traceback error when users used the reposync command to synchronize a remote Yum repository to a local directory, when the utime() system call had an error. This update corrects the mistake in the source code, and traceback errors no longer occur in the described scenario. Users of python-urlgrabber are advised to upgrade to these updated packages, which fix this bug.

Commands:
1.2.3.2. Nessus Nessus is a full-service security scanner. The plug-in architecture of Nessus allows users to customize it for their systems and networks. As with any scanner, Nessus is only as good as the signature database it relies upon. Fortunately, Nessus is frequently updated and features full reporting, host scanning, and real-time vulnerability searches. Remember that there could be false positives and false negatives, even in a tool as powerful and as frequently updated as Nessus. Note The Nessus client and server software requires a subscription to use. It has been included in this document as a reference to users who may be interested in using this popular application. For more information about Nessus, see the official website at the following URL: http://www.nessus.org/

Commands:
Chapter 32. Using Advanced Error Reporting When you use the Advanced Error Reporting ( AER ), you receive notifications of error events for Peripheral Component Interconnect Express ( PCIe ) devices. RHEL enables this kernel feature by default and collects the reported errors in the kernel logs. If you use the rasdaemon program, these errors are parsed and stored in its database. 32.1. Overview of AER Advanced Error Reporting ( AER ) is a kernel feature that provides enhanced error reporting for Peripheral Component Interconnect Express ( PCIe ) devices. The AER kernel driver attaches root ports which support PCIe AER capability in order to: Gather the comprehensive error information Report errors to the users Perform error recovery actions When AER captures an error, it sends an error message to the console. For a repairable error, the console output is a warning . Example 32.1. Example AER output 32.2. Collecting and displaying AER messages To collect and display AER messages, use the rasdaemon program. Procedure Install the rasdaemon package. # yum install rasdaemon Enable and start the rasdaemon service. # systemctl enable --now rasdaemon Created symlink /etc/systemd/system/multi-user.target.wants/rasdaemon.service /usr/lib/systemd/system/rasdaemon.service. Issue the ras-mc-ctl command. # ras-mc-ctl --summary # ras-mc-ctl --errors The command displays a summary of the logged errors (the --summary option) or displays the errors stored in the error database (the --errors option). Additional resources The rasdaemon(8) manual page The ras-mc-ctl(8) manual page

Commands:
Feb 5 15:41:33 hostname kernel: pcieport 10003:00:00.0: AER: Corrected error received: id=ae00 Feb 5 15:41:33 hostname kernel: pcieport 10003:00:00.0: AER: Multiple Corrected error received: id=ae00 Feb 5 15:41:33 hostname kernel: pcieport 10003:00:00.0: PCIe Bus Error: severity=Corrected, type=Data Link Layer, id=0000(Receiver ID) Feb 5 15:41:33 hostname kernel: pcieport 10003:00:00.0: device [8086:2030] error status/mask=000000c0/00002000 Feb 5 15:41:33 hostname kernel: pcieport 10003:00:00.0: [ 6] Bad TLP Feb 5 15:41:33 hostname kernel: pcieport 10003:00:00.0: [ 7] Bad DLLP Feb 5 15:41:33 hostname kernel: pcieport 10003:00:00.0: AER: Multiple Corrected error received: id=ae00 Feb 5 15:41:33 hostname kernel: pcieport 10003:00:00.0: PCIe Bus Error: severity=Corrected, type=Data Link Layer, id=0000(Receiver ID) Feb 5 15:41:33 hostname kernel: pcieport 10003:00:00.0: device [8086:2030] error status/mask=00000040/00002000
yum install rasdaemon
systemctl enable --now rasdaemon Created symlink /etc/systemd/system/multi-user.target.wants/rasdaemon.service /usr/lib/systemd/system/rasdaemon.service.
ras-mc-ctl --summary ras-mc-ctl --errors
Chapter 1. Overview AMQ Spring Boot Starter is an adapter for creating Spring-based applications that use AMQ messaging. It provides a Spring Boot starter module that enables you to build standalone Spring applications. The starter uses the AMQ JMS client to communicate using the AMQP 1.0 protocol. AMQ Spring Boot Starter is part of AMQ Clients, a suite of messaging libraries supporting multiple languages and platforms. For an overview of the clients, see AMQ Clients Overview . For information about this release, see AMQ Clients 2.10 Release Notes . AMQ Spring Boot Starter is based on the AMQP 1.0 JMS Spring Boot project. 1.1. Key features Quickly build standalone Spring applications with built-in messaging Automatic configuration of JMS resources Configurable pooling of JMS connections and sessions 1.2. Supported standards and protocols Version 2.2 of the Spring Boot API Version 2.0 of the Java Message Service API Version 1.0 of the Advanced Message Queueing Protocol (AMQP) 1.3. Supported configurations Refer to Red Hat AMQ 7 Supported Configurations on the Red Hat Customer Portal for current information regarding AMQ Spring Boot Starter supported configurations. 1.4. Document conventions The sudo command In this document, sudo is used for any command that requires root privileges. Exercise caution when using sudo because any changes can affect the entire system. For more information about sudo , see Using the sudo command . File paths In this document, all file paths are valid for Linux, UNIX, and similar operating systems (for example, /home/andrea ). On Microsoft Windows, you must use the equivalent Windows paths (for example, C:\Users\andrea ). Variable text This document contains code blocks with variables that you must replace with values specific to your environment. Variable text is enclosed in arrow braces and styled as italic monospace. For example, in the following command, replace <project-dir> with the value for your environment: USD cd <project-dir>

Commands:
cd <project-dir>
Chapter 4. Upgrading Red Hat build of Keycloak adapters After you upgrade the Red Hat build of Keycloak server, you can upgrade the adapters. Earlier versions of the adapter might work with later versions of the Red Hat build of Keycloak server, but earlier versions of the Red Hat build of Keycloak server might not work with later versions of the adapter. 4.1. Compatibility with older adapters Newer versions of the Red Hat build of Keycloak server potentially work with older versions of the adapters. However, some fixes of the Red Hat build of Keycloak server may break compatibility with older versions of the adapters. For example, a new implementation of the OpenID Connect specification may not match older client adapter versions. For this situation, you can use Compatibility modes. For OpenID Connect clients, the Admin Console includes OpenID Connect Compatibility Modes on the page with client details. With this option, you can disable some new aspects of the Red Hat build of Keycloak server to preserve compatibility with older client adapters. For more details, see the tool tips of individual switches. 4.2. Upgrading the EAP adapter To upgrade the JBoss EAP adapter, complete the following steps: Procedure Download the new adapter archive. Remove the adapter modules by deleting the EAP_HOME/modules/system/add-ons/keycloak/ directory. Unzip the downloaded archive into EAP_HOME . 4.3. Upgrading the JavaScript adapter To upgrade a JavaScript adapter, install the latest version from NPM . Procedure npm install keycloak-js@latest 4.4. Upgrading the Node.js adapter To upgrade a Node.js adapter that has been copied to your web application, perform the following procedure. Procedure Download the new adapter archive. Remove the existing Node.js adapter directory Unzip the updated file into its place Change the dependency for keycloak-connect in the package.json of your application

Commands:
Chapter 11. Networks 11.1. Network Elements The networks collection provides information about the logical networks in a Red Hat Virtualization environment. An API user accesses this information through the rel="networks" link obtained from the entry point URI. The following table shows specific elements contained in a network resource representation. Table 11.1. Network elements Element Type Description Properties link rel="vnicprofiles" relationship A link to the sub-collection for VNIC profiles attached to this logical network. link rel="labels" relationship A link to the sub-collection for labels attached to this logical network. data_center id= GUID A reference to the data center of which this cluster is a member. vlan id= integer A VLAN tag. stp Boolean: true or false true if Spanning Tree Protocol is enabled on this network. mtu integer Sets the maximum transmission unit for the logical network. If omitted, the logical network uses the default value. status One of operational or non_operational The status of the network. These states are listed in network_states under capabilities . usages complex Defines a set of usage elements for the network. Users can define networks as VM networks at this level. Important The API as documented in this section is experimental and subject to change. It is not covered by the backwards compatibility statement.

Commands:
Chapter 14. Adding custom SSL/TLS certificates when Red Hat Quay is deployed on Kubernetes When deployed on Kubernetes, Red Hat Quay mounts in a secret as a volume to store config assets. Currently, this breaks the upload certificate function of the superuser panel. As a temporary workaround, base64 encoded certificates can be added to the secret after Red Hat Quay has been deployed. Use the following procedure to add custom SSL/TLS certificates when Red Hat Quay is deployed on Kubernetes. Prerequisites Red Hat Quay has been deployed. You have a custom ca.crt file. Procedure Base64 encode the contents of an SSL/TLS certificate by entering the following command: USD cat ca.crt | base64 -w 0 Example output ...c1psWGpqeGlPQmNEWkJPMjJ5d0pDemVnR2QNCnRsbW9JdEF4YnFSdVd3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= Enter the following kubectl command to edit the quay-enterprise-config-secret file: USD kubectl --namespace quay-enterprise edit secret/quay-enterprise-config-secret Add an entry for the certificate and paste the full base64 encoded stringer under the entry. For example: custom-cert.crt: c1psWGpqeGlPQmNEWkJPMjJ5d0pDemVnR2QNCnRsbW9JdEF4YnFSdVd3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= Use the kubectl delete command to remove all Red Hat Quay pods. For example: USD kubectl delete pod quay-operator.v3.7.1-6f9d859bd-p5ftc quayregistry-clair-postgres-7487f5bd86-xnxpr quayregistry-quay-app-upgrade-xq2v6 quayregistry-quay-config-editor-6dfdcfc44f-hlvwm quayregistry-quay-database-859d5445ff-cqthr quayregistry-quay-redis-84f888776f-hhgms Afterwards, the Red Hat Quay deployment automatically schedules replace pods with the new certificate data.

Commands:
cat ca.crt | base64 -w 0
...c1psWGpqeGlPQmNEWkJPMjJ5d0pDemVnR2QNCnRsbW9JdEF4YnFSdVd3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
kubectl --namespace quay-enterprise edit secret/quay-enterprise-config-secret
custom-cert.crt: c1psWGpqeGlPQmNEWkJPMjJ5d0pDemVnR2QNCnRsbW9JdEF4YnFSdVd3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
kubectl delete pod quay-operator.v3.7.1-6f9d859bd-p5ftc quayregistry-clair-postgres-7487f5bd86-xnxpr quayregistry-quay-app-upgrade-xq2v6 quayregistry-quay-config-editor-6dfdcfc44f-hlvwm quayregistry-quay-database-859d5445ff-cqthr quayregistry-quay-redis-84f888776f-hhgms
Chapter 2. Storage 2.1. Storage Domains Overview A storage domain is a collection of images that have a common storage interface. A storage domain contains complete images of templates and virtual machines (including snapshots), ISO files, and metadata about themselves. A storage domain can be made of either block devices (SAN - iSCSI or FCP) or a file system (NAS - NFS, GlusterFS, or other POSIX compliant file systems). Note GlusterFS Storage is deprecated, and will no longer be supported in future releases. On NAS, all virtual disks, templates, and snapshots are files. On SAN (iSCSI/FCP), each virtual disk, template or snapshot is a logical volume. Block devices are aggregated into a logical entity called a volume group, and then divided by LVM (Logical Volume Manager) into logical volumes for use as virtual hard disks. See Red Hat Enterprise Linux Configuring and managing logical volumes for more information on LVM. Virtual disks can have one of two formats, either QCOW2 or raw. The type of storage can be either sparse or preallocated. Snapshots are always sparse but can be taken for disks of either format. Virtual machines that share the same storage domain can be migrated between hosts that belong to the same cluster.

Commands:
5.177. ltrace 5.177.1. RHBA-2012:0926 - ltrace bug fix and enhancement update Updated ltrace packages that fix multiple bugs and add one enhancement are now available for Red Hat Enterprise Linux 6. The ltrace utility is a debugging program that runs a specified command until the command exits. While the command is executing, ltrace intercepts and records both the dynamic library calls called by the executed process and the signals received by the executed process. The ltrace utility can also intercept and print system calls executed by the process. Bug Fixes BZ# 742340 Prior to this update, a traced process that had more than one thread could be aborted if the threads ran into breakpoints which the ltrace utility did not handle. With this update, ltrace attaches to the newly created threads, and carefully handles the breakpoints so that tracing events are not missed. This update also improves the detach logic so that a running process to which ltrace has been attached is left in a consistent state before detaching. BZ# 811184 Prior to this update, the ltrace utility could, under certain circumstances, fail to trace returns from functions which where called with a tail call optimization. This update adds support for tracing returns from functions called with a tail call optimization. Enhancement BZ# 738254 Prior to this update, ltrace could not trace library functions loaded via libdl. This update changes the behavior of the "-x" option for placing static breakpoints so that dynamic libraries are also considered and breakpoints set in them. This works for dynamic libraries that are linked to the binary as well as those that are opened with the function "dlopen" in runtime. All users of ltrace are advised to upgrade to this updated package, which fixes these bugs and adds this update.

Commands:
5.335. trace-cmd 5.335.1. RHEA-2012:0976 - trace-cmd enhancement update Updated trace-cmd packages that add one enhancement are now available for Red Hat Enterprise Linux 6. The trace-cmd packages contain a command line tool that interfaces with ftrace in the kernel. Enhancement BZ# 632061 This update adds support for the "-i" option that can be used to ignore events. By default, if an event is listed but cannot be found by the trace-cmd utility on the system, the utility exits. This option allows trace-cmd execution to continue even when an event is listed on the command line but cannot be found on the system. All users of trace-cmd are advised to upgrade to these updated packages, which add this enhancement.

Commands: