Sometime starting fairly recently, dnf update runs some kind of extra check and reports to me that "you are currently running kernel x and there is an ABI compatible upgrade pending." It then recommends a restart. It also always recommends restarting the wsdd service.

There is no kernel update pending - I am on the latest RL9.3 kernel (362.24.1.el9_3.0.1)

It looks to me like dnf is automatically running a needrestart command, but I didn't ask for that to my knowledge. I did install the needrestart package, but I didn't expect dnf to autorun it.

So far I've just been ignoring this. What's going on and how do I stop it?

Hello all,

I'm working on building a single image build pipeline to build functionally identical images for diverse compute providers.

In working on this, I've encountered an issue where the AWS AMI import fails importing our Rocky 8 image complaining that it cannot find grub.cfg. Unfortunately, the AMI import is a black box so I have no idea where it's expecting to find it or what else may be going on.

Has anyone encountered and successfully resolved this?

I'm trying to set up PXE boot into legacy BIOS with Rocky Linux.

As best as I can tell, the DHCP server is correctly provisioning the IPV4 address, the tftp server is successfully transferring vmlinuz and initrd.img (I get a success message that vmlinuz and itird.img have been transferred). I checked in my browser that the image tree and kickstart file are accessible with http.

When attempting the PXE boot, I get to a menu screen that gives the options "Install system", "Install system with basic video driver", "Rescue installed system", "Boot from local drive." Below the menu it says "Press [Tab] to edit options", "Automatic boot in 60 seconds".

It runs for several hours, and most of the messages say "IPv6: ADDRCONF (NETDEV_UP): ens9: link is not ready" and "IPv6: ADDRCONF (NETDEV_UP): ens108: link is not ready"

And then several hours later I get:

dracut-initqueue[1850]: Warning: dracut-initqueue timeout - starting timeout scripts IPv6: ADDRCONF (NETDEV_UP): ens9: link is not ready IPv6: ADDRCONF (NETDEV_UP): ens108: link is not ready

The above message gets repeated a few times and then

Starting Setup Virtual Console" Started Setup Virtual Console Starting Dracut Emergency Shell Warning: /dev/root does not exist

I looked at the journalctl logs on the machine I'm trying to provision, and don't really see anything that jumps out to me as useful in them, and I looked at the packet captures, and they mostly just appear to show that the files are getting transferred from the DHCP, http, and tftp servers like I think they should.

Several questions:

1.) What might be going wrong? What is a good process or checklist to try and narrow down the problem? 2.) Is it possible to disable IPv6 in the pxelinux config file? It would be nice to skip the hours of checking for something with IPv6 on the network interfaces. 3.) Is it possible that this error might be a physical issue with the network card or ethernet cable? How would I know/check?

Thank you so much in advance. Any suggestions are greatly appreciated.

Hello all, I am trying to host sftp server which will be accessed by multiple users with their individual accounts and they should not have any access to any other files then their user directory. And also they should not be able to ssh into server they only need sftp right. Any suggestions?

fyi, if anyone else has the same issue,

​

adding a route w/o explicitly stating its subnet, defaults to /24 subnet which can cause major network problems

each route you add in static config, needs a CIDR suffix, ie /32, /28, etc

heres the summary:

https://www.reddit.com/r/Network/comments/1cb7ww1/networkmanager_pain_in_redhat9_doesnt_obey/

Hello,

Full disclosure, I made a post here not to long ago, that is similar, but I am trying to learn. I am trying to resolve the CVE's that are listed for for the latest version of Apache 2.4.59. When I check the release notes on the Rocky install, I do not see anything in the backports that remediates the CVE's, specifically CVE-2024-27316.

 conf.d]# rpm -q --changelog httpd | grep CVE-
- Resolves: #2177753 - CVE-2023-25690 httpd: HTTP request splitting with
- Resolves: #2162500 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
- Resolves: #2162486 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
- Resolves: #2162510 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
- Resolves: #2094997 - CVE-2022-26377 httpd: mod_proxy_ajp: Possible request
- Resolves: #2097032 - CVE-2022-28615 httpd: out-of-bounds read in
- Resolves: #2098248 - CVE-2022-31813 httpd: mod_proxy: X-Forwarded-For dropped
- Resolves: #2097016 - CVE-2022-28614 httpd: out-of-bounds read via ap_rwrite()
- Resolves: #2097452 - CVE-2022-29404 httpd: mod_lua: DoS in r:parsebody
- Resolves: #2097459 - CVE-2022-30522 httpd: mod_sed: DoS vulnerability
- Resolves: #2097481 - CVE-2022-30556 httpd: mod_lua: Information disclosure
- Resolves: #2065251 - CVE-2022-22720 httpd: HTTP request smuggling
- Resolves: #2066311 - CVE-2021-44224 httpd: possible NULL dereference or SSRF
- Resolves: #2035064 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow

When I check on the Redhat site they mention under Mitigation " Please update the affected package as soon as possible."

The version of Apache that we are on right now is 2.4.57

httpd -v
Server version: Apache/2.4.57 (Rocky Linux)

When I check for the installed source is comes back to "appstream"

# dnf list installed | grep httpd
httpd.x86_64                              2.4.57-5.el9                     u/appstream
httpd-core.x86_64                         2.4.57-5.el9                     @appstream
httpd-filesystem.noarch                   2.4.57-5.el9                     @appstream
httpd-tools.x86_64                        2.4.57-5.el9                     @appstream
rocky-logos-httpd.noarch                  90.14-2.el9                      @appstream

And when I check for updates there appears to be no update besides "rocky-logos-httpd.noarch" which I believe is for updating the PHP version.

With all that being said, here is where I am at, Apache says that there is an update that patches CVE's, Redhat says that they are not patching this CVE and to update the install but when I check on the Rocky OS itself it is not seeing any updates.

I am running "sudo dnf makecache" before I check for updates but still nothing shows up. Any ideas? Am I still way off? Do I need to point to a different repository specifically for Apache?

Thanks!

I just installed rocky 9.3 with gnome desk top. I have an AMD Ryzen 7 5700g with an NVIDIA 3060 card. When I try this

1. sudo dnf update && sudo dnf upgrade -y
2. sudo dnf install epel-release
3. sudo dnf config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/cuda-rhel9.repo 220
4. sudo dnf install kernel-devel-$(uname -r) kernel-headers-$(uname -r)
5. sudo dnf install nvidia-driver nvidia-settings
6. sudo dnf install cuda-driver
7. sudo reboot now

When I try to run this sudo dnf install nvidia-driver nvidia-settings

I get this error

Cannot install the best candidate for the job

- package dnf-plugin-nvidia-1.1-1.el8.noarch from cuda-rhel8-x86_64 is filtered out by modular filtering

- nothing provides python(abi) = 3.6 needed by dnf-plugin-nvidia-1.1-1.el8.noarch from cuda-rhel8-x86_64

- package dnf-plugin-nvidia-1.6-1.el8.noarch from cuda-rhel8-x86_64 is filtered out by modular filtering

- nothing provides python(abi) = 3.6 needed by dnf-plugin-nvidia-1.6-1.el8.noarch from cuda-rhel8-x86_64

- package dnf-plugin-nvidia-1.9-1.el8.noarch from cuda-rhel8-x86_64 is filtered out by modular filtering

- nothing provides python(abi) = 3.6 needed by dnf-plugin-nvidia-1.9-1.el8.noarch from cuda-rhel8-x86_64

- nothing provides python(abi) = 3.6 needed by dnf-plugin-nvidia-2.0-1.el8.noarch from cuda-rhel8-x86_64

Problem 2: package nvidia-settings-3:550.54.15-1.el8.x86_64 from cuda-rhel8-x86_64 requires nvidia-driver(x86-64) = 3:550.54.15, but none of the providers can be installed

- package nvidia-driver-3:550.54.15-1.el8.x86_64 from cuda-rhel8-x86_64 requires dnf-plugin-nvidia, but none of the providers can be installed

- cannot install the best candidate for the job

- package dnf-plugin-nvidia-1.1-1.el8.noarch from cuda-rhel8-x86_64 is filtered out by modular filtering

- nothing provides python(abi) = 3.6 needed by dnf-plugin-nvidia-1.1-1.el8.noarch from cuda-rhel8-x86_64

- package dnf-plugin-nvidia-1.6-1.el8.noarch from cuda-rhel8-x86_64 is filtered out by modular filtering

- nothing provides python(abi) = 3.6 needed by dnf-plugin-nvidia-1.6-1.el8.noarch from cuda-rhel8-x86_64

- package dnf-plugin-nvidia-1.9-1.el8.noarch from cuda-rhel8-x86_64 is filtered out by modular filtering

- nothing provides python(abi) = 3.6 needed by dnf-plugin-nvidia-1.9-1.el8.noarch from cuda-rhel8-x86_64

- nothing provides python(abi) = 3.6 needed by dnf-plugin-nvidia-2.0-1.el8.noarch from cuda-rhel8-x86_64

(try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)

[wbiggs@wbiggs-desktop ~]$

​

Rocky Linux 9.3

If I run vi, vim gets executed. I checked /usr/bin expecting to find that vi was symlinked to vim, but vi is actually a small executable (only 691 bytes).

What is in /usr/bin/vi that causes vim to be executed?

How up to date software package managers in rocky linux? I tried to check it online but couldn't find any info. Like which version of blender downloads when you enter like sudo apt install blender?

​

Thank you.

I had someone request Rocky 9.3, and our cloud mgmt system only has 9.1 on it. So I went to the Rocky website, and clicked cloud images, and all of the urls are AWS. I don't have an AWS account, we use an on-prem VMWare cloud. Even if I could get ahold of the AWS image, it is probably a qcow2, which I can convert to a VMDK, but still have the issue of no OVF to complement the VMDK (VMWare requires an OVF and a VMDK at a minimum). Now, I know I could go into vCenter and launch a VM with an ISO and do a Minimal Install, but the cloud images are pre-tested for, well, clouds (as opposed to servers). They have cloud-init on them, among other cloud-tweaks.

Does anyone have a suggestion on an easy-to-use, easy-to-automate way of getting a Rocky cloud image downloaded and uploaded to VMWare (we actually load it to a cloud management system and from there, it goes to VMWare)? Trying to get cloud images on VMWare is looking very tedious.

I am getting vulnerability scans for a 9.3 host that is saying it is less than 3.0.0. I am not the Linux admin, just looking for some clarification or a place online where I can verify the latest supported version.

​

Thanks!

I have previously run qemu-s390x with my old laptop (cpu from 2010), but only worked when using old Ubuntu LTS release s390x image

Since I have a ryzen 5600x (cpu from 2019), will qemu-s390x be able to emulate / run the latest rocky linux s390x image this time?

I am trying to add repo sync in foreman for 9.3. Trying to use 9.3 repo urls as upstream but I keep getting permission denied. I tried accessing the repodata from browser, where i get 403 forbidden error. Happens for all repos in 9.3. 9.2 is accessible.

I just freshly installed rocky 9 lxc on proxmox, and then I installed docker (not podman).
After starting a docker container for plex, it is not reachable from any other device. However it is shown if i run:

ss -tuln
Netid              State               Recv-Q              Send-Q                           Local Address:Port                            Peer Address:Port              Process              
udp                UNCONN              0                   0                                      0.0.0.0:68                                   0.0.0.0:*                                      
tcp                LISTEN              0                   4096                                   0.0.0.0:443                                  0.0.0.0:*                                      
tcp                LISTEN              0                   4096                                   0.0.0.0:81                                   0.0.0.0:*                                      
tcp                LISTEN              0                   4096                                   0.0.0.0:80                                   0.0.0.0:*                                      
tcp                LISTEN              0                   128                                    0.0.0.0:22                                   0.0.0.0:*                                      
tcp                LISTEN              0                   4096                                   0.0.0.0:32400                                0.0.0.0:*                                      
tcp                LISTEN              0                   4096                                      [::]:443                                     [::]:*                                      
tcp                LISTEN              0                   4096                                      [::]:81                                      [::]:*                                      
tcp                LISTEN              0                   4096                                      [::]:80                                      [::]:*                                      
tcp                LISTEN              0                   128                                       [::]:22                                      [::]:*                                      
tcp                LISTEN              0                   4096                                      [::]:32400                                   [::]:*  

Any ideas what it could be? The nginx reverse proxy is working, but it also doesn't work for plex.
I an still rather new to homelab, and especially rocky linux.

Hi!

First, let me emphasize that I understand this is a more server/enterprise-focused distro. I switched to Rocky after some tests and I love it! I use it because of work requirements: it's the only non-RedHat supported distro for Autodesk Maya.

Rocky has been amazing for me. Easy to install, rock solid, great software compatibility.
Sometimes when I'm not working I like to play some games. I mostly play KPatience (flathub), though sometimes I like to play some games on Steam. But I'm having some problems with them and I don't know how to fix it since I'm a noob to this distro.

My main problem is some games run very poorly or don't start at all. For example, Counter-Strike 1.6 runs at 20-25 FPS when it should run at 1000 at least.
Counter-Strike Source doesn't start at all. Black Mesa doesn't start too.

Counter-Strike 2 does start and runs very well. I get 250-350 FPS with 19 BOTs on Dust2.
Don't Starve runs poorly, 25 FPS.
Rise of the Tomb Raider runs very well, 135-200 FPS.
More games still need testing.

Initially I thought SELinux was the problem, but these problems persist after I disable it.

Does anyone have some pointers on how I could make my games run?

I'm running:
Kernel 5.14.0-362.24.1.el9_3.x86_64
NVIDIA 550.54.15 from NVIDIA's RHEL9 repo
KDE 5.27.6
I installed Steam via the RPMFusion non-free repo (RHEL9).

Let me know if there's more info I can provide.

I saw the announcement ( June 2022 ) about FIPS 140-3. Also the NIST web site shows it as a system under test (yay? NIST Implementation Under Test List. ). Started last November/December 2023 and more modules January 2024.

However here we are in April 2024 and there is still no listing from Ctrl IQ, Inc. or anyone else. The page on Ctrl IQ's web site is gone too.

Anyone know what's up? We'd like to bid on some contracts but it is required to be FIPS 140-3 compliant.

I tried "Ctrl X" + "Ctrl Y" but it just shows "(insert Scroll (^E/^Y), even tried ":wq + enter" but doesn't rlly help. What do

https://preview.redd.it/5hcjkane0aqc1.jpg?width=1343&format=pjpg&auto=webp&s=2aa24936a2fdc1f6fc9a5d98d8b78ab78f6f1648

I use Rocky Linux on all my servers so a lot of my scripts and automation are written for Enterprise Linux (specifically Rocky Linux 9). I have 2 clusters of Raspberry Pis that I upgraded from the 4 model to the 5 model. I downloaded the image listed below:

https://dl.rockylinux.org/pub/sig/9/altarch/aarch64/images/RockyLinuxRpi_9-latest.img.xz

I was getting issues when attempting to boot and after some research online, I found the following forum (back from November)

https://forums.rockylinux.org/t/raspberry-pi-5-doesnt-boot-with-alt-image/11894

I haven't seen any updates since then so I am wondering when support for Raspberry Pi 5 is going to come for Rocky Linux.

I downloaded and installed rocky9.3 on a dual boot with windows11. The display seems fine on w11 but in Rocky everything feels zoomed in. In the display settings the resolution is set to 1024x768 but I am unable to change it.

I have a display port cable connected and when I run xrandr -verbose I get this…

xrandr: Failed to get size of gamma for output default Screen 0: minimum 1024 x 768, current 1024 x 768, maximum 1024 x 768 default connected primary 1024x768+0+0 0mm x 0mm 1024x768 76.00* [root@localhost Downloads]# xrandr --verbose xrandr: Failed to get size of gamma for output default Screen 0: minimum 1024 x 768, current 1024 x 768, maximum 1024 x 768 default connected primary 1024x768+0+0 (0x526) normal (normal) 0mm x 0mm       Identifier: 0x525       Timestamp: 9182507       Subpixel: unknown       Clones:
      CRTC: 0       CRTCs: 0       Transform: 1.000000 0.000000 0.000000        0.000000 1.000000 0.000000        0.000000 0.000000 1.000000        filter:       _MUTTER_PRESENTATION_OUTPUT: 0       non-desktop: 0             supported: 0, 1 1024x768 (0x526) 59.769MHz *current h: width 1024 start 0 end 0 total 1024 skew 0 clock 58.37KHz v: height 768 start 0 end 0 total 768 clock 76.00Hz

Does this have anything to do with the nvidia drivers? I’m at my wits end.. any help greatly appreciated.

Hello all,

i'm currently working to implement some tpm2.0 functionnalities for a personnal project on a rocky based system. I'm wondering if there any documentation or reference for the pcr use for each measurement or if i'm fated to deduce it myself.
I'm neither a pro on rocky or tpm2 tech

The main focus for my project is about the measured (and not secure) state of the machine before Luks decryption but if i can catch all pcr usage it will be usefull aswell.

The tpm2 bible only give exemple of usecase for pcr and i found the ArchLinux implementation which is i think not the same as Rocky one

​

arch pcr

Any help is welcome.

Thanks !

I have built my own VMs locally (either ESXi or VM workstation) and have successfully moved them to AWS as AMI templates for deployment. I did it with CentOS 7, CentoS 8, Rocky 8 and now Rocky 9.

Rocky 9 has been giving me problems though. I can get my initially build up there, but there are some new things I had to learn with the T3 types like ema and nvme drivers being added to the initramfs.

But when I patch my system (simple sudo dnf -y update) on reboot it hangs. Without access to the console I cannot see what is going on.

• If I exclude kernel patches it works
• After patching, if I use grubby to keep it at the current kernel (vmlinuz-5.14.0-362.18.1.el9_3.0.1.x86_64) it works
• If I rebuild all initramfs (dracut --regenerate-all --force -vvvv) the vmlinuz-5.14.0-362.18.1.el9_3.0.1.x86_64 kernel still works.
• If I reboot and go to newer kernel it doesn't work, it just hangs

​

Older Kernel Works, Newer one doesn't

​

Just hangs like this

Any thoughts?

Edit: Older Kernel does not work either.

Hello, I want to ask for help with public repositories.

I have own repository server and PCs without internet so I have repository for me to install things on that PCs. Issue is when is performed update, it will reset public repos and then DNF/YUM cant reach public repos. Is there way to disable reseting default repository list or force update my private list?

​

Thank you for any help.

Hello everyone,

I want to know if somebody has tried and successfully setup policyd-rate-limit (which is a python milter for postfix), it controls the number of email recieved or sent and blocks it according to user or account. I have been trying to setup but having issues, might be the package issue, posted the issue on github repo but no reply so far.

If someone has tried and installed it do let me know. The error I am facing are path issues, some library paths are not being setup by the pip3 installation and making from the source. when I replaced the path with snapd but still the milter fails to run.

If there is a guide or proper documentation for installation and setup in rocky linux.

My environment:
rocky linux 8.9
postfix 3.5.8
python 3.6
pip 21.3.1

The issue:
/etc/init.d/policyd-rate-limit: line 29: /lib/lsb/init-functions: No such file or directory
policyd-rate-limit is not running ... failed! ,when, service policyd-rate-limit status is called
tried changing service policyd-rate-limit status with snapd's init-functions (/var/lib/snapd/snap/...) which has the same variables as called by /etc/init.d/policyd-rate-limit

Any help will be apreciated.
Thank you

Update 3:

The plot thickens, it seems that GDM just plain sucks... :/ Will mess with sddm and other UIs...

Update 2:

So for shits and giggles, I also built a "click next, default" RL9 on ESXi 7 with no special treatment. Open-VM-Tools gets tacked on automatically and when the machine locks itself and screensaver kicks in, the blank screen with kicks in eventually where no keypress does anything, EXCEPT if I spam CTRL+ALT+F1 a few times... then typically the login screen comes back and/or I need to also resize the window.

So this completely rules out STIG as being the culprit, the whole resize the window bit also was an issue with RL8 with no mods except for the Open-VM-Tools.

This would would indicate that Open-VM-Tools and/or VMware 7 is to blame? I have also seen other reports for RHEL 7/8 being ran on virtualbox years ago with the exact same issue using the "extension bundle" or whatever equivalent to vmtools they provide...

I can say that I've never seen that issue with Ubuntu and this seems particularly with RHEL/RL(x) series of operating system.

I tried adding "nomodeset" to the grub setting, but then all advanced graphics options go away.

Anyhow, the workaround is to spam CTRL+ALT+F1 a few times until the GUI kicks back in... kinda wish I didn't have to.

-----------

Update 1:

So plot twist...CTRL+ALT+F1 brings back the GUI to life....It's almost as if one of the STIGs does this on purpose.

I hit that combo key but also hit other keys like F2 and F3... I noted that hitting one brought me through a terminal view and then shortly after back to the login screen...

I'll take a snapshot next and confirm which key.

------

Hello,

Noob question with Rocky Linux 9.3.

I made a VM and often times, the VM will go idle and when I view it in vSphere, it's black with just a blinking dot, no desktop shown... Any reason this happens?

ESXi 7 and open-vm-tools installed, I did disable the screen timeout.

STIG is implemented end to end.

Sorry, if this is already been asked 1 million times. I have a cluster of about a dozen raspberry pi 5s that I am running Debian. We use Rocky Linux 9 on our VMware cluster internally and I would like to switch my pi’s to Rocky for conformity but it’s only supported on models 3 and 4. Anyone with some insight on when this might become available? Thanks you in advance!

When I tried to boot, it was directly going to dracut powershell.

Warning: /dev/mapper/rl-root does not exist.

In Bios, the Harddisk was at HDD0 but after it became HDD1. There is no option for USB Bootable as well. Please someone give some assistance. I tried most of the things on the internet.