These release notes are generic for all SUSE Linux Enterprise Desktop 11 based products. Some parts may not apply to a particular architecture/product. Where this is not obvious, the respective architectures are listed explicitly.
A startup and preparation guide are found under the docu directory on the media. Any documentation (if installed) can be found below /usr/share/doc/ in the installed system.
This Novell product includes materials licensed to Novell under the GNU General Public License (GPL). The GPL requires that Novell make available certain source code that corresponds to those GPL-licensed materials. The source code is available for download at http://www.novell.com/linux/source. Also, for up to three years from Novell's distribution of the Novell product, upon request Novell will mail a copy of the source code. Requests should be sent by e-mail to sle_source_request@novell.com or as otherwise instructed at http://www.novell.com/linux/source. Novell may charge a fee to recover its reasonable costs of distribution.
SUSE Linux Enterprise Desktop 11 is the market's only enterprise-quality Linux desktop ready for routine business use. Developed and backed by Novell, SUSE Linux Enterprise Desktop provides market-leading usability, seamless interoperability with existing IT systems, and dozens of essential applications – all at a fraction of the price of proprietary operating systems. It comes bundled with the latest versions of leading applications such as the OpenOffice.org office productivity suite, Mozilla Firefox web browser, and Novell Evolution email and calendaring suite. In addition, it integrates with Microsoft SharePoint and Novell Teaming for group collaboration and supports a wide range of multimedia file formats, wireless and networking standards, and plug-and-play devices. Through the latest enhancements in power management and security, it also provides a green IT and bullet-proof desktop experience. Finally, SUSE Linux Enterprise Desktop delivers unparalleled flexibility. You can deploy it on a wide range of thick client devices including desktops, notebooks, netbooks, and workstations, on thin client devices, or as a virtual desktop. By leveraging the power of SUSE Linux Enterprise Desktop, your business can dramatically reduce costs, improve end-user security and increase workforce productivity.
The common PAM configuration files (/etc/pam.d/common-*) are now created and managed with pam-config.
In addition to AppArmor, SELinux capabilities were added as Technology Preview to SUSE Linux Enterprise Desktop 11, which will allow users to enable SELinux in SUSE Linux Enterprise Desktop if they wish.
What does SELinux basic enablement mean?
The shipped kernel features SELinux support.
We will apply SELinux patches to all "common" userland packages.
The libraries required for SELinux (libselinux, libsepol, libsemanage, etc.) were added to openSUSE and SUSE Linux Enterprise.
However, we are not offering enterprise class support for SELinux at this time; thus we will run QA with SELinux disabled to make sure that SELinux patches do not break the default delivery and the majority of packages.
We will not be shipping SELinux specific tools as part of the default distribution delivery. However, the packages (such as checkpolicy, policycoreutils, selinux-doc) will be available through the SUSE Linux Enterprise Desktop repositories.
By enabling SELinux in our upcoming codebase, we add missing pieces of code that exist in the community already, and we allow those who wish to use SELinux to do so conveniently without having to replace a big chunk of the distribution.
GNOME 2.24
GNOME was updated to the latest version and uses PulseAudio for sound.
KDE 4.1
KDE was updated to the latest 4.1.3 version.
X.org 7.4
Improved update stack
SUSE Linux Enterprise Desktop 11 comes with an improved update stack and a new command line tool zypper to manage the repositories and install/update packages.
Enhanced YaST partitioner
Extended built-in management infrastructure
CIM enablement with SFCB CIMON.
EVMS2 was replaced by LVM2
A public statement can be found at http://www.novell.com/linux2/volumemanagement/strategy.html.
Default Filesystem
The default file system in new installations was changed from ReiserFS to ext3. A public statement can be found at http://www.novell.com/linux/techspecs.html?tab=0.
GCC 4.3.2
glibc 2.9
Samba 3.2.4
Linux kernel 2.6.27
EFI enablement on AMD64
SWAP over NFS
This section includes installation related information for this release.
CJK (Chinese, Japanese, and Korean) do not work properly with text-mode installation if framebuffer is not used. The following solutions are available to work around this issue:
Use English or another non-CJK language for installation and later switch to a CJK language on the running system using YaST -> System -> Language.
If you must use a CJK language despite of the issue during the installation, do not select text-mode in Linuxrc boot-screen using <F3>, but select one of the other VGA modes instead. Then select the wanted CJK language using <F2> and add textmode=1 to the Linuxrc command-line. Now press Installation.
Use the graphical installation or install over SSH or VNC.
During the installation YaST resp. SaX2 are trying to detect displays and determine the display size and resolution. If you are installing on a notebook with the lid closed it is not be possible to detect the display. To avoid this problem it is highly recommended to keep the lid open during the installation.
If the detection failed, start YaST and click "Hardware" -> "Graphics Card and Monitor". Then configure the display manually.
As many development packages and sub-packages as possible have been moved to the SDK.
The installer uses per default persistent device names. If you plan to add additional storage devices to your system after the OS installation, we strongly recommend to use persistent device names for all storage devices.
To switch an already installed system to using persistent device names, enter the YaST2 partitioner. For each partition, select "Edit" and go to the "FStab Options" dialog. Any mount option except "Device name" provide you persistent devicenames. In addition, rerun the boot loader module in YaST to switch the bootloader to using the persistent device name also. Just start the module and select "Finish" to write the new proposed configuration to disk. This needs to be done before adding new storage devices.
For more information, see http://en.opensuse.org/Persistant_Storage_Device_Names.
iSCSI devices cannot be used for Linux Software RAID. Using MD devices on top of iSCSI triggers a cyclic dependency that leads to a crash.
To make NetworkManager send the hostname to the DHCP server, create a new network profile (see the Administration Guide for more information). Modify this profile with GNOME Configuration Editor (gconf-editor) and add the key /system/networking/connections/$number/ipv4/dhcp-hostname (replace "$number" with the actual number) with a string value. NetworkManager will send this value to the DHCP server. A special value system-hostname can be used to send the current hostname.
With this release we ship the GroupWise 8 client. If you want to keep the GroupWise 7 client, enter Software Manager and disable the GroupWise update.
With SUSE Linux Enterprise Desktop11 the kernel RPMs are split in different parts:
kernel-flavor-base
Very reduced hardware support, intended to be used in virtual machine images.
kernel-flavor
Extends the base package; contains all supported kernel modules.
kernel-flavor-extra
All other kernel modules which may be useful, but which are not supported. This package will not be installed by default.
The man command now asks which manual page the user wants to see if manual pages with the same name exist in different sections. The user is expected to type the section number to make this manual page visible.
If you want to get back the previous behavior, set MAN_POSIXLY_CORRECT=1 in a shell initialization file such as ~/.bashrc.
This release of SUSE Linux Enterprise Desktop ships with Novell AppArmor. The AppArmor intrusion prevention framework builds a firewall around your applications by limiting the access to files, directories, and POSIX capabilities to the minimum required for normal operation. AppArmor protection can be enabled via the AppArmor control panel, located in YaST under Novell AppArmor. For detailed information about using Novell AppArmor, see the documentation in /usr/share/doc/packages/apparmor-docs.
The AppArmor profiles included with SUSE Linux have been developed with our best efforts to reproduce how most users use their software. The profiles provided work unmodified for many users, but some users find our profiles too restrictive for their environments.
If you discover that some of your applications do not function as you expected, you may need to use the AppArmor Update Profile Wizard in YaST (or use the aa-logprof(8) command line utility) to update your AppArmor profiles. Place all your profiles into learning mode with the following: aa-complain /etc/apparmor.d/*
When a program generates many complaints, the system's performance is degraded. To mitigate this, we recommend periodically running the Update Profile Wizard (or aa-logprof(8)) to update your profiles even if you choose to leave them in learning mode. This reduces the number of learning events logged to disk, which improves the performance of the system.
SuSEfirewall2 is enabled by default. That means that by default you cannot log in from remote systems. It also interferes with network browsing and multicast applications, such as SLP and Samba ("Network Neighborhood"). You can fine-tune the firewall settings using YaST.
Technology Preview features are not supported or only supported limitedly. These features are mainly included for customer convenience and may not be funtionally complete, instable or in other ways not suitable for production use.
The eCryptfs kernel modules and the ecryptfs-utils package shipped with SUSE Linux Enterprise Desktop 11 are a preview of a stacked cryptographic filesystem for Linux.
SUSE Linux Enterprise Desktop 11 contains KVM as an additional virtualization solution. It is not supported by Novell, but an area of interest for future development and deliveries.
SUSE Linux Enterprise Desktop 11 contains a XEN host kernel and XEN tools support as a technical preview.
SUSE Linux Enterprise Desktop 11 contains the file system ext4, the successor of ext3, as a technical preview.
See the 'New features' section.
Puppet has been added a sa technical preview to SUSE Linux Enterprise Desktop 11.
It is possible to run SUSE Linux Enterprise Desktop 11 on a read-only root filesystem. Due to the huge number of possible configurations, this is currently not a supported scenario.
The /tmp and /var directories needs to be on a separate partition and cannot be mounted read-only.
After the installation has finished and all services are configured, login as root and do the following modifications:
Modify /etc/fstab and add "ro" to the mount options of the root filesystem entry.
rm /etc/mtab ln -s /proc/mounts /etc/mtab mkdir /var/lib/hwclock mv /etc/adjtime /var/lib/hwclock ln -s /var/lib/hwclock/adjtime /etc/adjtime # the following two steps are only necessary if you use dhcp: mv /etc/resolv.conf /var/lib/misc/ ln -s /var/lib/misc/resolv.conf /etc/resolv.conf # Now mount root filesystem read-only and reboot mount -o remount,ro / rebootOur kernel is compiled with support for Linux Filesystem Capabilities. It is disabled by default. Enable it by adding file_caps=1 as a kernel boot option.
The following list of current functionality has been removed with this SUSE Linux Enterprise Desktop release.
dante
powertweak
zmd
The following packages are deprecated and will be removed with SUSE Linux Enterprise Desktop 12:
lprng
sendmail
qt3
The JFS file system is no longer supported for new installations. The kernel file system driver is still available, but YaST does not offer partitioning with JFS.
For the future strategy and development in regard to volume and storage management on SUSE Linux Enterprise System, see http://www.novell.com/linux/volumemanagement/strategy.html.
This section contains a number of technical changes and enhancements for the experienced user.
The modify_resolvconf script is removed in favor of the more versatile netconfig script. The new script handles specific network settings from multiple sources more flexible and transparent. For more informations, see the updated manuals and the netconfig man-page.
In the shipped manuals, modify_resolvconf is erroneously referenced. We will correct it soon.
Instead of the madwifi driver the ath5k/ath9k in-kernel replacement is now available. ath5k/ath9k does not support access point mode yet, but normal networks (infrastructure and ad-hoc) are well supported by the new driver.
Lenovo ThinkPad laptops have special code in the MBR (master boot record) because of the "Blue ThinkVantage button" functionality. If detecting and preparing it properly fails, it might be necessary to restore the boot sector.
If you have a ThinkPad, ensure that the bootloader is not installed into the MBR (verify it in the installation proposal!) and the MBR is not rewritten by generic code (in installation proposel select Bootloader -> Boot Loader Installation -> Boot Loader Options -> Write Generic Boot Code to MBR -- should be unchecked).
If your MBR gets rewritten, the ThinkVantage button will not work anymore. The back-up of the MBR is stored in /var/lib/YaST2/backup_boot_sectors/.
Locale Settings in ~/.i18n
If you are not satisfied with locale system defaults, change the settings in ~/.i18n. Entries in ~/.i18n override system defaults from /etc/sysconfig/language. Use the same variable names but without the RC_ namespace prefixes, for example, use LANG instead of RC_LANG. For information about locales in general, see "Language and Country-Specific Settings" in the Reference Manual.
Configuration of kdump
The kernel is crashing or otherwise misbehaving and a kernel core dump needs to be captured for analysis.
A description on how to setup kdump can be found under the following URL: http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3374462&sliceId=SAL_Public
Realtime Applications
When running real-time applications on larger systems, lower maximum latencies can be achieved by employing the new disable_buffer_lru kernel command-line option. This disables the per-CPU LRU in the buffer cache, and may thus decrease overall filesystem performance.
JPackage Standard for Java Packages
Java packages are changed to follow the JPackage Standard (http://www.jpackage.org/). Read the documentation in /usr/share/doc/packages/jpackage-utils/ for information.
Loading unsupported kernel drivers
Every kernel module has a flag 'supported'. If this flag is not set loading this module will taint the kernel. Kernels, which are tainted are not supported. To avoid this, unsupported Kernel modules are part of an extra RPM (kernel-<flavor>-extra). Since for most desktops this would be a problem, loading of those drivers is allowed by default.
To prevent loading of unsupported kernel drivers automatically during boot, change the line allow_unsupported_modules 1 in /etc/modprobe.d/unsupported-modules to allow_unsupported_modules 0.
Nonexecutable Stack
Already introduced for SUSE Linux Enterprise Desktop 9 on the x86-64 (AMD64) architecture with 64-bit kernels, the Linux kernel in SUSE Linux Enterprise Desktop also supports nonexecutable stack (NX) on x86 for CPUs that support it (Intel Prescott and AMD64) with 32-bit kernels. For this to work, the kernel with PAE support, kernel-bigsmp, must be installed. Go into YaST and install that kernel instead of your default kernel. For 64-bit kernels, all kernels support NX.
The nonexecutable stack improves the security of your system. Many security vulnerabilities are stack overflows, where an attacker overwrites the stack of your program by feeding oversized data to the application that fails to properly check the length. Depending on the details of the program, with nonexecutable stack, these vulnerabilities may either not be exploitable (and only crash the program, resulting in a DoS) or at least be significantly harder to exploit.
Some applications do require executable stacks. The compiler detects this during compilation and marks the binaries accordingly. The kernel enable an executable stack for them to allow them to work.
On x86-64, to provide a higher level of security, the user can pass noexec=on on the kernel command line. The kernel then uses a nonexecutable stack unconditionally and also marks the data section of a program nonexecutable. This provides a higher protection level than just the nonexecutable stack, but potentially causes problems for some applications. Novell has not found any problems during testing the most commonly used applications and services. Because it is not the default, this has not been tested as extensively as the stack protection alone, so Novell only recommends this setup for servers after the administrator has verified that all needed services continue to function properly.
Read the READMEs on the CDs.
Get the detailed changelog information about a particular package from the RPM:
rpm --changelog -qp <FILENAME>.rpm
<FILENAME>. is the name of the RPM.
Check the ChangeLog file in the top level of CD1 for a chronological log of all changes made to the updated packages.
Find more information in the docu directory of CD1 of the SUSE Linux Enterprise Desktop 11 CDs. This directory includes PDF versions of the SUSE Linux Enterprise Desktop 11 startup and preparation guides.
http://www.novell.com/documentation/sled11/ contains additional or updated documentation for SUSE Linux Enterprise Desktop 11.
Visit http://www.novell.com/linux/ for the latest Linux product news from SUSE/Novell and http://www.novell.com/linux/source/ for additional information on the source code of SUSE Linux Enterprise products.
For the latest version of SUSE Linux Enterprise Desktop 11 Release Notes, see http://www.novell.com/linux/releasenotes/i586/SUSE-SLED/11/.
There are two plugins available: the latest version of the Java plugin (libnpjp2.so), and the legacy version (libjavaplugin_oji.so). Both are installed in the system if you install Java, but the new version is active. Some plugins using Java have problems with that version. If you are affected by this it is recommended to change the link of /etc/alternatives/javaplugin to point to the legacy one. This may cause other problems.
Novell is aware of the problem and working on a solution for that.
For SUSE Linux Enterprise Desktop 11 documentation, see http://www.novell.com/documentation/sled11.
The names of the boot prompt parameters given in the manual are obsolete and will get discontinued in SUSE Linux Enterprise 11. Instead of smturl use regurl and instead of smtcert use regcert.
By default, Firefox does not honor settings made with the GConf system. In order to make the GConf lockdown keys effective, edit /usr/lib/firefox/local-configuration.js and set config.use_system_prefs to true. This file allows the administrator to set and lock preferences that will apply to every Firefox user.
There is only limited graphics support on IBM SurePOS 700 4800-7X3 systems with 4820-2GN monitors. During a graphical installation you can encounter an error message from the monitor (OSD = On Screen Display) such as:
OUT OF RANGE H: -48.4 KHz V: -60.1 Hz.
To work around this issue try a different resolution, VESA or text-mode for installation. Another option is to choose the native driver by specifying acceleratedx=1 on the boot prompt. It might also help to update the BIOS.
After system installation the problem does not occur any longer and the graphics system is fully supported.
On the FIC GE2 platform when using 24 BPP color depth and resolutions >= 1280x1024 on the DVI interface stripes are displayed on the X server. This distorts all windows.
Changing to 16 BPP color depth seems to solve the problem.
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. Please refer to http://www.novell.com/info/exports/ for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export approvals.
Copyright ® 2007 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.novell.com/company/legal/patents and one or more additional patents or pending patent applications in the U.S. and in other countries.
For Novell trademarks, see Novell Trademark ad Service Mark list (http://www.novell.com/company/legal/trademarks/tmlist.html). All third-party trademarks are the property of their respective owners.