These release notes are generic for all SUSE Linux Enterprise Desktop 11 based products. Some parts may not apply to particular architectures or products. Where this is not obvious, the respective architectures are listed explicitly.
A startup and preparation guide can be found under the docu directory on the media. Any documentation (if installed) can be found below /usr/share/doc/ in the installed system.
This Novell product includes materials licensed to Novell under the GNU General Public License (GPL). The GPL requires that Novell make available certain source code that corresponds to those GPL-licensed materials. The source code is available for download at http://www.novell.com/linux/source. Also, for up to three years from Novell's distribution of the Novell product, Novell will upon request mail a copy of the source code. Requests should be sent by e-mail to sle_source_request@novell.com or as otherwise instructed at http://www.novell.com/linux/source. Novell may charge a fee to recover the costs of distribution, within reason.
SUSE Linux Enterprise Desktop 11 is the market's only enterprise-quality Linux desktop ready for routine business use. Developed and backed by Novell, SUSE Linux Enterprise Desktop provides market-leading usability, seamless interoperability with existing IT systems, and dozens of essential applications—all at a fraction of the price of proprietary operating systems. It comes bundled with the latest versions of leading applications such as OpenOffice.org office productivity suite, Mozilla Firefox web browser, and Novell Evolution email and calendar suite. In addition, it integrates with Microsoft SharePoint and Novell Teaming for group collaboration and supports a wide range of multimedia file formats, wireless and networking standards, and plug-and-play devices.
Through the latest enhancements in power management and security, SUSE Linux Enterprise Desktop 11 also provides an environmentally friendly IT experience (Green IT) and an error-proof desktop. Finally, SUSE Linux Enterprise Desktop delivers unparalleled flexibility. You can deploy it on a wide range of thick client devices (including desktops, notebooks, netbooks, and workstations), on thin client devices, or as a virtual desktop. By leveraging the power of SUSE Linux Enterprise Desktop, your business can dramatically reduce costs, improve end-user security and increase workforce productivity.
The common PAM configuration files (/etc/pam.d/common-*) are now created and managed with pam-config.
In addition to AppArmor, SELinux capabilities were added as Technology Preview to SUSE Linux Enterprise Desktop 11, which will allow users to enable SELinux in SUSE Linux Enterprise Desktop, if they wish.
What does SELinux basic enablement mean?
The shipped kernel features SELinux support.
We will apply SELinux patches to all "common" userland packages.
The libraries required for SELinux (libselinux, libsepol, libsemanage, etc.) were added to openSUSE and SUSE Linux Enterprise.
However, we are not offering enterprise class support for SELinux at this time; thus we will run QA with SELinux disabled to ensure that SELinux patches do not break the default delivery and the majority of packages.
We will not be shipping SELinux specific tools as part of the default distribution delivery. However, the packages (such as checkpolicy, policycoreutils, selinux-doc) will be available through the SUSE Linux Enterprise Desktop repositories.
By enabling SELinux in our upcoming codebase, we add missing pieces of code that exist in the community already, and we allow those who wish to use SELinux to do so conveniently without having to replace a large portion of the distribution.
GNOME 2.24
GNOME was updated to the latest version and uses PulseAudio for sound.
KDE 4.1
Novell introduces KDE 4 as an innovative free software desktop and applications such as the Konqueror web browser, the Dolphin file manager, the Okular document reader, the System Settings control center and more. This new version of KDE is built on KDE Libraries which provide easy access to resources on the network by means of KIO and advanced visual capabilities through Qt4. Phonon and Solid. Customers migrating from SUSE Linux Enterprise Desktop 10 using KDE are getting a new user experience in version 11. We recommend backing up your user home directory when upgrading from SUSE Linux Enterprise Desktop 10 to SUSE Linux Enterprise Desktop 11. (Partly based on http://www.kde.org/announcements/4.0/)
KDE was updated to the latest 4.1.3 version.
X.org 7.4
Improved update stack
SUSE Linux Enterprise Desktop 11 comes with an improved update stack and the new command line tool zypper to manage the install/update packages and repositories.
Enhanced YaST partitioner
Extended built-in management infrastructure
CIM enablement with SFCB CIMON.
EVMS2 was replaced by LVM2
A public statement can be found at http://www.novell.com/linux2/volumemanagement/strategy.html.
Default Filesystem
The default file system in new installations was changed from ReiserFS to ext3. A public statement can be found at http://www.novell.com/linux/techspecs.html?tab=0.
GCC 4.3.2
glibc 2.9
Samba 3.2.4
Linux kernel 2.6.27
EFI enablement on AMD64
SWAP over NFS
This section includes installation related information for this release.
CJK (Chinese, Japanese, and Korean) does not work properly with text-mode installation if framebuffer is not used. Other languages that require special fonts are probably also affected. The following solutions are available to work around this issue:
Use English or another non-CJK language for installation and later switch to a CJK language on the running system using YaST -> System -> Language.
If you must use a CJK language during the installation, do not select text-mode in the boot loader screen using <F3>, but select one of the other VGA modes instead. Then select the wanted CJK language using <F2> and add textmode=1 to the boot loader command-line. Now press Installation.
Use the graphical installation or install over SSH or VNC.
During the installation YaST resp. SaX2 tries to detect displays and determine the display size and resolution. If you are installing on a notebook with a closed lid it is not be possible to detect the display. To avoid this problem you must keep the lid open during installation.
If the detection fails, start YaST and click "Hardware" -> "Graphics Card and Monitor". Then configure the display manually.
As many development packages and sub-packages as possible have been moved to the SDK.
The installer uses default persistent device names. If you plan to add additional storage devices to your system after the OS installation, we strongly recommend you use persistent device names for all storage devices.
To cause an already installed system to use persistent device names, enter the YaST2 partitioner. For each partition, select "Edit" and go to the "FStab Options" dialog. Any mount option except "Device name" provides persistent device names. In addition, rerun the boot loader module in YaST to switch the bootloader to using the persistent device name. Just start the module and select "Finish" to write the new proposed configuration to disk. This needs to be done before adding new storage devices.
For more information, see http://en.opensuse.org/Persistant_Storage_Device_Names.
iSCSI devices cannot be used for Linux Software RAID. Using MD devices on top of iSCSI triggers a cyclic dependency that leads to a system crash.
To make NetworkManager send the hostname to the DHCP server, create a new network profile (see the Administration Guide for more information). Modify this profile with GNOME Configuration Editor (gconf-editor) and add the key /system/networking/connections/$number/ipv4/dhcp-hostname (replace "$number" with the actual number) with a string value. NetworkManager will send this value to the DHCP server. A special value system-hostname can be used to send the current hostname.
We ship the GroupWise 8 client with this release. If you want to keep the GroupWise 7 client, enter Software Manager and disable the GroupWise update.
With SUSE Linux Enterprise Desktop11 the kernel RPMs are split into different parts:
kernel-flavor-base
Very reduced hardware support, intended to be used in virtual machine images.
kernel-flavor
Extends the base package; contains all supported kernel modules.
kernel-flavor-extra
All other kernel modules which may be useful but are not supported. This package will not be installed by default.
The man command now asks which manual page the user wants to see if manual pages with the same name exist in different sections. The user is expected to type the section number to make this manual page visible.
If you want to get back the previous behavior, set MAN_POSIXLY_CORRECT=1 in a shell initialization file such as ~/.bashrc.
This release of SUSE Linux Enterprise Desktop ships with Novell AppArmor. The AppArmor intrusion prevention framework builds a firewall around your applications by limiting the access to files, directories, and POSIX capabilities to the minimum required for normal operation. AppArmor protection can be enabled via the AppArmor control panel, located in YaST under Novell AppArmor. For detailed information about using Novell AppArmor, see the documentation in /usr/share/doc/packages/apparmor-docs.
The AppArmor profiles included with SUSE Linux have been developed with our best efforts to reproduce how most users use their software. The profiles provided work unmodified for many users, but some users find our profiles too restrictive for their environments.
If you discover that some of your applications do not function as you expected, you may need to use the AppArmor Update Profile Wizard in YaST (or use the aa-logprof(8) command line utility) to update your AppArmor profiles. Place all your profiles into learning mode with the following: aa-complain /etc/apparmor.d/*
When a program generates a high number of complaints, the system's performance is degraded. To mitigate this, we recommend periodically running the Update Profile Wizard (or aa-logprof(8)) to update your profiles, even if you choose to leave them in learning mode. This reduces the number of learning events logged to disk, which improves the performance of the system.
SuSEfirewall2 is enabled by default. That means that by default you cannot log in from remote systems. It also interferes with network browsing and multicast applications, such as SLP and Samba ("Network Neighborhood"). You can fine-tune the firewall settings using YaST.
Technology Preview features are either not supported or supported in a limited fashion. These features are mainly included for customer convenience and be functionally incomplete, unstable or in other ways not suitable for production use.
The eCryptfs kernel modules and the ecryptfs-utils package shipped with SUSE Linux Enterprise Desktop 11 are a preview of a stacked cryptographic filesystem for Linux.
SUSE Linux Enterprise Desktop 11 contains KVM as an additional virtualization solution. It is not supported by Novell, but is an area of interest for future development and deliveries.
SUSE Linux Enterprise Desktop 11 contains a XEN host kernel and XEN tools support as a technical preview.
SUSE Linux Enterprise Desktop 11 contains the file system ext4, the successor of ext3, as a technical preview.
See the 'New features' section.
Puppet has been added as a technical preview to SUSE Linux Enterprise Desktop 11.
It is possible to run SUSE Linux Enterprise Desktop 11 on a read-only root filesystem. Due to the huge number of possible configurations, this is currently not a supported scenario.
The /tmp and /var directories need to be on a separate partition and cannot be mounted read-only.
After the installation has finished and all services are configured, login as root and do the following modifications:
Modify /etc/fstab and add "ro" to the mount options of the root filesystem entry.
rm /etc/mtab ln -s /proc/mounts /etc/mtab mkdir /var/lib/hwclock mv /etc/adjtime /var/lib/hwclock ln -s /var/lib/hwclock/adjtime /etc/adjtime # the following two steps are only necessary if you use dhcp: mv /etc/resolv.conf /var/lib/misc/ ln -s /var/lib/misc/resolv.conf /etc/resolv.conf # Now mount root filesystem read-only and reboot mount -o remount,ro / reboot
Our kernel is compiled with support for Linux Filesystem Capabilities. It is disabled by default. Enable it by adding file_caps=1 as a kernel boot option.
The following list of current functionalities has been removed with this SUSE Linux Enterprise Desktop release.
dante
powertweak
zmd
The following packages are deprecated and will be removed with SUSE Linux Enterprise Desktop 12:
lprng
sendmail
qt3
The JFS file system is no longer supported for new installations. The kernel file system driver is still available, but YaST does not offer partitioning with JFS.
For future strategy and development in regard to volume and storage management on SUSE Linux Enterprise System, see http://www.novell.com/linux/volumemanagement/strategy.html.
This section contains a number of technical changes and enhancements for the experienced user.
For better sound functionality we strongly recommend that pulseaudio 0.9.14 or higher is installed. This version is available via maintenance channels for SUSE Linux Enterprise systems registered with Novell.
The modify_resolvconf script is removed in favor of the more versatile netconfig script. This new script handles specific network settings from multiple sources more flexibly and transparently. For more information, see the updated manuals and the netconfig man-page.
In the shipped manuals, modify_resolvconf is erroneously referenced. We will correct this soon.
Instead of the madwifi driver the ath5k/ath9k in-kernel replacement is now available. ath5k/ath9k does not support access point mode yet, but normal networks (infrastructure and ad-hoc) are well supported by the new driver.
The Wireshark software, a packet sniffer and network analysis tool, is not available on the installation media.
Next time, we will add it to the online update channel for installation.
Lenovo ThinkPad laptops have special code in the MBR (master boot record) because of the "Blue ThinkVantage button" functionality. If proper detection and preparation fails, it might be necessary to restore the boot sector.
If you have a ThinkPad, ensure that the bootloader is not installed into the MBR (verify it in the installation proposal!) and the MBR is not rewritten by generic code (in installation proposel select Bootloader -> Boot Loader Installation -> Boot Loader Options -> Write Generic Boot Code to MBR -- should be unchecked).
If your MBR gets rewritten, the ThinkVantage button will not work anymore. The back-up of the MBR is stored in /var/lib/YaST2/backup_boot_sectors/.
Locale Settings in ~/.i18n
If you are not satisfied with locale system defaults, change the settings in ~/.i18n. Entries in ~/.i18n override system defaults from /etc/sysconfig/language. Use the same variable names but without the RC_ namespace prefixes. For example, use LANG instead of RC_LANG. For information about locales in general, see "Language and Country-Specific Settings" in the Reference Manual.
Configuration of kdump
The kernel is crashing or otherwise not behaving normally and a kernel core dump needs to be captured for analysis.
A description on how to setup kdump can be found under the following URL: http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3374462&sliceId=SAL_Public
Realtime Applications
When running real-time applications on larger systems, lower maximum latencies can be achieved by employing the new disable_buffer_lru kernel command-line option. This disables the per-CPU LRU in the buffer cache, and may thus decrease overall filesystem performance.
JPackage Standard for Java Packages
Java packages are changed to follow the JPackage Standard (http://www.jpackage.org/). Read the documentation in /usr/share/doc/packages/jpackage-utils/ for information.
Loading unsupported kernel drivers
Every kernel module has a 'supported' flag. If this flag is not set, then loading this module will taint the kernel. Kernels which are tainted are not supported. To avoid this, unsupported Kernel modules are part of an extra RPM (kernel-<flavor>-extra). Since this would a problem for most desktops, the loading of those drivers is allowed by default.
To prevent the loading of unsupported kernel drivers automatically during boot, change the line allow_unsupported_modules 1 in /etc/modprobe.d/unsupported-modules to allow_unsupported_modules 0.
Nonexecutable Stack
Already introduced for SUSE Linux Enterprise Desktop 9 on the x86-64 (AMD64) architecture with 64-bit kernels, the Linux kernel in SUSE Linux Enterprise Desktop also supports nonexecutable stack (NX) on x86 for CPUs that support it (Intel Prescott and AMD64) with 32-bit kernels. For this to work, the kernel with PAE support, kernel-pae, must be installed. Go into YaST and install that kernel instead of your default kernel. For 64-bit kernels, all kernels support NX.
The nonexecutable stack improves the security of your system. Many security vulnerabilities are stack overflows, where an attacker overwrites the stack of your program by feeding oversized data to the application that fails to properly check the length. Depending on the details of the program (with a nonexecutable stack), these vulnerabilities may either not be exploitable (and only crash the program, resulting in a Denial of Service) or at least be significantly harder to exploit.
Some applications do require executable stacks. The compiler detects this during compilation and marks the binaries accordingly. The kernel enables an executable stack to allow them to work.
To provide a higher level of security on x86-64, the user can pass noexec=on on the kernel command line. The kernel then uses a nonexecutable stack unconditionally and also marks the data section of a program as nonexecutable. This provides a higher protection level than just the nonexecutable stack, but potentially causes problems for some applications. Novell has not found any problems during testing the most commonly used applications and services. Because it is not the default, this has not been tested as extensively as the stack protection alone, so Novell only recommends this setup for servers after the administrator has verified that all needed services continue to function properly.
Read the READMEs on the CDs.
Get the detailed changelog information about a particular package from the RPM:
rpm --changelog -qp <FILENAME>.rpm
<FILENAME>. is the name of the RPM.
Check the ChangeLog file in the top level of CD1 for a chronological log of all changes made to the updated packages.
Find more information in the docu directory of CD1 of the SUSE Linux Enterprise Desktop 11 CDs. This directory includes PDF versions of the SUSE Linux Enterprise Desktop 11 startup and preparation guides.
http://www.novell.com/documentation/sled11/ contains additional or updated documentation for SUSE Linux Enterprise Desktop 11.
Visit http://www.novell.com/linux/ for the latest Linux product news from SUSE/Novell and http://www.novell.com/linux/source/ for additional information on the source code of SUSE Linux Enterprise products.
For the latest version of SUSE Linux Enterprise Desktop 11 Release Notes, see http://www.novell.com/linux/releasenotes/i586/SUSE-SLED/11/.
If you were using a static IP with NetworkManager, you will lose this configuration while updating from SLED 10 SP2 to SLED 11. You must re-enter this information. The traditional networking method with ifup is not affected by this issue.
Name server lookup information of resolv.conf configured with the traditional networking method with ifup is missing after updating.
There are two plugins available: the latest version of the Java plugin (libnpjp2.so), and the legacy version (libjavaplugin_oji.so). Both are installed in the system if you install Java, but the new version is active. Some plugins using Java have problems with this version. If you are affected by this it is recommended to change the link of /etc/alternatives/javaplugin to point to the legacy plugin. This may cause other problems.
Novell is aware of the problem and is working on a solution.
Note, libjavaplugin_oji.so does not exist in the x86_64 version of the java package.
For SUSE Linux Enterprise Desktop 11 documentation, see http://www.novell.com/documentation/sled11/, where you can download PDF documents. For installation with YaST software management or with zypper, packages are available on the installation media. Some of these packages are installed by default. These are the package names:
sled-installquick_en-pdf: SLED 11 Installation Quick Start
sled-gnomequick_en-pdf: SLED 11 GNOME Quick Start
sled-kdequick_en-pdf: SLED 11 KDE Quick Start
sled-gnomeuser_en-pdf: SLED 11 GNOME User Guide
sled-kdeuser_en-pdf: SLED 11 KDE User Guide
sled-apps_en-pdf: SLED 11 Application Guide
sled-admin_en-pdf: SLED 11 Administration Guide
sled-deployment_en-pdf: SLED 11 Deployment Guide
sled-security_en-pdf: SLED 11 Security Guide
sle-apparmor-quick_en-pdf : AppArmor 2.3.1 Quick Start
sle-audit-quick_en-pdf: Linux Audit Quick Start
The following documents are to be released shortly. At the moment these packages are, for the most part, empty:
sled-tuning_en-pdf: SLED 11 Tuning Guide
sled-xen_en-pdf: SLED 11 Virtualization Guide
sled-manuals_en: the set of all SLED books in HTML format
The names of the boot prompt parameters given in the manual are obsolete and will be discontinued in SUSE Linux Enterprise 11. Instead of smturl use regurl and instead of smtcert use regcert.
By default, Firefox does not honor settings made with the GConf system. In order to make the GConf lockdown keys effective, edit /usr/lib/firefox/local-configuration.js and set config.use_system_prefs to true. This file allows the administrator to set and lock preferences that will apply to every Firefox user.
There is only limited graphics support on IBM SurePOS 700 4800-7X3 systems with 4820-2GN monitors. During a graphical installation you can encounter an error message from the monitor (OSD = On Screen Display) such as:
OUT OF RANGE H: -48.4 KHz V: -60.1 Hz.
To work around this issue try a different resolution, VESA or text-mode for installation. Another option is to choose the native driver by specifying acceleratedx=1 on the boot prompt. It might also help to update the BIOS.
After system installation the problem no longer occurs and the graphics system is fully supported.
On the FIC GE2 platform (when using 24 BPP color depth and resolutions >= 1280x1024 on the DVI interface) stripes are displayed on the X server. This distorts all windows.
Changing to 16 BPP color depth seems to solve this problem.
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time, without the obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classifications to export, re-export, or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical/biological weaponry end uses. Please refer to http://www.novell.com/info/exports/ for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export approvals.
Copyright ® 2009 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.novell.com/company/legal/patents and one or more additional patents or pending patent applications in the U.S. and other countries.
For Novell trademarks, see Novell Trademark ad Service Mark list (http://www.novell.com/company/legal/trademarks/tmlist.html). All third-party trademarks are the property of their respective owners.