AWS linux medium security documentation change
Summary
Added documentation about deprecation of Sun RPC in glibc and ping6 utility, with migration guidance
Security assessment
The Sun RPC deprecation addresses potential security risks by removing outdated RPC implementations (references Fedora/Gentoo security-minded changes). The documentation explicitly advises migration to libtirpc for security and IPv6 support. This constitutes security-related guidance.
Diff
diff --git a/linux/al2/ug/deprecated-al2.md b/linux/al2/ug/deprecated-al2.md index 65fa10505..faa244a9d 100644 --- a//linux/al2/ug/deprecated-al2.md +++ b//linux/al2/ug/deprecated-al2.md @@ -5 +5 @@ -32-bit x86 (i686) Packagesaws-apitools-* replaced by AWS CLIamazon-cloudwatch-agent replaces awslogsbzr revision control systemcgroup v1log4j hotpatch (log4j-cve-2021-44228-hotpatch)lsb_release and the system-lsb-core packagemcryptOpenJDK 7 (java-1.7.0-openjdk)Python 2.7rsyslog-openssl replaces rsyslog-gnutlsNetwork Information Service (NIS) / ypMultiple domain names in Amazon VPC create-dhcp-optionsOpenSSH key fingerprint in audit logld.gold Linker +32-bit x86 (i686) Packagesaws-apitools-* replaced by AWS CLIamazon-cloudwatch-agent replaces awslogsbzr revision control systemcgroup v1log4j hotpatch (log4j-cve-2021-44228-hotpatch)lsb_release and the system-lsb-core packagemcryptOpenJDK 7 (java-1.7.0-openjdk)Python 2.7rsyslog-openssl replaces rsyslog-gnutlsNetwork Information Service (NIS) / ypMultiple domain names in Amazon VPC create-dhcp-optionsSun RPC in glibcOpenSSH key fingerprint in audit logld.gold Linkerping6 @@ -38,0 +39,2 @@ This section describes functionality that is available in AL2, and no longer ava + * Sun RPC in glibc + @@ -42,0 +45,2 @@ This section describes functionality that is available in AL2, and no longer ava + * ping6 + @@ -152,0 +157,6 @@ In order to support multiple domain names, a DHCP server should use DHCP Option +## Sun RPC in `glibc` + +The implementation of Sun RPC in `glibc` is deprecated in AL2 and removed in AL2023. Customers are advised to move to using the `libtirpc` library (available in AL2 and AL2023) if Sun RPC functionality is required. Adopting `libtirpc` also enables applications to support IPv6. + +This change reflects the broader community's adoption of upstream `glibc` removing this functionality, for example the [Removal of Sun RPC interfaces from `glibc` in Fedora](https://fedoraproject.org/wiki/Changes/SunRPCRemoval) and a [similar change in Gentoo](https://wiki.gentoo.org/wiki/Project:Toolchain/Glibc_2.26_porting_notes/RPC_implementation). + @@ -162,0 +173,6 @@ The upstream [GNU Binutils](https://www.gnu.org/software/binutils/) [release not +## ping6 + +In AL2023, the regular `ping` utility natively supports IPv6, and the separate `/bin/ping6` is no longer required. In AL2023, `/usr/sbin/ping6` is a symlink to the `/usr/bin/ping` executable. + +This change follows the broader community's adoption of newer `iputils` versions which provide this functionality, for example the [Ping IPv6 change in Fedora](https://fedoraproject.org/wiki/Changes/PingIpv6). +