AWS linux medium security documentation change
Summary
Added documentation about deprecation of Sun RPC in glibc and ping6 utility, mirroring AL2 changes
Security assessment
Same security context as AL2 documentation - highlights removal of Sun RPC implementation in glibc (security hardening measure) and provides migration guidance. The ping6 change reflects IPv6 modernization rather than direct security fixes.
Diff
diff --git a/linux/al2023/ug/deprecated-al2.md b/linux/al2023/ug/deprecated-al2.md index 55f32b152..a637341d7 100644 --- a//linux/al2023/ug/deprecated-al2.md +++ b//linux/al2023/ug/deprecated-al2.md @@ -5 +5 @@ -32-bit x86 (i686) Packagesaws-apitools-* replaced by AWS CLIamazon-cloudwatch-agent replaces awslogsbzr revision control systemcgroup v1log4j hotpatch (log4j-cve-2021-44228-hotpatch)lsb_release and the system-lsb-core packagemcryptOpenJDK 7 (java-1.7.0-openjdk)Python 2.7rsyslog-openssl replaces rsyslog-gnutlsNetwork Information Service (NIS) / ypMultiple domain names in Amazon VPC create-dhcp-optionsOpenSSH key fingerprint in audit logld.gold Linker +32-bit x86 (i686) Packagesaws-apitools-* replaced by AWS CLIamazon-cloudwatch-agent replaces awslogsbzr revision control systemcgroup v1log4j hotpatch (log4j-cve-2021-44228-hotpatch)lsb_release and the system-lsb-core packagemcryptOpenJDK 7 (java-1.7.0-openjdk)Python 2.7rsyslog-openssl replaces rsyslog-gnutlsNetwork Information Service (NIS) / ypMultiple domain names in Amazon VPC create-dhcp-optionsSun RPC in glibcOpenSSH key fingerprint in audit logld.gold Linkerping6 @@ -38,0 +39,2 @@ This section describes functionality that is available in AL2, and no longer ava + * Sun RPC in glibc + @@ -42,0 +45,2 @@ This section describes functionality that is available in AL2, and no longer ava + * ping6 + @@ -152,0 +157,6 @@ In order to support multiple domain names, a DHCP server should use DHCP Option +## Sun RPC in `glibc` + +The implementation of Sun RPC in `glibc` is deprecated in AL2 and removed in AL2023. Customers are advised to move to using the `libtirpc` library (available in AL2 and AL2023) if Sun RPC functionality is required. Adopting `libtirpc` also enables applications to support IPv6. + +This change reflects the broader community's adoption of upstream `glibc` removing this functionality, for example the [Removal of Sun RPC interfaces from `glibc` in Fedora](https://fedoraproject.org/wiki/Changes/SunRPCRemoval) and a [similar change in Gentoo](https://wiki.gentoo.org/wiki/Project:Toolchain/Glibc_2.26_porting_notes/RPC_implementation). + @@ -162,0 +173,6 @@ The upstream [GNU Binutils](https://www.gnu.org/software/binutils/) [release not +## ping6 + +In AL2023, the regular `ping` utility natively supports IPv6, and the separate `/bin/ping6` is no longer required. In AL2023, `/usr/sbin/ping6` is a symlink to the `/usr/bin/ping` executable. + +This change follows the broader community's adoption of newer `iputils` versions which provide this functionality, for example the [Ping IPv6 change in Fedora](https://fedoraproject.org/wiki/Changes/PingIpv6). +