rhel-fedora

RHEL-Fedora: Fedora and RHEL-Family Administration

Administer Fedora, RHEL, Rocky Linux, AlmaLinux, Oracle Linux, Amazon Linux, and nearby RPM-family systems without flattening their important differences.

Start by separating the fast-moving Fedora lane from the conservative enterprise lane, then account for vendor quirks such as subscription-manager, CentOS Stream drift, Oracle UEK, Amazon's cloud-first defaults, and SELinux or firewalld behavior that people love to blame on the wrong layer.

Versions worth pinning (verified October 2026):

Only pin versions here when they materially affect compatibility or troubleshooting shape. For ordinary package work, prefer the live distro lane and repo state over a stale package table.

Component	Version	Why it matters
Fedora stable	44 / verify live	current mainstream baseline (Fedora ships ~every 6 months and EOLs ~13 months, faster than this table is bumped - confirm live)
Fedora next branch	45 / verify live	useful when a bug is really Fedora-next behavior
RHEL enterprise lane	10.x	current enterprise baseline in the new major lane
RHEL previous major	9.x	still widely deployed and behaviorally different from 10
Rocky Linux	verify live major lane	close to RHEL, but current docs and vault state still matter
AlmaLinux	verify live major lane	close to RHEL, but current release notes and policy docs still matter
Oracle Linux	verify live major lane	current Oracle lane matters, but UEK vs RHCK matters more
Amazon Linux	AL2023 / verify live release	release-note lane matters more than memorizing one point version
SELinux	verify live	policy package and mode matter more than memorized version strings
DNF	verify live	Fedora moves faster than enterprise lanes; DNF 5 vs legacy expectations matter
Podman	verify live	rootless and quadlet behavior depend on the shipped distro lane
Kernel security	verify live via RHSA/FEDORA tracker	patch high-severity privesc CVEs promptly; mid-2026 examples to confirm fixed: Copy Fail CVE-2026-31431 (CISA KEV, exploited), Dirty Frag CVE-2026-43284/43500, Fragnesia CVE-2026-46300 (ESP-in-TCP, public PoC, not in CISA KEV), ptrace CVE-2026-46333; newer: CVE-2026-53266 (netfilter ebtables SNAT, CISA KEV 2026-09-18, Red Hat Important, no RHEL errata listed at the 2026-10-02 check)

For kernel advisories, use the exact vendor package and support stream. Red Hat rates Copy Fail CVE-2026-31431 Important; use the linked bulletin and RHSA package matrix for affected and fixed builds. Do not transfer Ubuntu kernel patch floors to RHEL, Fedora, or a downstream clone.

When to use

• Package management with dnf, yum, rpm, local .rpm files, repo configuration, or package provenance
• Fedora repo, COPR, updates-testing, modularity, and release-upgrade work
• RHEL subscription, entitlement, CodeReady Builder, Insights, EPEL, and clone compatibility questions
• systemd service, timer, boot, and journal troubleshooting on Fedora or RHEL-family systems
• GRUB, EFI, dracut, initramfs, kernel, grubby, and boot recovery work
• Release maintenance: Fedora dnf system-upgrade, RHEL-family major or minor transitions, leapp planning
• Security plumbing: SELinux modes, contexts, booleans, AVC denials, firewalld, FIPS-adjacent checks, package signing
• Container-host work that is really host-admin work: Podman packages, rootless prerequisites, cgroup or SELinux host integration
• Desktop stack on Fedora Workstation or similar: Wayland vs X11, GNOME, KDE, portals, PipeWire, Bluetooth
• Session startup and laptop work: GDM, SDDM, suspend or resume, power profiles, hybrid graphics
• GPU and gaming work: NVIDIA akmods or DKMS, Mesa, Vulkan, Steam, Proton, Gamescope, MangoHud
• Capture and communication: OBS, WebRTC screen sharing, Discord or Teams, portals, virtual cameras
• Storage: XFS, ext4, Btrfs, LUKS, LVM, Stratis, TRIM, hibernation
• Firmware and hardware enablement: fwupdmgr, vendor firmware tools, microcode, mokutil, Secure Boot
• Cloud-image and VM defaults on Amazon Linux, RHEL cloud images, Rocky, Alma, and Oracle Linux guests
• Base Linux ops on RPM-family systems: journalctl, dmesg, lsblk, grubby, rpm -Va, restorecon

When NOT to use

• Shell syntax, quoting, or script portability - use shell-scripting
• Network architecture, DNS, VPNs, reverse proxies, or firewall design - use networking
• Dockerfiles, Compose files, image builds, or container runtime architecture - use docker
• Kubernetes cluster or manifest work - use kubernetes
• Fleet-wide Linux configuration via playbooks - use ansible
• Security review, vulnerability triage, or offensive testing - use security-audit or privilege-escalation
• Arch, CachyOS, or other pacman-family systems - use arch-linux
• Debian, Ubuntu, Mint, Pop!_OS, or other apt-family systems - use debian-ubuntu
• Fedora Silverblue, Kinoite, Bazzite, Bluefin, Universal Blue, CoreOS, bootc, or other rpm-ostree / image-mode workflows - outside this skill; do not treat them like ordinary dnf-managed hosts
• OPNsense or pfSense appliance work - use opnsense-pfsense
• NixOS declarative system configuration - use nixos
• Kali Linux and offensive-tool distros - use kali-linux

---

AI Self-Check

Before returning Fedora or RHEL-family commands, verify:

• Distro lane identified: Fedora, CentOS Stream, RHEL, Rocky, AlmaLinux, Oracle Linux, Amazon Linux, or another derivative. Advice diverges fast.
• Release lane identified: Fedora stable vs Rawhide/Branched, RHEL 8 vs 9 vs 10, AL2023 vs old Amazon Linux 2, Oracle Linux with RHCK vs UEK, and the lane's current lifecycle status.
• Package path identified: dnf, legacy yum, plain rpm, or microdnf. If the host is rpm-ostree or image-mode, stop and route away instead of treating it like a normal DNF-managed host.
• Repo provenance understood: base repos, EPEL, CRB/PowerTools/CodeReady Builder, COPR, vendor repos, and third-party release RPMs are not interchangeable.
• Fedora speed respected: Fedora guidance that is fine on the current stable release can be stale or wrong on Rawhide and too new for enterprise clones.
• Enterprise conservatism respected: do not blindly transplant Fedora COPR, raw upstream kernels, or random GitHub RPM repos onto production RHEL-family hosts.
• SELinux considered early: if the symptom smells like permission, bind mount, custom service, rootless container, or web app weirdness, check AVCs before disabling SELinux.
• SELinux fix is correct: distinguish labeling (restorecon, semanage fcontext) from booleans (setsebool) and custom policy (audit2allow). Do not cargo-cult setenforce 0, and never disable SELinux enforcement or firewalld permanently as a shortcut.
• firewalld scope is correct: runtime vs permanent rules, active zone, interface binding, and rich rules are understood before changing exposure.
• Boot stack identified: GRUB, EFI mountpoint, kernel package, dracut, Secure Boot state, and grubby path are known before changing boot files.
• Fallback path exists: do not remove the only known-good kernel or boot entry, especially on a remote, encrypted, or cloud system.
• Vendor kernel path identified: Oracle UEK vs RHCK, Amazon kernel choices, and NVIDIA akmods/DKMS expectations matter.
• Subscription state known: on RHEL, entitlement and repo enablement may be the real problem, not package naming.
• Module streams handled consciously: if AppStream or module streams are involved, verify the active stream before suggesting installs, resets, or downgrades.
• Desktop stack is coherent: compositor, portal backend, PipeWire, session type, and user services line up.
• Gaming stack includes 32-bit userspace when needed: Steam and Proton failures often come from missing multilib graphics pieces, not the game itself.
• Capture stack is coherent: portal backend, PipeWire, WebRTC or Electron path, and any virtual camera module line up with the current session type.
• Cloud-image assumptions are checked: Amazon Linux, cloud-init images, and minimal RHEL images omit tools you might expect on a full install.
• Upgrade path is real: Fedora dnf system-upgrade, RHEL leapp, and clone major-version jumps have different support stories. Do not improvise an in-place major upgrade path.
• Diagnostic errors are not silenced: do not hide useful failure output with 2>/dev/null on commands whose errors matter. Use 2>&1 || true when gathering.
• Version table treated as a hint, not gospel: if the pinned table is getting old, verify distro release and key package versions live before leaning on it.
• Cross-cutting agent hygiene applied - see references/agent-hygiene.md

---

Workflow

The steps are ordered. Copy this checklist and track progress:

• Step 1: Distro lane identified
• Step 2: Current state gathered
• Step 3: Matching reference loaded
• Step 4: One layer changed; consequential changes confirmed first
• Step 5: Validated (on failure, fix and return to Step 4)

Step 1: Identify the distro lane first

Detect immutable and image-based systems (rpm-ostree, bootc, CoreOS, Silverblue/Kinoite, and vendor image variants) before selecting a package workflow. Do not use a mutable-host dnf repair sequence on an image lane; route to the image's supported layering, override, or rebuild path.

Distro	Default stance	What changes
Fedora stable	Fast-moving workstation or server baseline	DNF 5 era, COPR exists, frequent rebases, shorter support window
Fedora Rawhide / Branched	Slow down	Pre-release behavior, docs and package names can move under you
CentOS Stream	Treat as ahead-of-RHEL, not equal-to-RHEL	Preview-ish enterprise lane; package timing and bugs can differ
RHEL	Conservative enterprise baseline	Subscription-manager, repo entitlements, supported upgrade paths
Rocky Linux	Conservative clone baseline	No subscription-manager, vault behavior, fast follow after upstream
AlmaLinux	Conservative clone baseline with its own policies	Mostly RHEL-shaped, but do not pretend it is literally identical
Oracle Linux	Check kernel lane immediately	UEK vs RHCK changes driver, storage, and support assumptions
Amazon Linux 2023	Cloud-first, vendor-shaped lane	Fedora-derived userland with AWS defaults, no blind RHEL-copying
Other RPM-based	Confirm repo and support model	Do not assume Fedora or RHEL rules without evidence

Step 2: Gather current system state

Run only commands that match the lane detected in Step 1. The following broad inventory is for mutable RPM hosts; on an image-based lane, skip dnf, yum, module, package-transaction, and mutable-boot commands and gather the equivalent rpm-ostree or bootc deployment state instead.

cat /etc/os-release
uname -r
rpm -E '%{?rhel} %{?fedora}'
rpm -q systemd rpm dnf grub2-common dracut selinux-policy-targeted 2>&1 || true
dnf --version 2>&1 || yum --version 2>&1 || true
rpm -qa | grep -E '^(kernel|kernel-core|kernel-uek|dnf|yum|podman|firewalld|selinux-policy)' | head -20
rpm -qf /etc/redhat-release 2>&1 || true
dnf repolist --enabled 2>&1 || yum repolist enabled 2>&1 || true
dnf module list --enabled 2>&1 || true
subscription-manager status 2>&1 || true
subscription-manager repos --list-enabled 2>&1 || true
systemctl --failed 2>&1 || true
journalctl -b -p warning..alert 2>&1 || true
getenforce 2>&1 || true
sestatus 2>&1 || true
ausearch -m avc -ts boot 2>&1 || true
firewall-cmd --get-active-zones 2>&1 || true
firewall-cmd --list-all 2>&1 || true
findmnt /boot
findmnt /boot/efi
grubby --default-kernel 2>&1 || true
grubby --info=ALL 2>&1 || true
lsblk -f
echo "Session=$XDG_SESSION_TYPE Desktop=$XDG_CURRENT_DESKTOP"
loginctl list-sessions 2>&1 || true
systemctl status display-manager 2>&1 || true
systemctl --user --failed 2>&1 || true
systemctl --user status pipewire pipewire-pulse wireplumber 2>&1 || true
systemctl --user status xdg-desktop-portal 2>&1 || true
command -v wpctl >/dev/null 2>&1 && wpctl status
command -v bluetoothctl >/dev/null 2>&1 && bluetoothctl show
lspci -k | grep -Ei 'vga|3d|display'
journalctl -b | grep -Ei 'nvrm|nvidia|amdgpu|i915|xe|drm' 2>&1 || true
journalctl --user -b | grep -Ei 'portal|pipewire|webrtc|obs' 2>&1 || true
lsmod | grep '^v4l2loopback' 2>&1 || true
rpm -qa 'akmod-*' 'kmod-*' 2>&1 | sort || true
command -v dkms >/dev/null 2>&1 && dkms status 2>&1 || true
findmnt -t btrfs,xfs,ext4
systemctl status fstrim.timer 2>&1 || true
fwupdmgr get-devices 2>&1 || true

On a mutable DNF host, check update availability separately and preserve its tri-state result:

dnf check-update
# Exit 0 means no updates, 100 means updates are available, and every other nonzero exit is a
# diagnostic failure to report. Do not append `|| true`.

Step 3: Load only the relevant reference

Task type	Reference
dnf, yum, rpm, repo config, EPEL, COPR, modules, local RPMs	references/packages-and-repos.md
systemd units, timers, journal, overrides	references/systemd-and-journal.md
GRUB, kernel, dracut, EFI, grubby, recovery	references/boot-kernel-and-recovery.md
Fedora vs RHEL vs Rocky vs Alma vs Oracle vs Amazon behavior	references/derivatives-and-vendor-quirks.md
Wayland, X11, GNOME, KDE, PipeWire, Bluetooth	references/desktop-audio-and-bluetooth.md
Display managers, session startup, suspend or resume, power, hybrid graphics	references/session-display-and-mobile.md
GPU drivers, Vulkan, Steam, Proton, gaming	references/graphics-and-gaming.md
OBS, WebRTC, screen sharing, virtual cameras	references/capture-and-sharing.md
XFS, ext4, Btrfs, LUKS, LVM, Stratis, TRIM, hibernation	references/storage-and-rollback.md
SELinux, firewalld, package signing, updates, compliance-adjacent checks	references/security-and-updates.md
Remote gaming, controllers, input	references/remote-gaming-input-and-tooling.md
Core Linux inspection commands and RPM-family tools	references/base-linux-and-cli.md
Recurring Fedora and RHEL-family failure patterns	references/gotchas-and-special-situations.md

Do not load every reference by default. Pick the one that matches the failure mode, then widen only if the first layer is clean.

For firewall triage, inspect firewalld service state, active zones, interface/source bindings, and effective rules before suggesting a change. Use references/security-and-updates.md for the read-only commands and runtime/permanent verification.

Step 4: Change one layer at a time

• Fix repo and package state before debugging services that may be broken by wrong package sets.
• Fix SELinux labeling or policy before declaring the app broken.
• Fix firewalld exposure before blaming service startup.
• Fix mountpoints and loader state before rebuilding dracut or changing kernels.
• On Fedora, separate "upstream fast-moving distro behavior" from "third-party repo or COPR behavior."
• On RHEL, separate "package unavailable" from "repo entitlement disabled."
• On Oracle Linux, confirm UEK vs RHCK before chasing driver and storage symptoms.
• On Amazon Linux, separate cloud-image defaults and AWS repo choices from generic RHEL folklore.
• Prefer reversible steps: keep old kernels, save .repo files, snapshot if available, preserve SELinux context fixes in policy rather than one-off chcon hacks.
• Snapshot or back up before release upgrades, bootloader work, storage changes, or major SELinux relabels.

Consequential changes (release upgrades, kernel removal, dracut or bootloader rebuilds, module stream resets, SELinux policy or port mappings, firewalld exposure, LUKS or LVM changes): show the exact command and what it will do (DNF transaction, removal list, zone and port, or target device), get explicit confirmation, run it, then go to Step 5. In unattended runs, stop at the plan. Exact commands live in references/packages-and-repos.md (transactions, modules, release upgrades), references/boot-kernel-and-recovery.md (kernels, dracut, rescue chroot), and references/security-and-updates.md (SELinux and firewalld changes).

Step 5: Validate before closing

rpm -q package_name
rpm -V package_name
systemctl status unit_name
journalctl -u unit_name -b
getenforce
sestatus
firewall-cmd --list-all
grubby --default-kernel

If a check fails, fix the layer it points to and return to Step 4. Reboot only when the boot path is understood and at least one known-good entry remains.

---

Troubleshooting Pattern

Keep triage cross-layer and boring:

1. Confirm active distro, release lane, package manager, kernel lane, and repo state.
2. Identify the failing layer: repo/package state, SELinux, firewall, system service, user service, boot path, desktop session, graphics, or app.
3. Pull the right logs before changing config.
4. Change one layer at a time and retest.
5. Prefer known-good baseline over tweak stacking.

Core log sweep:

journalctl -b -p warning..alert
journalctl --user -b
dmesg --level=err,warn
journalctl -u unit_name -b
ausearch -m avc -ts recent

Broad pattern sweeps when you need correlation, not first-pass precision:

journalctl -b | grep -Ei 'nvrm|nvidia|amdgpu|i915|xe|drm' 2>&1 || true
journalctl --user -b | grep -Ei 'portal|pipewire|webrtc|obs' 2>&1 || true
ausearch -m avc -ts boot 2>&1 || true

When a bug looks desktop-only, compare one clean baseline:

• GNOME vs KDE
• browser WebRTC vs packaged client
• plain game launch vs Gamescope or MangoHud
• RHCK vs UEK on Oracle Linux when kernel behavior is suspect
• stock repo package vs third-party repo package

---

Default Decisions

• Fedora means fast change. Verify the exact release and avoid stale blog-fix cargo cults.
• RHEL means support boundaries matter. Check entitlements, supported repos, and documented upgrade paths before inventing one.
• Clones are close, not identical in process. Rocky, AlmaLinux, Oracle Linux, and Amazon Linux can share RPM names while differing in policy, repos, kernels, and support tooling. Do not mix clone or vendor repositories without explicit priority and compatibility decisions.
• Narrow before broad. Use dnf repoquery, dnf history, and targeted transactions before broad package churn; for service issues, inspect the journal, SELinux AVCs, and firewalld zones before reinstalling packages. Keep metadata and cache refreshes intentional; repeated full refreshes slow automation.
• Use systemd-native tools first. Reach for systemctl, journalctl, loginctl, and timedatectl before wrappers.
• Treat SELinux as signal, not as the enemy. AVC denials usually tell you exactly which layer is wrong.
• Treat firewalld as stateful plumbing. Zone, runtime, permanent state, and service definitions all matter.
• GRUB, kernel, and dracut are one subsystem. Kernel package, initramfs, Secure Boot state, and bootloader entries have to agree.
• Desktop failures are often session failures. On Wayland, user units, portals, and session env matter as much as the package list.
• Gaming failures are often stack mismatches. Wrong driver branch, missing 32-bit userspace, absent firmware, or a broken Proton path is more common than the game being the real problem.
• Cloud images are intentionally skinny. Missing packages and disabled services are often by design, not corruption.

---

Quick Triage Checklist

Symptom	First checks
Package weirdness after install	dnf repolist, dnf check, rpm -q, module stream mismatch, third-party repo drift
Package unavailable on RHEL	entitlement or CRB missing? subscription-manager repos --list-enabled, repo enablement, EPEL assumptions
SELinux broke my app	getenforce, ausearch -m avc -ts recent, labeling vs boolean vs policy module
Service fails after update	repo drift, dropped config, systemctl status, journalctl -b, rpm -V package
Won't boot after kernel work	EFI mount, grubby --info=ALL, dracut image, Secure Boot, fallback kernel
Fedora upgrade weirdness	exact Fedora release, dnf system-upgrade state, third-party repos, COPR packages
RHEL clone behaves oddly	clone-specific release docs, vault state, EPEL assumptions, unsupported in-place upgrade folklore
Oracle Linux issue	RHCK vs UEK first, then driver/storage/virtualization path
Amazon Linux mismatch	AL2023 vs AL2, cloud-init defaults, AWS package docs, missing extra repos
Desktop weirdness after update	XDG_SESSION_TYPE, portal, Xwayland, user services
Bluetooth audio issues	BlueZ pairing, PipeWire nodes, card profile
Game blackscreen/crash	GPU driver, Vulkan, multilib graphics libs, Gamescope/MangoHud
Screen share broken	Wayland vs X11, portal backend, PipeWire user units
Suspend/resume breaks desktop	sleep state, GPU logs, lock-screen, display manager
NVIDIA/module vanished after kernel change	akmods or DKMS drift, Secure Boot signing, current kernel vs installed module
Nothing makes sense	check gotchas reference - repo drift, SELinux labeling, module stream confusion, stale third-party repos, and kernel lane mismatch explain a lot

---

Reference Files

• references/packages-and-repos.md - DNF, YUM, RPM, local packages, repo files, EPEL, COPR, modules, and package provenance
• references/systemd-and-journal.md - systemd service debugging, unit overrides, user units, journal triage, and safe edit flow
• references/boot-kernel-and-recovery.md - GRUB, dracut, kernel packages, grubby, EFI, Secure Boot, and recovery workflow
• references/derivatives-and-vendor-quirks.md - Fedora, CentOS Stream, RHEL, Rocky, AlmaLinux, Oracle Linux, and Amazon Linux differences that actually matter
• references/desktop-audio-and-bluetooth.md - X11 vs Wayland, GNOME and KDE notes, portals, PipeWire, and Bluetooth troubleshooting
• references/session-display-and-mobile.md - GDM, SDDM, session env, suspend or resume, power profiles, and hybrid graphics routing
• references/graphics-and-gaming.md - NVIDIA, AMD, Intel, Vulkan, Steam, Proton, Gamescope, MangoHud, and akmods or DKMS notes
• references/capture-and-sharing.md - OBS, WebRTC screen sharing, Discord or Teams routing, hardware encoding, and virtual camera troubleshooting
• references/storage-and-rollback.md - XFS, ext4, Btrfs, LUKS, LVM, Stratis, TRIM, hibernation, and rollback boundaries
• references/security-and-updates.md - SELinux, firewalld, package signing, updates, FIPS-adjacent concerns, and compliance-sensitive defaults
• references/remote-gaming-input-and-tooling.md - Moonlight, Sunshine, controllers, and Steam Remote Play
• references/base-linux-and-cli.md - core Linux inspection commands and RPM-family tools such as rpm -Va, repoquery, and restorecon
• references/gotchas-and-special-situations.md - recurring Fedora and RHEL-family failure patterns, special cases, and what-to-do-next guidance

---

Output Contract

See references/output-contract.md for the full contract.

• Skill name: RHEL-FEDORA
• Deliverable bucket: audits
• Mode: conditional. When invoked to analyze, review, audit, or improve existing repo content, apply the reporting size and evidence rules in references/output-contract.md and write the deliverable to docs/local/audits/rhel-fedora/<YYYY-MM-DD>-<slug>.md. When invoked to answer a question, teach a concept, build a new artifact, or generate content, respond freely without the contract.
• Severity scale: P0 | P1 | P2 | P3 | info (see shared contract; only used in audit/review mode).

Related Skills

• shell-scripting - shell syntax, zsh or bash behavior, script portability
• networking - network services, DNS, VPNs, firewall design beyond host-level firewalld
• docker - container runtime and image concerns instead of host distro administration
• kubernetes - cluster and manifest work that sits above host OS administration
• ansible - codifying Linux changes across many machines
• security-audit - hardening and security review rather than normal package and service administration
• arch-linux - Arch Linux and CachyOS administration (same operating-system-admin pattern, different package and release model)
• debian-ubuntu - Debian and Ubuntu administration (same operating-system-admin pattern, different package and distro family)
• update-docs - after substantial system administration changes that introduce new operational gotchas

---

Rules

1. Confirm consequential changes before running them. Show the exact command and its plan, wait for an explicit yes, then verify. Unattended runs stop at the plan.
2. Do not improvise major upgrades. Fedora major jumps, RHEL leapp, and clone major-version moves require a documented path or a rebuild plan.
3. Be conservative with third-party repos. COPR on Fedora, EPEL on enterprise clones, vendor RPM repos, and release packages all change the support boundary.