suse-knowledge-patch

SUSE 16+ Knowledge Patch

Claude's baseline covers SLES 15 SP5, openSUSE Leap 15.5, and Tumbleweed through mid-2024. This skill provides changes from openSUSE Leap 15.6 (June 2024) and the SUSE 16.0 release (SLES Nov 2025, Leap Oct 2025).

Key context: openSUSE Leap 16.0 and SUSE Linux Enterprise 16.0 share the same codebase (source and binary identical). Nearly all 16.0 changes below apply to both distributions.

Rebranding: "SUSE Linux Enterprise Server" is now "SUSE Linux". Minor releases (16.0, 16.1, ...) replace service packs.

Breaking Changes Quick Reference

What Changed	Old (15.x)	New (16.0)
Installer	YaST / AutoYaST	Agama (web UI + CLI + HTTP API)
Security framework	AppArmor	SELinux (enforcing, 400+ modules)
Network stack	wicked	NetworkManager only
Config locations	Mixed /etc	Defaults in /usr; /etc for overrides only
/tmp	Persistent on disk	tmpfs (RAM-backed, cleared on reboot)
SSH root login	Password allowed	Password disabled; key-only
User groups	Shared users group	Per-user primary groups
Cgroups	v1 + v2	v2 only
Hypervisor	Xen + KVM	KVM only
Display server	Xorg + Wayland	Wayland only (XWayland for compat)
Init system	systemd + SysV compat	systemd only (no SysV scripts)
Python	3.6/3.11	3.13
CPU minimum	x86-64	x86-64-v2
DHCP server	ISC DHCP	Kea DHCP
Name service	NIS available	NIS removed; LDAP
sudo behavior	Target user's password	Own password (wheel group)
Zypper repos	Modules + pool/update channels	Single repo per minor release
Remote desktop	VNC	GNOME Remote Desktop (RDP)
GUI toolkits	GTK2, Qt5, wxWidgets	GTK3+/GTK4, Qt6 only
Audio (Leap)	PulseAudio	PipeWire

Agama Installer (Replaces YaST)

YaST and AutoYaST are fully removed. Agama provides:

• Web UI for interactive installs
• CLI (agama) for scripted installs
• HTTP API for automation
• Profiles (JSON/Jsonnet) replace AutoYaST XML for unattended installs

# Unattended install with Agama profile
agama profile import profile.json
agama install

# Profiles are additive — layer multiple profiles
agama profile import base.json
agama profile import site-specific.json
agama install

For remote management, use Cockpit (replaces YaST remote modules). For configuration management, use Salt or Ansible.

See references/installer-and-management.md for details.

SELinux (Replaces AppArmor)

SELinux is enforcing by default with policies for 400+ modules. AppArmor is no longer the default.

# Check status
sestatus
getenforce # returns "Enforcing"

# Temporarily set to permissive (for debugging)
setenforce 0

# View/manage booleans
getsebool -a
setsebool -P httpd_can_network_connect on

# Troubleshoot denials
ausearch -m AVC -ts recent
audit2allow -a # generate policy from denials

openSUSE note: AppArmor cannot be selected during install but can be enabled post-install. AppArmor updated from 3.1 to 4.1 (fine-grained network rules by IP/port in 4.0, priority=<number> rule prefix in 4.1).

See references/security-and-networking.md for details.

NetworkManager Only (wicked Removed)

wicked is removed. NetworkManager is the sole network stack. Interface names use systemd predictable naming.

# Configure network via CLI
nmcli connection show
nmcli connection add type ethernet con-name eth0 ifname enp0s3 ipv4.method manual ipv4.addresses 192.168.1.10/24

# For complex naming, use systemd.link
# /etc/systemd/network/10-custom.link

See references/security-and-networking.md for networking details.

System Defaults Moved to /usr

Default configs now live in /usr; /etc is for admin overrides only.

# Customize systemd settings — create drop-in snippets
mkdir -p /etc/systemd/system/myservice.service.d/
cat >/etc/systemd/system/myservice.service.d/override.conf <<EOF
[Service]
LimitNOFILE=65536
EOF

# Restore a default: remove the /etc override
rm /etc/systemd/system/myservice.service.d/override.conf

See references/system-defaults.md for full details.

SSH Root Password Login Disabled

New installs disable password-based SSH for root. If no SSH key is provided during install, sshd won't be enabled.

# Restore password login (not recommended)
zypper install openssh-server-config-rootlogin

/tmp Is Now tmpfs

/tmp uses tmpfs (RAM-backed), cleared on every reboot. Applications writing persistent temporary data must use /var/cache, /var/tmp, or another persistent location.

sudo: Wheel Group and Auth Changes

The first user created by the installer is added to the wheel group. The sudo-policy-wheel-auth-self package (installed by default) changes sudo behavior:

• Users in wheel group: prompted for their own password (not root's)
• Users NOT in wheel: prompted for root password

This replaces the 15.x behavior where sudo always prompted for the target user's password.

/etc/hostname No Longer Strips FQDN

Previously, if a FQDN was stored in /etc/hostname, the domain part was silently stripped. In 16.0, the name is applied as-is. Storing a FQDN is discouraged (non-RFC-compliant); use DNS or /etc/hosts for FQDN resolution.

No Zypper Modules or Split Repos

The module system (basesystem, server-apps, development, etc.) is gone. No separate pool/update channels. Minor releases (16.1, 16.2) get separate repositories.

Key Version Changes

Component	Version	Notes
Python	3.13	/usr/bin/python3 ��� may bump in minor releases
Kernel compiler	gcc 13	Install gcc13, invoke as gcc-13 for module builds
CPU requirement	x86-64-v2	QEMU needs -cpu host or v2-capable model
Cgroups	v2 only	v1 no longer available

mountfd API in util-linux

mount uses the new kernel mountfd API. For read-only mounts where you need the physical layer read-write:

mount -oro=vfs    # instead of: mount -oro

Per-User Primary Groups

USERGROUPS_ENAB is enabled: each new user gets their own primary group instead of the shared users group. Scripts relying on @users in sudoers or similar need updating.

Major Removals

Removed	Replacement	Notes
YaST / AutoYaST	Agama, Cockpit, Salt/Ansible	Full removal
wicked	NetworkManager	Sole network stack
AppArmor (default)	SELinux (enforcing)	400+ policy modules
Xen hypervisor	KVM	HVM/PVH guests still work
Xorg	Wayland + XWayland	X11 apps via XWayland
SysV init scripts	systemd units	rc<service> shortcuts removed
NIS (ypserv)	LDAP	Full removal
ISC DHCP server	Kea DHCP
32-bit support	--	ia32_emulation kernel param on x86_64
/etc/services	--	Dummy file, being phased out
libnsl.so.1	--	libnsl-stub1 temporary workaround
nscd	--	Removed
crun	runc
dovecot 2.3	2.4	Incompatible config format, manual migration
VNC server	GNOME Remote Desktop (RDP)
GTK2, Qt5, wxWidgets	GTK3+/GTK4, Qt6	Desktop toolkit migration required
sapconf	saptune	SLES only

See references/removals-and-migrations.md for migration guidance.

SLES-Specific Notes

• Kdump: Configure via kdumptool and /etc/sysconfig/kdump. NOT enabled by default in 16.0 (fix planned for 16.1). See references/installer-and-management.md.
• sapconf removed: Use saptune for SAP tuning.
• Rebranding: "SUSE Linux Enterprise Server" is now "SUSE Linux".

openSUSE-Specific Notes

PipeWire Replaces PulseAudio

PipeWire is the default audio stack in Leap 16.0. Upgrades auto-migrate. If issues: ensure not using wireplumber-video-only-profile.

NVIDIA Auto-Setup

On supported GPUs, NVIDIA open driver and graphics repository are installed automatically. User-space drivers also auto-installed for out-of-box graphical acceleration.

libvirt + Docker nftables Conflict

Docker doesn't support nftables, breaking libvirt VM networking. Fix:

# /etc/libvirt/network.conf
firewall_backend = "iptables"

firewall-cmd --add-interface=virbr0 --zone=libvirt --permanent
firewall-cmd --reload
systemctl restart libvirtd

32-bit / Steam on Leap

Steam removed from Non-OSS repo; use Flatpak. For 32-bit: install grub2-compat-ia32 and reboot. SELinux users may need selinux-policy-targeted-gaming.

Migration Tool (15->16)

opensuse-migration-tool (install on 15.6) handles migration to Leap 16, Slowroll, Tumbleweed, or SLES.

openSUSE-Only Removals

• HexChat (upstream archived) -- use Polari or Flatpak
• ansible-9 / ansible-core-2.16
• criu
• nmap deprecated (license change)

Desktop Environments (Leap 16.0)

• Plasma 6.4: Per-desktop tiling layouts, overhauled Spectacle
• GNOME 48: Notification stacking, triple buffering, Digital Wellbeing
• Xfce 4.20: Fractional scaling, improved file manager (experimental Wayland session)

Lifecycle

24-month community support per release. Annual minor releases through Leap 16.6 (fall 2031). Leap 15.6 support extended to April 2026.

openSUSE Leap 15.6 (June 2024)

Pre-16.0 changes specific to openSUSE Leap. See references/leap-15.6-changes.md.

• Bumblebee removed -- use NVIDIA SUSE Prime for hybrid graphics
• Cockpit added -- root login disabled by default; edit /etc/cockpit/disallowed-users
• nouveau disabled for Turing/Ampere GPUs -- install nvidia-open-driver-G06-signed-kmp-default
• 4096-bit RSA signing key -- manual import needed from pre-15.4

Reference Files

File	Contents
installer-and-management.md	Agama installer, profiles, Cockpit, Salt/Ansible, Kdump
security-and-networking.md	SELinux setup, NetworkManager migration, SSH hardening
system-defaults.md	/usr defaults, /tmp tmpfs, cgroup v2, per-user groups, mountfd API, Python 3.13, gcc13
removals-and-migrations.md	Full removal list with migration paths
leap-15.6-changes.md	openSUSE Leap 15.6 details (Bumblebee, Cockpit, NVIDIA, signing key)
leap-16.0-opensuse-specific.md	openSUSE-only 16.0 details (PipeWire, NVIDIA auto-setup, libvirt, migration tool, desktops)