Hardened Package Enforcement (rlc-h)
rlc-h is a meta package that enforces installation of the security-hardened builds shipped with RLC Pro Hardened. It is what keeps a system on the hardened glibc and openssh instead of the stock Rocky Linux builds.
rlc-h handles the hardened builds only; it is not a FIPS package. FIPS cryptography is delivered by a separate metapackage (rlc-fips or rlc-fips-certified). A hardened FIPS system installs both. See Switching FIPS Modes for the FIPS metapackage.
What rlc-h enforces
Installing rlc-h pulls in the hardened repository configuration and forces DNF onto the hardened builds of glibc and openssh:
| Package | How it is required | Notes |
|---|---|---|
rlc-h-gpg-keys | direct | GPG keys for the hardened repo |
rlc-h-release | direct | Hardened repo release configuration |
rlc-h-repos | direct | Hardened repo .repo files |
glibc | virtual provide ciq-hardened-glibc | Memory-safety and exploit mitigations |
openssh | virtual provide ciq-hardened-openssh | SSH server/client hardening |
You can see the exact set on a running system with rpm -q --requires rlc-h.
The hardened builds of glibc and openssh carry a virtual provide (ciq-hardened-glibc, ciq-hardened-openssh) that stock Rocky Linux packages do not. The meta requires these provides, forcing DNF to select the hardened builds regardless of version (EVR) comparison.
RLC Pro Hardened also ships other hardening components (the Linux Kernel Runtime Guard LKRG, the hardened memory allocator, passwdqc, and the control tool). Those are part of the image; they are not pulled in by the rlc-h meta, whose job is specifically to enforce the hardened glibc and openssh.
Why the meta is required
Without rlc-h, DNF installs the stock Rocky glibc and openssh, because those may carry a higher EVR than the hardened builds. The meta's dependency on the ciq-hardened-* virtual provides is the only thing that forces DNF to prefer the hardened builds.
Confirm rlc-h is present with rpm -q rlc-h. RLC Pro Hardened images are intended to include it so the system stays on the hardened builds; if it is missing, install it (see below). Do not remove it unless you intend to stop using hardened packages: without it, a dnf upgrade can silently replace the hardened glibc and openssh with stock Rocky builds.
Procedures
Install rlc-h
If rlc-h is not already present, install it from the hardened repository:
sudo dnf install rlc-h
This installs the hardened repo configuration and moves glibc and openssh to the hardened (ciq-hardened-*) builds.
Verify a system is using hardened packages
# The meta is installed
rpm -q rlc-h
# glibc and openssh carry the hardened virtual provides
rpm -q --whatprovides ciq-hardened-glibc
rpm -q --whatprovides ciq-hardened-openssh
If rpm -q --whatprovides ciq-hardened-glibc returns no package provides ciq-hardened-glibc, the system is running stock glibc.
Update hardened packages
sudo dnf upgrade
While rlc-h is installed, DNF only upgrades glibc and openssh to newer hardened builds; it will not move to a stock Rocky build even if a newer stock version exists.
Remove hardened enforcement
sudo dnf remove rlc-h
sudo dnf distro-sync
On the next upgrade (or immediately with distro-sync), stock Rocky glibc and openssh replace the hardened builds.
Troubleshooting
Hardened virtual provide not satisfied after install
If, after installing rlc-h, rpm -q --whatprovides ciq-hardened-glibc returns no package provides ciq-hardened-glibc, the installed glibc is the stock build, typically because the hardened repo was not reachable during install.
Confirm the hardened repo is enabled, then force the upgrade from it (substitute the repo name for your version):
dnf repolist enabled | grep hardened
sudo dnf upgrade glibc --repo rlc-9.6-hardened.x86_64 # RLC Pro Hardened 9.6
sudo dnf upgrade glibc --repo rlc-h-9-x86_64 # RLC Pro Hardened 9.7
Hardened packages replaced by stock packages after dnf upgrade
If the system reverts to stock glibc after an upgrade, the meta was removed or was never installed. Reinstall and re-sync:
rpm -q rlc-h # confirm whether the meta is present
sudo dnf install rlc-h
sudo dnf distro-sync
Contact CIQ Support if the hardened packages still do not take effect while rlc-h is installed.