+++ This bug was initially created as a clone of Bug #1824152 +++ Description of problem: The openscap scanner runs out of memory when scanning systems with big number of packages (for example 'Server with GUI' group). This is always reproducible on systems with minimal HW requirements for RHEL-7 [1] and with 'Server with GUI' group of packages installed. The issue is dependent on a content which is processed by the scanner. Mainly rules which utilize rpm, textfilecontent54 or file probes are causing this issue as some of these rules are processing all rpms/files on a filesystem (for example rules "rpm_verify_*", "file_permissions_*", "dir_perms_*", "no_files_unowned_by_user", etc.). Note: This is probably due to memory management in openscap scanner. All the collected results are stored in memory until scan finishes. Version-Release number of selected component (if applicable): openscap-1.2.17-9.el7 openscap-scanner-1.2.17-9.el7 How reproducible: always Steps to Reproduce: 1. Setup a VM with 1 CPU core and 1.5 GB RAM (network install [1]). 2. Install package group 'Server with GUI'. 3. Tailor a profile which uses many rules like rpm_verify_*", "file_permissions_*", "dir_perms_*", "no_files_unowned_by_user", etc. and use it to scan the system. Alternatively use e8 profile from scap-security-guide as it selects many such rules. 4. Scanner is killed during the scan as it consumes all free memory on the system (OOM kill). Actual results: Scanner is killed because system runs out of memory. Expected results: Scanner finishes the scan successfully without allocating all the system memory resources. Additional info: [1] https://access.redhat.com/articles/rhel-limits#minimum-required-memory-3
Resolving this issue requires a large-scale rework of the OpenSCAP codebase, which is out of scope for the RHEL7 as it its now in Maintenanace Phase 2. It is not an urgent issue, ase the problem isn't likely to occur on typical scanned systems, which typically are servers without the GUI and a minimal package set.