Memory allocation errors on RHEL6

Chuck Atkins chuck.atkins at kitware.com
Tue Oct 6 16:40:46 UTC 2015


I just did a fresh install of RHEL6, with minimal desktop configuration,
applied all updates, and installed scap-security-guide, openscap, and
scap-workbench from the system repos.  First I created a tailoring file
with SCAP Workbench to adjust the STIG server profile for desktop usage
(allow X, remove various server packages, etc.).  The scan worked fine but
when generating the results and report, I get a bunch of memory allocation
errors.  When I  tried to evaluate from the command line instead, using the
tailoring file from scap-workbench, I get:

[root at rhel6-stig-vm ~]# oscap xccdf eval \
  --tailoring-file ssg-rhel6-kw-desktop-xccdf.xml \
  --profile xccdf_kitware.com_profile_stig-rhel6-server-upstream_desktop \
  --report ssg-report.html --results ssg-results.xml \
  --check-engine-results --oval-results \
  /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml

...
all benchmark rules process
...

XPath error : Memory allocation failed : growing nodeset hit limit

growing nodeset hit limit

^
runtime error: file /usr/share/openscap/xsl/xccdf-report-oval-details.xsl
line 39 element key
Failed to evaluate the 'match' expression.

(error repeated 4 times)

The RPMs installed as reported by yum are:

openscap-utils.x86_64      1.2.4-1.el6_6sat
@rhel-6-workstation-satellite-tools-6.1-rpms
scap-security-guide.noarch 0.1.21-3.el6
@rhel-6-workstation-rpms
[root at rhel6-stig-vm ~]#

Interestingly, I don't seem to get these memory errors when I run against
the xccdf directly and not the combined datastream, but then I can't use
the tailoring file I created.  Any ideas on the memory errors?

- Chuck
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20151006/c0ec2a24/attachment.html>


More information about the scap-security-guide mailing list