Open Vulnerability and Assessment Language

There seems to be some types/groups with missing MinOccurs and MaxOccurs information.  It appears that this is because such information was not put into the schema file as the schema file uses defaults in this case.

Date Added: 2008-08-04 23:45:35
fixed the stylesheet to use the defualt value of 1 if a minOccurs or MaxOccurs attribute is not present.

>In the file you mentioned I see a generic mapping of data types to
>supported operations. I don't see the special cases, though. For
>example, in the 5.3 schema, the xpath object entity (which is a string)
>in the xmlfilecontent_object explicitly restricts the operation to
>"equals". I don't see any such restriction in 5.4. Am I just overlooking
>it?

Unfortunately, no you are not overlooking it.  I had forgot that a special restriction had been made for the <xpath> entity.  Now thinking about, I think there might be 1 or 2 similar entities that had special restrictions.  This is an argument against these special restrictions.  Of course on the flip side, allowing an operation of 'not equals' for the <xpath> entity does not make sense.

Would a best of both worlds solution be that we make a general mapping between datatype and operation in the declaration of the EntityBaseType as done in version 5.4, but then make addition restrictions on entities like <xpath> that need them like we did in version 5.3.  This would allows us to keep the benefit of reducing all the duplicative schematron statements (as well as centralize the mapping) that was the reason for the change between versions.

This change would be made in version 5.5.  For now, I would have a tool throw an unknown result if it ever came across an <xpath> with an operation other than 'equals' since it is unknown how to deal with this.

Date Added: 2008-05-16 20:56:21
If we do this, we may also need to make restrictions for things like var_check.  We need to go through the logic and see if further restrictions need to be made.  Check out the thread on the developer list from May 2008 entitled "questions on the var_check attribute on entity objects"

Date Added: 2008-08-04 21:07:05
added schematron to the specific individual entities to restrict the operation attribute to the desired value

Clarification is needed regarding how to treat version strings like 5.2-3.4.  Currently the schemas says that "The version datatype represents a value that is a hierarchical list of non-negative integers separated by a single character delimiter".  It doesn't give any guidance about when more than one type of non-number character is used.

Date Added: 2008-07-08 17:54:23
The solution to this is to add a sentence to the schema documentation that says to treat any non-number character as a delimeter.  This means that 5.2-3.4 would be the same as 5.2.3.4 as well as 5f2f3m4

Date Added: 2008-07-30 17:42:01
added the following documentation:

Note that any non-number character can be used as a delimiter and that different characters can be used within the same version string.  So '#.#-#' is the same as '#.#.#' or '#c#c#'.

When a .* pattern match is given for a trustee_sid, should the object set include all possible sids found in the domain?  Or just those associated with the file/key/etc?

Date Added: 2008-07-30 16:41:26
Added the following documentation to the trustee_sid entity:

"If a pattern match operation is used attempts to identify all the trustees (for exampl a .* pattern) then the search should be limited to just the trustees on the DACL/SACL of the object in question."

We need to document what value the first instance of a content match would be.

Date Added: 2008-07-30 16:58:16
added the following:

The first match is given an instance value of 1, the second match is given and instance value of 2, and so on.

We need to expand the documentation related to how to report cases when a value can not be cast to the specified datatype.  For example if the datatype is integer and the value is NULL.

Date Added: 2008-07-31 23:56:41
added the following documentation to the EntityBaseType:

If a cast can not be made, (trying to cast 'abc' to an integer) then an error should be thrown. For example, if the datatype is set to 'integer' and the value of the entity is empty.  There is no way to cast the empty string (or NULL) to an integer, and in cases like this an error should be reported.

HP has proposed the line test for the catos schema that tests the results of the SHOW command.  This is similar to the ios and pix schema line tests.

Date Added: 2008-08-06 21:20:14
test has been added

A function is needed that uses a regex to capture a substring in a given input.  McAfee has submitted a proposal for such a function.

Date Added: 2008-08-08 23:40:55
added the McAfee function

A proposal has been made to modify the CatOS version test.

Date Added: 2008-08-27 23:16:38
modification has been made

This email encompasses the feedback from the developers at Secure Elements:

The results of my schema syntax review of OVAL 5.5 RC1 are as follows:

found 9 schematron errors in the windows definitions schema.
found 2 schematron errors in the solaris definitions schema
found 1 XML schema error in the pixos definitions schema.
found 1 schematron error in the catos definitions schema.

found 9 schematron errors in the windows syschar schema
found 1 XML schema error in the pixos syschar schema
found 4 XML schema errors in the aix syschar schema

These findings are detailed below.


Details:

IN windows-definitions-schema.xsd

at line 5826
update <sch:rule context="win-def:regkeyeffectiverights_test/win-def:state">
to     <sch:rule context="win-def:regkeyeffectiverights53_test/win-def:state">

at line 6729/6730
update <sch:assert test="not(@datatype) or @datatype='bool'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_read_permission entity of a sharedresource_state should be 'bool'</sch:assert>
to     <sch:assert test="not(@datatype) or @datatype='boolean'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_read_permission entity of a sharedresource_state should be 'boolean'</sch:assert>

at line 6742/6743
update <sch:assert test="not(@datatype) or @datatype='bool'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_write_permission entity of a sharedresource_state should be 'bool'</sch:assert>
to     <sch:assert test="not(@datatype) or @datatype='boolean'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_write_permission entity of a sharedresource_state should be 'boolean'</sch:assert>


at line 6755/6756
update <sch:assert test="not(@datatype) or @datatype='bool'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_create_permission entity of a sharedresource_state should be 'bool'</sch:assert>
to     <sch:assert test="not(@datatype) or @datatype='boolean'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_create_permission entity of a sharedresource_state should be 'boolean'</sch:assert>

at line 6768/6769
update <sch:assert test="not(@datatype) or @datatype='bool'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_exec_permission entity of a sharedresource_state should be 'bool'</sch:assert>
update <sch:assert test="not(@datatype) or @datatype='boolean'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_exec_permission entity of a sharedresource_state should be 'boolean'</sch:assert>
 
at line 6781/6782
update <sch:assert test="not(@datatype) or @datatype='bool'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_delete_permission entity of a sharedresource_state should be 'bool'</sch:assert>
to     <sch:assert test="not(@datatype) or @datatype='boolean'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_delete_permission entity of a sharedresource_state should be 'boolean'</sch:assert>

at line 6794/6795
update <sch:assert test="not(@datatype) or @datatype='bool'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_atrib_permission entity of a sharedresource_state should be 'bool'</sch:assert>
to     <sch:assert test="not(@datatype) or @datatype='boolean'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_atrib_permission entity of a sharedresource_state should be 'boolean'</sch:assert>

at line 6807/6808
update <sch:assert test="not(@datatype) or @datatype='bool'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_perm_permission entity of a sharedresource_state should be 'bool'</sch:assert>
to     <sch:assert test="not(@datatype) or @datatype='boolean'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_perm_permission entity of a sharedresource_state should be 'boolean'</sch:assert>

at line 6820/6821
update <sch:assert test="not(@datatype) or @datatype='bool'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_all_permission entity of a sharedresource_state should be 'bool'</sch:assert>
update <sch:assert test="not(@datatype) or @datatype='boolean'">
          <sch:value-of select="../@id"/> - datatype attribute for the access_all_permission entity of a sharedresource_state should be 'boolean'</sch:assert>



IN SCHEMA solaris-definitions-schema.xsd
at line 27
update <sch:assert test="@object_ref=/oval-def:oval_definitions/oval-def:objects/sol-def:smf_object/@id">
to     <sch:assert test="@object_ref=/oval-def:oval_definitions/oval-def:objects/sol-def:isainfo_object/@id">

at line 31
update <sch:assert test="@state_ref=/oval-def:oval_definitions/oval-def:states/sol-def:smf_state/@id">
to     <sch:assert test="@state_ref=/oval-def:oval_definitions/oval-def:states/sol-def:isainfo_state/@id">

IN SCHEMA pixos-definitions-schema.xsd
at line 3
update <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:pixos-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#pixos" xmlns:sch="http://purl.oclc.org/dsdl/schematron" targetNamespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#pix" elementFormDefault="qualified" version="5.5">
to     <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:pixos-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#pixos" xmlns:sch="http://purl.oclc.org/dsdl/schematron" targetNamespace="http://oval.mitre.org/XMLSchema/oval-definitions-5#pixos" elementFormDefault="qualified" version="5.5">

IN SCHEMA catos-definitions-schema.xsd
at line 127
update <sch:assert test="@state_ref=/oval-def:oval_definitions/oval-def:states/catos-def:module_number/@id"><sch:value-of select="../@id"/> - the state child element of a module_test must reference a module_state</sch:assert>
to     <sch:assert test="@state_ref=/oval-def:oval_definitions/oval-def:states/catos-def:module_state/@id"><sch:value-of select="../@id"/> - the state child element of a module_test must reference a module_state</sch:assert>


IN SCHEMA windows-system-characteristics.xsd
at line 14
insert <sch:ns prefix="xsi" uri="http://www.w3.org/2001/XMLSchema-instance"/>

at line 3746
update <sch:assert test="not(@datatype) or @datatype='bool'">item <sch:value-of select="../@id"/> - datatype attribute for the access_read_permission entity of a sharedresource_item should be 'bool'</sch:assert>
to     <sch:assert test="not(@datatype) or @datatype='boolean'">item <sch:value-of select="../@id"/> - datatype attribute for the access_read_permission entity of a sharedresource_item should be 'boolean'</sch:assert>

at line 3758
update	<sch:assert test="not(@datatype) or @datatype='bool'">item <sch:value-of select="../@id"/> - datatype attribute for the access_write_permission entity of a sharedresource_item should be 'bool'</sch:assert>
to      <sch:assert test="not(@datatype) or @datatype='boolean'">item <sch:value-of select="../@id"/> - datatype attribute for the access_write_permission entity of a sharedresource_item should be 'boolean'</sch:assert>

at line 3770
update  <sch:assert test="not(@datatype) or @datatype='bool'">item <sch:value-of select="../@id"/> - datatype attribute for the access_create_permission entity of a sharedresource_item should be 'bool'</sch:assert>
to      <sch:assert test="not(@datatype) or @datatype='boolean'">item <sch:value-of select="../@id"/> - datatype attribute for the access_create_permission entity of a sharedresource_item should be 'boolean'</sch:assert>

at line 3782
update  <sch:assert test="not(@datatype) or @datatype='bool'">item <sch:value-of select="../@id"/> - datatype attribute for the access_exec_permission entity of a sharedresource_item should be 'bool'</sch:assert>
to      <sch:assert test="not(@datatype) or @datatype='boolean'">item <sch:value-of select="../@id"/> - datatype attribute for the access_exec_permission entity of a sharedresource_item should be 'boolean'</sch:assert>

at line 3794
update  <sch:assert test="not(@datatype) or @datatype='bool'">item <sch:value-of select="../@id"/> - datatype attribute for the access_delete_permission entity of a sharedresource_item should be 'bool'</sch:assert>
to      <sch:assert test="not(@datatype) or @datatype='boolean'">item <sch:value-of select="../@id"/> - datatype attribute for the access_delete_permission entity of a sharedresource_item should be 'boolean'</sch:assert>

at line 3806
update  <sch:assert test="not(@datatype) or @datatype='bool'">item <sch:value-of select="../@id"/> - datatype attribute for the access_atrib_permission entity of a sharedresource_item should be 'bool'</sch:assert>
to      <sch:assert test="not(@datatype) or @datatype='boolean'">item <sch:value-of select="../@id"/> - datatype attribute for the access_atrib_permission entity of a sharedresource_item should be 'boolean'</sch:assert>

at line 3818
update  <sch:assert test="not(@datatype) or @datatype='bool'">item <sch:value-of select="../@id"/> - datatype attribute for the access_perm_permission entity of a sharedresource_item should be 'bool'</sch:assert>
to      <sch:assert test="not(@datatype) or @datatype='boolean'">item <sch:value-of select="../@id"/> - datatype attribute for the access_perm_permission entity of a sharedresource_item should be 'boolean'</sch:assert>

at line 3830
update  <sch:assert test="not(@datatype) or @datatype='bool'">item <sch:value-of select="../@id"/> - datatype attribute for the access_all_permission entity of a sharedresource_item should be 'bool'</sch:assert>
to      <sch:assert test="not(@datatype) or @datatype='boolean'">item <sch:value-of select="../@id"/> - datatype attribute for the access_all_permission entity of a sharedresource_item should be 'boolean'</sch:assert>


IN SCHEMA pixos-system-characteristics.xsd
at line 2
update  <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:oval-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xmlns:pixos-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#pix" xmlns:sch="http://purl.oclc.org/dsdl/schematron" targetNamespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#pixos" elementFormDefault="qualified" version="5.5">
to      <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:oval-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xmlns:pixos-sc="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#pixos" xmlns:sch="http://purl.oclc.org/dsdl/schematron" targetNamespace="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#pixos" elementFormDefault="qualified" version="5.5">

IN SCHEMA aix-system-characteristics.xsd
delete line 178

at line 180
update  <xsd:restriction base="oval-def:EntityItemStringType">
to      <xsd:restriction base="oval-sc:EntityItemStringType">

at line 226
update  <xsd:annotation>>
to      <xsd:annotation>

at line 230
update  <xsd:restriction base="oval-def:EntityItemStringType">
to      <xsd:restriction base="oval-sc:EntityItemStringType">

Date Added: 2008-09-16 20:52:48
fixed

From email on the developer list
Date: Thu 7/24/2008 8:21 PM 
Subject: "Request for 5.5 or 6.0"

==================================================
Please add a comment that

datatype="boolean" means that it is encode per W3C,
http://www.w3.org/TR/xmlschema-2/#boolean
datatype="binary" means that it is encode per W3C,
http://www.w3.org/TR/xmlschema-2/#hexBinary 
datatype="float" means that it is encode per W3C,
http://www.w3.org/TR/xmlschema-2/#float 
datatype="int" means that it is encode per W3C,
http://www.w3.org/TR/xmlschema-2/#int 
datatype="string" means that it is encode per W3C,
http://www.w3.org/TR/xmlschema-2/#string 

Also, add schematron to enforce it.   It will help greatly when someone
is new to XML and coming from C++ or C# and may assume that binary is
0x0F   or any other variation that works in C++.

For us long time Xml folks, the above is completely self-evident... but
that is not always the case
=================================================

Date Added: 2008-08-01 17:42:04
To clarify... this change should be made where the datatypes defined by the DatatypeEnumeration align with the XML Schema spec. 

We should also include better documentation for all the other datatypes (evr_string,ios_version, etc) Readers of the documentation should be able to easily look up the definition of these types. how about links to the source docs? 

Date Added: 2008-08-07 22:51:26
I have updated the documentation associated with each datatype.  I have also added some potential schematron rules to validate that data is in the correct format.  These rules utilize xpath 2.0 and there is some question whether the OVAL community wants this.