|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
Document : xccdfp-1.1.xsd
|
|
Packit |
517ee8 |
Created on : 25 January 2006
|
|
Packit |
517ee8 |
Last Updated on : 17 April 2006
|
|
Packit |
517ee8 |
Author : Neal Ziring
|
|
Packit |
517ee8 |
Description : see annotations below
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
ChangeLog:
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
Changes in 0.1
|
|
Packit |
517ee8 |
- initial version, first cut
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
Changes in 0.2
|
|
Packit |
517ee8 |
- first full version
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
Changes in 0.3
|
|
Packit |
517ee8 |
- revised logical tests
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
Changes in 0.4
|
|
Packit |
517ee8 |
- allowed for pre-defined Fact names
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
Changes in 1.1
|
|
Packit |
517ee8 |
- major simplification, removed lots of expressive
|
|
Packit |
517ee8 |
power (string and numeric facts)
|
|
Packit |
517ee8 |
- lots of typo fixes and stuff due to comments from
|
|
Packit |
517ee8 |
Ian Crawford
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
-->
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
targetNamespace="http://checklists.nist.gov/xccdf-p/1.1"
|
|
Packit |
517ee8 |
elementFormDefault="qualified" attributeFormDefault="unqualified"
|
|
Packit |
517ee8 |
xmlns:cdfp="http://checklists.nist.gov/xccdf-p/1.1"
|
|
Packit |
517ee8 |
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
|
Packit |
517ee8 |
xmlns:xml="http://www.w3.org/XML/1998/namespace">
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation>
|
|
Packit |
517ee8 |
This is an XML Schema for defining information
|
|
Packit |
517ee8 |
structure about IT platforms, mainly for use with
|
|
Packit |
517ee8 |
the eXtensible Common Checklist Description Format
|
|
Packit |
517ee8 |
(XCCDF). This version of the XCCDF Platform
|
|
Packit |
517ee8 |
Specification (XCCDF-P) is designed to be used
|
|
Packit |
517ee8 |
with XCCDF 1.0 or 1.1, and may also be used
|
|
Packit |
517ee8 |
with other XML data formats that need to describe
|
|
Packit |
517ee8 |
aspects of IT product and system platforms.
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
This specification was written by Neal Ziring, based
|
|
Packit |
517ee8 |
on ideas from the DISA FSO VMS/Gold Disk team, from
|
|
Packit |
517ee8 |
David Waltermire and David Proulx, and from Drew
|
|
Packit |
517ee8 |
Buttner.
|
|
Packit |
517ee8 |
<version date="25 January 2006">1.1.0.0</version>
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
schemaLocation="../../common/xml.xsd">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
Import the XML namespace schema so that we can use
|
|
Packit |
517ee8 |
the xml: attribute groups (particularly xml:lang).
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
</xsd:import>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:element name="Platform-Specification">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
This element can act as a top-level container for the
|
|
Packit |
517ee8 |
Fact definitions and Platform definitions that make up
|
|
Packit |
517ee8 |
a full XCCDF-P specification. It should be used
|
|
Packit |
517ee8 |
when a XCCDF-P spec is being distributed as a
|
|
Packit |
517ee8 |
standalone document, or included in an XCCDF 1.1
|
|
Packit |
517ee8 |
specification.
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
This element schema used to include a keyref for
|
|
Packit |
517ee8 |
Fact names, but it has been removed to allow for
|
|
Packit |
517ee8 |
pre-defined Fact dictionaries.
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:complexType>
|
|
Packit |
517ee8 |
<xsd:sequence>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="0" maxOccurs="unbounded"/>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="0" maxOccurs="unbounded"/>
|
|
Packit |
517ee8 |
</xsd:sequence>
|
|
Packit |
517ee8 |
</xsd:complexType>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:key name="factURIKey">
|
|
Packit |
517ee8 |
<xsd:selector xpath="./cdfp:Fact"/>
|
|
Packit |
517ee8 |
<xsd:field xpath="@name"/>
|
|
Packit |
517ee8 |
</xsd:key>
|
|
Packit |
517ee8 |
</xsd:element>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:element name="Fact">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
This element denotes a single named Fact. Every fact
|
|
Packit |
517ee8 |
has the following:
|
|
Packit |
517ee8 |
- name, a URI, which must be a unique key
|
|
Packit |
517ee8 |
- title, arbitrary text with xml:lang, optional
|
|
Packit |
517ee8 |
- remark, arbitrary text with xml:lang, optional
|
|
Packit |
517ee8 |
- check, XML content, optional
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:complexType>
|
|
Packit |
517ee8 |
<xsd:sequence>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="0" maxOccurs="unbounded"/>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="0" maxOccurs="unbounded"/>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="0" maxOccurs="unbounded"/>
|
|
Packit |
517ee8 |
</xsd:sequence>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
use="required"/>
|
|
Packit |
517ee8 |
</xsd:complexType>
|
|
Packit |
517ee8 |
<xsd:unique name="factCheckSystemKey">
|
|
Packit |
517ee8 |
<xsd:selector xpath="./cdfp:check"/>
|
|
Packit |
517ee8 |
<xsd:field xpath="@system"/>
|
|
Packit |
517ee8 |
</xsd:unique>
|
|
Packit |
517ee8 |
</xsd:element>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:element name="Platform">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
This element denotes a single Platform definition.
|
|
Packit |
517ee8 |
A Platform definition represents the qualifications
|
|
Packit |
517ee8 |
an IT asset or target must have to be considered an
|
|
Packit |
517ee8 |
instance of a particular Platform. A Platform has
|
|
Packit |
517ee8 |
the following:
|
|
Packit |
517ee8 |
- id, a locally unique id
|
|
Packit |
517ee8 |
- name, a URI, which must be a unique key
|
|
Packit |
517ee8 |
- title, arbitrary text with xml:lang, optional
|
|
Packit |
517ee8 |
- remark, arbitrary text with xml:lang, optional
|
|
Packit |
517ee8 |
- definition ref, either a fact ref or a logical
|
|
Packit |
517ee8 |
test (boolean combination of fact refs)
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:complexType>
|
|
Packit |
517ee8 |
<xsd:sequence>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="0" maxOccurs="unbounded"/>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="0" maxOccurs="unbounded"/>
|
|
Packit |
517ee8 |
<xsd:choice minOccurs="1" maxOccurs="1">
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="1" maxOccurs="1"/>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="1" maxOccurs="1"/>
|
|
Packit |
517ee8 |
</xsd:choice>
|
|
Packit |
517ee8 |
</xsd:sequence>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
use="optional"/>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
use="required"/>
|
|
Packit |
517ee8 |
</xsd:complexType>
|
|
Packit |
517ee8 |
</xsd:element>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:complexType name="factRefType">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
Type for a reference to Fact; the reference
|
|
Packit |
517ee8 |
is always by name. This is the type for the
|
|
Packit |
517ee8 |
element fact-ref, which can appear in a Platform
|
|
Packit |
517ee8 |
definition or in a logical-test in a Platform
|
|
Packit |
517ee8 |
definition.
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
use="required"/>
|
|
Packit |
517ee8 |
</xsd:complexType>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:complexType name="logicTestType">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
Type for a test against several Facts; the content
|
|
Packit |
517ee8 |
is one or more fact-refs and nested logical-tests.
|
|
Packit |
517ee8 |
Allowed operators are AND and OR.
|
|
Packit |
517ee8 |
The negate attribute, if set, makes the test
|
|
Packit |
517ee8 |
its logical inverse (so you get NAND and NOR).
|
|
Packit |
517ee8 |
Note that the output of a logical-test is always
|
|
Packit |
517ee8 |
TRUE or FALSE, Unknowns map to FALSE.
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:choice minOccurs="1" maxOccurs="unbounded">
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="1" maxOccurs="1"/>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
minOccurs="1" maxOccurs="1"/>
|
|
Packit |
517ee8 |
</xsd:choice>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
type="cdfp:logicOperatorEnumType"/>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
type="xsd:boolean" default="0"/>
|
|
Packit |
517ee8 |
</xsd:complexType>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:complexType name="checkType">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
Data type for the check element, a checking system
|
|
Packit |
517ee8 |
specification URI, and XML content. The check
|
|
Packit |
517ee8 |
element may appear inside a Fact, giving a means
|
|
Packit |
517ee8 |
to ascertain the value of that Fact using a
|
|
Packit |
517ee8 |
particular checking engine. (This checkType is
|
|
Packit |
517ee8 |
based on the one in XCCDF, but is somewhat simpler.
|
|
Packit |
517ee8 |
It does not include the notion of exporting values
|
|
Packit |
517ee8 |
from the scope of an XCCDF document to the checking
|
|
Packit |
517ee8 |
engine.)
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:sequence>
|
|
Packit |
517ee8 |
<xsd:choice minOccurs="1" maxOccurs="1">
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
type="cdfp:checkContentType"/>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
type="cdfp:checkContentRefType"/>
|
|
Packit |
517ee8 |
</xsd:choice>
|
|
Packit |
517ee8 |
</xsd:sequence>
|
|
Packit |
517ee8 |
<xsd:attribute name="system" type="xsd:string" use="required"/>
|
|
Packit |
517ee8 |
</xsd:complexType>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:complexType name="checkContentRefType">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
Data type for the check-content-ref element, which
|
|
Packit |
517ee8 |
points to the code for a detached check in another file.
|
|
Packit |
517ee8 |
This element has no body, just a couple of attributes:
|
|
Packit |
517ee8 |
href and name. The name is optional, if it does not appear
|
|
Packit |
517ee8 |
then this reference is to the entire other document.
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:attribute name="href" type="xsd:anyURI" use="required"/>
|
|
Packit |
517ee8 |
<xsd:attribute name="name" type="xsd:string"/>
|
|
Packit |
517ee8 |
</xsd:complexType>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:complexType name="checkContentType" mixed="true">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
Data type for the check-content element, which holds
|
|
Packit |
517ee8 |
the actual code of an enveloped check in some other
|
|
Packit |
517ee8 |
(non-XCCDF-P) language. This element can hold almost
|
|
Packit |
517ee8 |
anything. The content is not meaningful as XCCDF-P,
|
|
Packit |
517ee8 |
though tools may process it or hand it off to other
|
|
Packit |
517ee8 |
tools.
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:choice minOccurs="0" maxOccurs="unbounded">
|
|
Packit |
517ee8 |
<xsd:any namespace="##other" processContents="skip"/>
|
|
Packit |
517ee8 |
</xsd:choice>
|
|
Packit |
517ee8 |
</xsd:complexType>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:simpleType name="logicOperatorEnumType">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
Allowed operators for logic tests: we only
|
|
Packit |
517ee8 |
have two, AND and OR. They're capitalized
|
|
Packit |
517ee8 |
for consistency with usage in OVAL v4.
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:restriction base="xsd:string">
|
|
Packit |
517ee8 |
<xsd:enumeration value="OR" />
|
|
Packit |
517ee8 |
<xsd:enumeration value="AND" />
|
|
Packit |
517ee8 |
</xsd:restriction>
|
|
Packit |
517ee8 |
</xsd:simpleType>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
<xsd:complexType name="textType">
|
|
Packit |
517ee8 |
<xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:documentation xml:lang="en">
|
|
Packit |
517ee8 |
Type for a string with an xml:lang attribute.
|
|
Packit |
517ee8 |
</xsd:documentation>
|
|
Packit |
517ee8 |
</xsd:annotation>
|
|
Packit |
517ee8 |
<xsd:simpleContent>
|
|
Packit |
517ee8 |
<xsd:extension base="xsd:string">
|
|
Packit |
517ee8 |
<xsd:attribute ref="xml:lang"/>
|
|
Packit |
517ee8 |
</xsd:extension>
|
|
Packit |
517ee8 |
</xsd:simpleContent>
|
|
Packit |
517ee8 |
</xsd:complexType>
|
|
Packit |
517ee8 |
|
|
Packit |
517ee8 |
</xsd:schema>
|