Skip to content

Add the with-parent-controls for #1662. #1717

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aj-stein-nist merged 6 commits into from
Mar 30, 2023
Merged

Add the with-parent-controls for #1662. #1717

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
55527ef
with-parent-controls for import only for usnistgov/OSCAL#1662
aj-stein-nist Mar 28, 2023
3bb55b2
Clarify spec for usnistgov/OSCAL#1662.
aj-stein-nist Mar 28, 2023
28ffd3a
Merge branch 'develop' into 1662-oscal_complete_schemaxsd-v104-lacks-…
aj-stein-nist Mar 28, 2023
9b8b4db
Apply suggestions from code review
aj-stein-nist Mar 30, 2023
478c012
Update src/specifications/profile-resolution/profile-resolution-specm…
aj-stein-nist Mar 30, 2023
b9d3780
Apply suggestions from code review
aj-stein-nist Mar 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 39 additions & 15 deletions src/metaschema/oscal_profile_metaschema.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,13 +81,24 @@
<p>Identifies that all controls are to be included from the imported catalog or profile.</p>
</remarks>
</assembly>
<assembly ref="select-control-by-id" min-occurs="1" max-occurs="unbounded">
<use-name>include-controls</use-name>
<group-as name="include-controls" in-json="ARRAY"/>
<define-assembly name="include-controls">
<formal-name>Select Control</formal-name>
<description>Select a control or controls from an imported control set.</description>
<flag ref="with-child-controls"/>
<flag ref="with-parent-controls"/>
<model>
<field ref="with-id" max-occurs="unbounded">
<group-as name="with-ids" in-json="ARRAY"/>
</field>
<assembly ref="matching" max-occurs="unbounded">
<group-as name="matching" in-json="ARRAY"/>
</assembly>
</model>
<remarks>
<p>Identifies a subset of controls to import from the referenced catalog or profile by control identifier or match pattern.</p>
<p>If <code>with-child-controls</code> is <q>yes</q> on the call to a control, no sibling <code>call</code>elements need to be used to call any controls appearing within it. This flag provides a way to include controls with all their dependent controls (enhancements) without having to call them individually.</p>
<p>If <code>with-parent-controls</code> is <q>yes</q> on the call to a control, no sibling <code>call</code>elements need to be used to include any parent controls. This flag provides a way to include controls with all their ancestor controls (enhancements) without having to call them individually.</p>
</remarks>
</assembly>
</define-assembly>
</choice>
<assembly ref="select-control-by-id" max-occurs="unbounded">
<use-name>exclude-controls</use-name>
Expand Down Expand Up @@ -444,18 +455,12 @@
<description>Select a control or controls from an imported control set.</description>
<flag ref="with-child-controls"/>
<model>
<define-field name="with-id" as-type="token" max-occurs="unbounded">
<formal-name>Match Controls by Identifier</formal-name>
<description>Selecting a control by its ID given as a literal.</description>
<field ref="with-id" max-occurs="unbounded">
<group-as name="with-ids" in-json="ARRAY"/>
</define-field>
<define-assembly name="matching" max-occurs="unbounded">
<formal-name>Match Controls by Pattern</formal-name>
<description>Selecting a set of controls by matching their IDs with a
wildcard pattern.</description>
</field>
<assembly ref="matching" max-occurs="unbounded">
<group-as name="matching" in-json="ARRAY"/>
<flag ref="pattern"/>
</define-assembly>
</assembly>
</model>
<remarks>
<p>If <code>with-child-controls</code> is <q>yes</q> on the call to a control, no sibling <code>call</code>elements need to be used to call any controls appearing within it. Since generally, this is how control enhancements are represented (as controls within controls), this provides a way to include controls with all their dependent controls (enhancements) without having to call them individually.</p>
Expand All @@ -471,8 +476,27 @@
</allowed-values>
</constraint>
</define-flag>
<define-flag as-type="token" name="with-parent-controls">
<formal-name>Include Parent Controls with Control</formal-name>
<description>When a control is included, whether its parent (ancestor) controls are also included.</description>
<constraint>
<allowed-values>
<enum value="yes">Include parent controls with an included control.</enum>
<enum value="no">When importing a control, only include parent controls that are also explicitly called.</enum>
</allowed-values>
</constraint>
</define-flag>
<define-flag as-type="string" name="pattern">
<formal-name>Pattern</formal-name>
<description>A <a href="https://en.wikipedia.org/wiki/Glob_(programming)">glob expression</a> matching the IDs of one or more controls to be selected.</description>
</define-flag>
<define-field name="with-id" as-type="token">
<formal-name>Match Controls by Identifier</formal-name>
<description>Selecting a control by its ID given as a literal.</description>
</define-field>
<define-assembly name="matching">
<formal-name>Match Controls by Pattern</formal-name>
<description>Selecting a set of controls by matching their IDs with a wildcard pattern.</description>
<flag ref="pattern"/>
</define-assembly>
</METASCHEMA>
8 changes: 2 additions & 6 deletions src/specifications/profile-resolution/profile-resolution-specml.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -532,7 +532,7 @@ include-controls:
</p>
<section id="include-child-controls">
<head>with-child-controls</head>
<p>Child controls are, for the most part, treated the same as top level controls: they can be explicitly included using the selection directives above. As a shortcut to manually including all of the desired descendant controls of a given control, OSCAL provides the <code>with-child-controls</code> option. <code>with-child-controls</code> appears as a child object under a given inclusion directive, and defines additional behavior that is to be executed alongside the parent inclusion.</p>
<p>Child controls can be explicitly included using the selection directives above or include all of the descendant controls of a given control, with the <code>with-child-controls</code> flag. <code>with-child-controls</code> appears as a child object under a given inclusion directive and defines the behaviors listed below.</p>
<p><req level="must" id="req-with-child-controls-yes">A
<src>with-child-controls: yes</src> directive on an
<src>include-controls</src> indicates that
Expand All @@ -549,11 +549,7 @@ include-controls:
</section>
<section id="include-parent-controls">
<head>with-parent-controls</head>
<p>Although similar to the above
<src>with-child-controls</src>, the optional
<src>with-parent-controls</src> applies to parents of the included control, and has the opposite default behavior. In order to maintain the structure of the source catalog, profile resolution includes all parents of an included control by default. If a profile author wants to change this structure, they should use an exclude directive that lists all of the undesired parents. As a shortcut for this,
<src>with-parent-controls</src> provides the following functionality:
</p>
<p>The the optional <src>with-parent-controls</src> flag applies to parents of the included control. If a profile author wants to change this structure, they should use an exclude directive that lists all of the undesired parents. <src>with-parent-controls</src> appears as a child object under a given inclusion directive and defines the behaviors listed below.</p>
<p><req level="must" id="req-with-parent-controls-yes">A
<src>with-parent-controls: yes</src> directive on an
<src>include-controls</src> indicates that
Expand Down