Discuss var_refs and var_checks in EntityStateRecordType

[vanderpol]

I would like to know the backstory (if anyone recalls) why we would intentionally limit the functionality of state tests with record types? We have created content that runs in SCC, JOVAL and other tools, but one vendor contacted us with:

According to the OVAL 5.11 schema documentation, the use of var_ref in the wmi57_state for the entity type record is not permitted.

In looking at the schema, it appears they are correct, but I'm confused why this would be something OVAL would want to restrict? I've used this feature in both WMI57 and SQL512 tests, and the content is technically schema valid, so didn't realize it was an issue. Plus the fact that it ran without errors in JOVAL and potentially openSCAP without errors, make me want to ask the vendor that doesn't support it, to just add support as we'll be removing this note in OVAL 5.12.1.

Thoughts? Especially looking for feedback from @solind , hoping you might have some history on this?

<xsd:complexType name="EntityStateRecordType">
xsd:annotation
xsd:documentationThe EntityStateRecordType defines an entity that consists of a number of uniquely named fields. This structure is used for representing a record from a database query and other similar structures where multiple related fields must be collected at once. Note that for all entities of this type, the only allowed datatype is 'record' and the only allowed operation is 'equals'. During analysis of a system characteristics item, each field is analyzed and then the overall result for elements of this type is computed by logically anding the results for each field and then applying the entity_check attribute.</xsd:documentation>
xsd:documentationNote the datatype attribute must be set to 'record'.</xsd:documentation>

xsd:documentationNote the operation attribute must be set to 'equals'.</xsd:documentation>
xsd:documentationNote the var_ref attribute is not permitted and the var_check attribute does not apply.</xsd:documentation>
xsd:documentationNote that when the mask attribute is set to 'true', all child field elements must be masked regardless of the child field's mask attribute value.</xsd:documentation>
</xsd:annotation>
xsd:complexContent
<xsd:extension base="oval-def:EntityStateComplexBaseType">
xsd:sequence
<xsd:element name="field" type="oval-def:EntityStateFieldType" minOccurs="0" maxOccurs="unbounded"/>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>

[vanderpol]

FYI, I'm able to convert the collected item from the record into a variable_object, and perform the same test via a variable test, which is a good workaround, just makes the results less understandable as to where the data came from.

[solind]

Hi @vanderpol, you're using an OVAL variable in a record field. That comment in the schema documentation is just saying that you can't reference a variable for the whole record. Make sense?

[vanderpol]

The developers at Trellix/Policy Auditor said that this was invalid per the OVAL spec:

<wmi57_state id="oval:navy.navwar.niwcatlantic.scc.win11.scorecard:ste:90" version="1" comment="Verify Intel CPU Name is listed as supported by Microsoft for Windows 11 24H2: https://learn.microsoft.com/en-us/windows-hardware/design/minimum/supported/windows-11-24h2-supported-intel-processors"
  xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
  <result datatype="record" entity_check="at least one">
	<oval-def:field datatype="string" name="name" operation="pattern match" var_ref="oval:navy.navwar.niwcatlantic.scc.win11.scorecard:var:90" var_check="at least one"/>
  </result>
</wmi57_state>

[vanderpol]

I think we should change the Notes on the EntityStateRecordType and EntityObjectRecordType should be clarified to more clearly explain what they mean.

[solind]

Hey, they can be wrong, they're only human after all.

Both EntityStateRecordType and EntityStateFieldType clearly belong to the EntityAttributeGroup, which includes var_ref and var_check. The documentation for the record type pertains only to the record. If the record type documentation was talking about the field type, it would have (also) been documented in the field type, but it is not.

I wonder, was there no SCAP 1.3 validation content requiring demonstration of the use of variables in record fields?

[vanderpol]

I can do some surfing of the SCAP 1.3 validation content, good idea.