From 902dbd52745dfba1210fd8acb0e89088bdc7d91f Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 4 Nov 2008 20:29:31 +0100 Subject: finished xsl metadata validation --- policy_metadata/xsl_md.xsl | 36 --------------- policy_metadata/xsl_metadata.rng | 97 ++++++++++++++++++++++++++++------------ 2 files changed, 69 insertions(+), 64 deletions(-) delete mode 100644 policy_metadata/xsl_md.xsl (limited to 'policy_metadata') diff --git a/policy_metadata/xsl_md.xsl b/policy_metadata/xsl_md.xsl deleted file mode 100644 index 8178615..0000000 --- a/policy_metadata/xsl_md.xsl +++ /dev/null @@ -1,36 +0,0 @@ - - - - - - - - - - - - - - - diff --git a/policy_metadata/xsl_metadata.rng b/policy_metadata/xsl_metadata.rng index b5445ca..0116d81 100644 --- a/policy_metadata/xsl_metadata.rng +++ b/policy_metadata/xsl_metadata.rng @@ -26,13 +26,22 @@ xmlns:md="http://freeipa.org/xsl/metadata/1.0" xmlns:pa="http://freeipa.org/xml/rng/ns/plugable_architecture/1.0"> + md:output_handler should be the first element after xsl:stylesheet. The + content of the stylesheet can be validated separately. + + + + + + - With the md:output_handler element it is possible to define how the - policy data is processed after the XSLT transformation is applied. The idea - is that a driver program or script can access this metadata information with - a suitable XPath and can handle the output of the transformation - accordingly. + With the md:output_handler element it is possible to define how the + policy data is processed after the XSLT transformation is applied. The idea + is that a driver program or script can access this metadata information with + a suitable XPath and can handle the output of the transformation + accordingly. + @@ -67,22 +76,11 @@ xmlns:pa="http://freeipa.org/xml/rng/ns/plugable_architecture/1.0"> - The following is a dummy element to catch all elements from - different namespaces, e.g. comments and documentation - - - - - - - - - - - + + It is possible to generate more than one type of output for more than one output handler. To switch between different types of output a parameter @@ -100,26 +98,38 @@ xmlns:pa="http://freeipa.org/xml/rng/ns/plugable_architecture/1.0"> - + It is important that a file is created with the right access + permissions to avoid either security or usability troubles. + md:name, the full name of the file, is the only required + attribute. - + + /.* + + The standard unix access control to a file is determined by its + owner, its group and the access permissions. If this attributes are missing + a sensible default should be assumes. For example owner root, group root and + 0400 permissions. You have to define either all three or none of the + attributes. - - - - + The permission must be specified in octal mode. - + + [0-7]{4} + + If the client system supports SELinux you can specify the SELinux + context for the file, otherwise a sensible default will be used + (restorecon). @@ -127,16 +137,47 @@ xmlns:pa="http://freeipa.org/xml/rng/ns/plugable_architecture/1.0"> - + To execute a process we need the full path of the file to execute, + optional some arguments and the user and group context under which the procrss + should run. If md:user and md:group are missing, the least privileges, e.g. + nobody/nogroup should be assumed. - + + /.* + - + + + + + + + + + + The following is a dummy element to catch all elements from + different namespaces, e.g. comments and documentation + + + + + + + + + + + + + + + + -- cgit