> From: Brent Kimberley <Brent.Kimberley(a)Durham.ca>
> As opposed to writing one XCCDF, why not write one XCCDF per
> point of interest (inside the container of interest, inside the
> OS but outside the container of interest, ...) - until upstream
> standards address Origin, Point (in SpaceTime), Frame of Reference,
> ... for a cyber-physical assembly?
When I start working on our container environment, I expect I
need to write custom XCCDF and custom OVAL for some of the checks.
Some of the management may be done in the container, but I expect
most to be done in the underlying host. So paths may be different,
which would lead to either more complex OVAL with parameterization,
or duplication of the OVAL content.
And as implied elsewhere, the XCCDF needs to be modified to
indicate the correct information for the environment.