<def-group>
  <definition class="compliance"
  id="mount_option_nodev_nonroot_local_partitions" version="1">
    <metadata>
      <title>Add nodev Option to Non-Root Local Partitions</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 6</platform>
      </affected>
      <description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</description>
      <reference source="MED" ref_id="20130821" ref_url="test_attestation" />
    </metadata>
    <criteria>
      <criterion comment="nodev on local filesystems"
      test_ref="test_nodev_nonroot_local_partitions" negate="true" />
    </criteria>
  </definition>
  <linux:partition_test check="all" check_existence="all_exist"
  id="test_nodev_nonroot_local_partitions" version="1"
  comment="nodev on local filesystems">
    <linux:object object_ref="object_non_root_partitions" />
    <linux:state state_ref="state_local_nodev" />
  </linux:partition_test>
  <linux:partition_object id="object_non_root_partitions" version="1">
    <!-- look at all partitions except root -->
    <linux:mount_point operation="pattern match">^/\w.*$</linux:mount_point>
    <filter action="include">state_local_nodev</filter>
  </linux:partition_object>
  <linux:partition_state id="state_local_nodev" version="1">
    <!-- this check defines a local partition as one which has a device node in /dev -->
    <linux:device operation="pattern match">^/dev/.*$</linux:device>
    <linux:mount_options datatype="string" entity_check="all"
    operation="not equal">nodev</linux:mount_options>
  </linux:partition_state>
</def-group>
