<def-group>
  <definition class="compliance"
  id="mount_option_smb_client_signing" version="1">
    <metadata>
      <title>Require Client SMB Packet Signing, if using
      mount.cifs</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 6</platform>
      </affected>
      <description>Require packet signing of clients who mount
      Samba shares using the mount.cifs program (e.g., those who
      specify shares in /etc/fstab). To do so, ensure that signing
      options (either sec=krb5i or sec=ntlmv2i) are
      used.</description>
    </metadata>
    <criteria operator="OR">
      <criteria operator="AND">
        <criteria operator="OR">
          <criterion comment="check for no cifs in /etc/fstab"
          test_ref="test_20340111" />
          <criterion comment="check for sec=krb5i or sec=ntlmv2i in /etc/fstab"
          test_ref="test_20340112" />
        </criteria>
        <criteria operator="OR">
          <criterion comment="check for no cifs in /etc/mtab"
          test_ref="test_20340113" />
          <criterion comment="check for sec=krb5i or sec=ntlmv2i in /etc/mtab"
          test_ref="test_20340114" />
        </criteria>
      </criteria>
    </criteria>
  </definition>
  <ind:textfilecontent54_test check="all"
  check_existence="none_exist"
  comment="check for no cifs in /etc/fstab"
  id="test_20340111" version="1">
    <ind:object object_ref="obj_20340111" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_20340111"
  version="1">
    <ind:filepath>/etc/fstab</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+[\S]+[\s]+cifs[\s]+([\S]+)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_test check="all"
  check_existence="at_least_one_exists"
  comment="check for sec=krb5i or sec=ntlmv2i in /etc/fstab"
  id="test_20340112" version="1">
    <ind:object object_ref="obj_20340111" />
    <ind:state state_ref="state_20340112" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_state id="state_20340112"
  version="1">
    <ind:instance datatype="int">2</ind:instance>
    <ind:subexpression operation="pattern match">sec=(krb5i|ntlmv2i)</ind:subexpression>
  </ind:textfilecontent54_state>
  <ind:textfilecontent54_test check="all"
  check_existence="none_exist"
  comment="check for no cifs in /etc/mtab"
  id="test_20340113" version="1">
    <ind:object object_ref="obj_20340112" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_20340112"
  version="1">
    <ind:filepath>/etc/mtab</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+[\S]+[\s]+cifs[\s]+([\S]+)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_test check="all"
  check_existence="at_least_one_exists"
  comment="check for sec=krb5i or sec=ntlmv2i in /etc/mtab"
  id="test_20340114" version="1">
    <ind:object object_ref="obj_20340112" />
    <ind:state state_ref="state_20340112" />
  </ind:textfilecontent54_test>
</def-group>
