<def-group>
  <definition class="compliance" id="mount_option_dev_shm_noexec" version="1">
    <metadata>
      <title>Add noexec Option to /dev/shm</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 6</platform>
      </affected>
      <description>It can be dangerous to allow the execution of binaries from
      world-writable temporary storage directories such as /dev/shm. The noexec
      mount option prevents binaries from being executed out of
      /dev/shm.</description>
      <reference source="MED" ref_id="20130821" ref_url="test_attestation" />
    </metadata>
    <criteria>
      <criterion comment="noexec on /dev/shm" test_ref="test_noexec_dev_shm" />
    </criteria>
  </definition>
  <linux:partition_test check="all" check_existence="all_exist"
  id="test_noexec_dev_shm" version="1" comment="noexec on /dev/shm">
    <linux:object object_ref="object_dev_shm_partition_noexec" />
    <linux:state state_ref="state_dev_shm_noexec" />
  </linux:partition_test>
  <linux:partition_object id="object_dev_shm_partition_noexec" version="1">
    <linux:mount_point>/dev/shm</linux:mount_point>
  </linux:partition_object>
  <linux:partition_state id="state_dev_shm_noexec" version="1">
    <linux:mount_options datatype="string" entity_check="at least one"
    operation="equals">noexec</linux:mount_options>
  </linux:partition_state>
</def-group>
