<def-group><!-- The test will check if correct option is present in both active (/proc/mounts) and
       configured (/etc/fstab) mount points. It won't fail if the mount point is not currently
       active, but will consider absence of the mount point configuration as a failure unless
       MOUNT_HAS_TO_EXIST is set to `true` (the name is a bit controversial: it means that
       the mount point has to exist in the configuration file to be checked, and we don't care
       about it if it is not configured). -->

  <definition class="compliance" id="mount_option_dev_shm_noexec" version="2">
    <metadata>
        <title>Add noexec Option to /dev/shm</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>/dev/shm should be mounted with mount option noexec.</description>
    </metadata>
    <criteria operator="AND">
      <criteria operator="OR">
         <criterion comment="noexec on /dev/shm"
           test_ref="test_dev_shm_partition_noexec_expected"/>
         <criterion comment="/dev/shm does not exist"
           test_ref="test_dev_shm_partition_noexec_expected_exist"
           negate="true" />
      </criteria>
      <criteria operator="OR">
         <criterion comment="noexec on /dev/shm in /etc/fstab"
           test_ref="test_dev_shm_partition_noexec_expected_in_fstab"/>
    
      </criteria>
    </criteria>
  </definition>


  <linux:partition_object version="1"
    id="object_dev_shm_partition_noexec_expected">
    <linux:mount_point>/dev/shm</linux:mount_point>
  </linux:partition_object>

  <ind:textfilecontent54_object version="1"
    id="object_dev_shm_partition_noexec_expected_in_fstab">
    <ind:filepath>/etc/fstab</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/dev/shm[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>


  <linux:partition_state version="1"
    id="state_dev_shm_partition_noexec_expected">

    <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>

  </linux:partition_state>

  <ind:textfilecontent54_state version="1"
    id="state_dev_shm_partition_noexec_expected_in_fstab">
    <ind:instance datatype="int">1</ind:instance>

    <ind:subexpression entity_check="at least one" operation="pattern match">noexec</ind:subexpression>

  </ind:textfilecontent54_state>




  <linux:partition_test check="all" check_existence="all_exist" version="2"
    comment="noexec on /dev/shm "
    id="test_dev_shm_partition_noexec_expected">
    <linux:object object_ref="object_dev_shm_partition_noexec_expected"/>
    <linux:state state_ref="state_dev_shm_partition_noexec_expected"/>
  </linux:partition_test>

  <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1"
    comment="noexec on /dev/shm  in /etc/fstab"
    id="test_dev_shm_partition_noexec_expected_in_fstab">
    <ind:object object_ref="object_dev_shm_partition_noexec_expected_in_fstab" />
    <ind:state state_ref="state_dev_shm_partition_noexec_expected_in_fstab" />
  </ind:textfilecontent54_test>


  <linux:partition_test check="all" check_existence="all_exist" version="1"
    comment="/dev/shm exists"
    id="test_dev_shm_partition_noexec_expected_exist">
    <linux:object object_ref="object_dev_shm_partition_noexec_expected"/>
  </linux:partition_test>


</def-group>