<def-group>
  <definition class="compliance" id="mount_option_var_tmp_bind" version="1">
    {{{ oval_metadata("The /var/tmp directory should be bind mounted to /tmp in
      order to consolidate temporary storage into one location protected by the
      same techniques as /tmp.") }}}
    <criteria operator="AND">
      <criterion comment="Ensure /var/tmp is configured to bind mount to /tmp"
      test_ref="test_configure_mount_option_var_tmp_bind_tmp" />
      <criterion comment="Ensure /var/tmp is mounted"
      test_ref="test_mount_option_var_tmp" />
      <criteria operator="OR">
        <criterion comment="Ensure /var/tmp is mounted and binded"
        test_ref="test_mount_option_var_tmp_bind" />
        <criterion comment="Ensure /var/tmp and /tmp have the same source device"
        test_ref="test_mount_option_var_tmp_bind_compare_source" />
      </criteria>
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
  comment="Ensure /var/tmp is configured to bind mount to /tmp"
  id="test_configure_mount_option_var_tmp_bind_tmp" version="1">
    <ind:object object_ref="object_configure_mount_option_var_tmp_bind_tmp" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab"
  id="object_configure_mount_option_var_tmp_bind_tmp" version="1">
    <ind:filepath>/etc/fstab</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <linux:partition_test id="test_mount_option_var_tmp" version="1"
  comment="Ensure /var/tmp is mounted" check="all">
    <linux:object object_ref="object_mount_option_var_tmp" />
  </linux:partition_test>
  <linux:partition_object id="object_mount_option_var_tmp" version="1">
    <linux:mount_point operation="pattern match">^/var/tmp$</linux:mount_point>
  </linux:partition_object>

  <!-- The linux:partition_test reads from /proc/mounts, which does not record
       the bind mount option. As a result, the less elegant textfilecontent54_test
       is required here. -->

  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
  comment="Ensure bind mount option is on /var/tmp"
  id="test_mount_option_var_tmp_bind" version="1">
    <ind:object object_ref="object_mount_option_var_tmp_bind" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab"
  id="object_mount_option_var_tmp_bind" version="1">
    <ind:filepath>/etc/mtab</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <!-- On newer system /etc/mtab has changed behavior and there is no info
       about binded mounts anymore. An alternative is to check if
       /tmp and /var/tmp have the same source device -->

  <linux:partition_test id="test_mount_option_var_tmp_bind_compare_source" version="1"
  comment="Ensure /var/tmp and /tmp have the same source device" check="all">
    <linux:object object_ref="object_mount_option_var_tmp_bind_compare_source" />
    <linux:state state_ref="state_mount_option_var_tmp_bind_compare_source" />
  </linux:partition_test>
  <linux:partition_object id="object_mount_option_var_tmp_bind_compare_source" version="1">
    <linux:mount_point operation="pattern match">^/tmp$</linux:mount_point>
  </linux:partition_object>
  <linux:partition_state id="state_mount_option_var_tmp_bind_compare_source" version="1">
    <linux:device datatype="string" entity_check="at least one"
    operation="equals" var_ref="var_mount_option_var_tmp_bind_var_tmp_source_device"/>
  </linux:partition_state>

  <local_variable comment="Source device of /var/tmp" datatype="string"
  id="var_mount_option_var_tmp_bind_var_tmp_source_device" version="1">
    <object_component item_field="device"
    object_ref="object_mount_option_var_tmp" />
  </local_variable>

</def-group>
