inspec-core 2.1.67

data/lib/resources/audit_policy.rb

@@ -0,0 +1,63 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+# Advanced Auditing:
+# As soon as you start applying Advanced Audit Configuration Policy, legacy policies will be completely ignored.
+# reference: https://technet.microsoft.com/en-us/library/cc753632.aspx
+# use:
+#  - list all categories: Auditpol /list /subcategory:* /r
+#  - list parameters: Auditpol /get /category:"System" /subcategory:"IPsec Driver"
+#  - list specific parameter: Auditpol /get /subcategory:"IPsec Driver"
+#
+# @link: http://blogs.technet.com/b/askds/archive/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2.aspx
+#
+# Valid values are:
+#
+# - "No Auditing"
+# - "Not Specified"
+# - "Success"
+# - "Success and Failure"
+# - "Failure"
+#
+# Further information is available at: https://msdn.microsoft.com/en-us/library/dd973859.aspx
+
+module Inspec::Resources
+  class AuditPolicy < Inspec.resource(1)
+    name 'audit_policy'
+    supports platform: 'windows'
+    desc 'Use the audit_policy InSpec audit resource to test auditing policies on the Microsoft Windows platform. An auditing policy is a category of security-related events to be audited. Auditing is disabled by default and may be enabled for categories like account management, logon events, policy changes, process tracking, privilege use, system events, or object access. For each enabled auditing category property, the auditing level may be set to No Auditing, Not Specified, Success, Success and Failure, or Failure.'
+    example "
+      describe audit_policy do
+        its('parameter') { should eq 'value' }
+      end
+    "
+
+    def method_missing(method)
+      key = method.to_s
+
+      # expected result:
+      # Machine Name,Policy Target,Subcategory,Subcategory GUID,Inclusion Setting,Exclusion Setting
+      # WIN-MB8NINQ388J,System,Kerberos Authentication Service,{0CCE9242-69AE-11D9-BED3-505054503030},No Auditing,
+      result ||= inspec.command("Auditpol /get /subcategory:'#{key}' /r").stdout
+
+      # find line
+      target = nil
+      result.each_line do |s|
+        target = s.strip if s =~ /\b.*#{key}.*\b/
+      end
+
+      # extract value
+      values = nil
+      unless target.nil?
+        # split csv values and return value
+        values = target.split(',')[4]
+      end
+
+      values
+    end
+
+    def to_s
+      'Audit Policy'
+    end
+  end
+end

data/lib/resources/auditd.rb

@@ -0,0 +1,231 @@
+# encoding: utf-8
+
+require 'forwardable'
+require 'utils/filter_array'
+require 'utils/filter'
+require 'utils/parser'
+
+module Inspec::Resources
+  class AuditDaemon < Inspec.resource(1)
+    extend Forwardable
+    attr_accessor :lines
+    attr_reader :params
+
+    name 'auditd'
+    supports platform: 'unix'
+    desc 'Use the auditd InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files. These rules are output using the auditcl -l command.'
+    example "
+      describe auditd.syscall('chown').where {arch == 'b32'} do
+        its('action') { should eq ['always'] }
+        its('list') { should eq ['exit'] }
+      end
+
+      describe auditd.where {key == 'privileged'} do
+        its('permissions') { should include ['x'] }
+      end
+
+      describe auditd do
+        its('lines') { should include %r(-w /etc/ssh/sshd_config) }
+      end
+    "
+
+    def initialize
+      @content = inspec.command('/sbin/auditctl -l').stdout.chomp
+      @params = []
+
+      if @content =~ /^LIST_RULES:/
+        return skip_resource 'The version of audit is outdated. The `auditd` resource supports versions of audit >= 2.3.'
+      end
+      parse_content
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:file,         field: 'file')
+          .add(:list,         field: 'list')
+          .add(:action,       field: 'action')
+          .add(:fields,       field: 'fields')
+          .add(:fields_nokey, field: 'fields_nokey')
+          .add(:syscall,      field: 'syscall')
+          .add(:key,          field: 'key')
+          .add(:arch,         field: 'arch')
+          .add(:path,         field: 'path')
+          .add(:permissions,  field: 'permissions')
+          .add(:exit,         field: 'exit')
+
+    filter.connect(self, :params)
+
+    def status(name = nil)
+      @status_content ||= inspec.command('/sbin/auditctl -s').stdout.chomp
+      @status_params ||= Hash[@status_content.scan(/^([^ ]+) (.*)$/)]
+
+      return @status_params[name] if name
+      @status_params
+    end
+
+    def parse_content
+      @lines = @content.lines.map(&:chomp)
+
+      lines.each do |line|
+        if is_file_syscall_syntax?(line)
+          file_syscall_syntax_rules_for(line)
+        end
+
+        if is_syscall?(line)
+          syscall_rules_for(line)
+
+        elsif is_file?(line)
+          file_rules_for(line)
+        end
+      end
+    end
+
+    def file_syscall_syntax_rules_for(line)
+      file = file_syscall_syntax_for(line)
+      action, list = action_list_for(line)
+      fields = rule_fields_for(line)
+      key_field, fields_nokey = remove_key_from(fields)
+      key = key_in(key_field.join(''))
+      perms = perms_in(fields)
+
+      @params.push(
+        {
+          'file' => file,
+          'list' => list,
+          'action' => action,
+          'fields' => fields,
+          'permissions' => perms,
+          'key' => key,
+          'fields_nokey' => fields_nokey,
+        },
+      )
+    end
+
+    def syscall_rules_for(line)
+      syscalls = syscalls_for(line)
+      action, list = action_list_for(line)
+      fields = rule_fields_for(line)
+      key_field, fields_nokey = remove_key_from(fields)
+      key = key_in(key_field.join(''))
+      arch = arch_in(fields)
+      path = path_in(fields)
+      perms = perms_in(fields)
+      exit_field = exit_in(fields)
+
+      syscalls.each do |s|
+        @params.push(
+          {
+            'syscall' => s,
+            'list' => list,
+            'action' => action,
+            'fields' => fields,
+            'key' => key,
+            'arch' => arch,
+            'path' => path,
+            'permissions' => perms,
+            'exit' => exit_field,
+            'fields_nokey' => fields_nokey,
+          },
+        )
+      end
+    end
+
+    def file_rules_for(line)
+      file = file_for(line)
+      perms = permissions_for(line)
+      key = key_for(line)
+
+      @params.push(
+        {
+          'file' => file,
+          'key' => key,
+          'permissions' => perms,
+        },
+      )
+    end
+
+    def to_s
+      'Auditd Rules'
+    end
+
+    private
+
+    def is_syscall?(line)
+      line.match(/-S /)
+    end
+
+    def is_file?(line)
+      line.match(/-w /)
+    end
+
+    def is_file_syscall_syntax?(line)
+      line.match(/-F path=/)
+    end
+
+    def syscalls_for(line)
+      line.scan(/-S ([^ ]+)\s?/).flatten.first.split(',')
+    end
+
+    def action_list_for(line)
+      line.scan(/-a ([^,]+),([^ ]+)\s?/).flatten
+    end
+
+    def key_for(line)
+      line.match(/-k ([^ ]+)\s?/)[1] if line.include?('-k ')
+    end
+
+    def file_for(line)
+      line.match(/-w ([^ ]+)\s?/)[1]
+    end
+
+    def file_syscall_syntax_for(line)
+      line.match(/-F path=(\S+)\s?/)[1]
+    end
+
+    def permissions_for(line)
+      line.match(/-p ([^ ]+)/)[1].scan(/\w/)
+    end
+
+    def rule_fields_for(line)
+      line.gsub(/-[aS] [^ ]+ /, '').split('-F ').map { |l| l.split(' ') }.flatten
+    end
+
+    def arch_in(fields)
+      fields.each do |field|
+        return field.match(/arch=(\S+)\s?/)[1] if field.start_with?('arch=')
+      end
+      nil
+    end
+
+    def perms_in(fields)
+      fields.each do |field|
+        return field.match(/perm=(\S+)\s?/)[1].scan(/\w/) if field.start_with?('perm=')
+      end
+      nil
+    end
+
+    def path_in(fields)
+      fields.each do |field|
+        return field.match(/path=(\S+)\s?/)[1] if field.start_with?('path=')
+      end
+      nil
+    end
+
+    def exit_in(fields)
+      fields.each do |field|
+        return field.match(/exit=(\S+)\s?/)[1] if field.start_with?('exit=')
+      end
+      nil
+    end
+
+    def key_in(field)
+      _, v = field.split('=')
+      v
+    end
+
+    def remove_key_from(fields)
+      fields.partition { |x| x.start_with? 'key' }
+    end
+  end
+end

data/lib/resources/auditd_conf.rb

@@ -0,0 +1,46 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'utils/simpleconfig'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class AuditDaemonConf < Inspec.resource(1)
+    name 'auditd_conf'
+    supports platform: 'unix'
+    desc "Use the auditd_conf InSpec audit resource to test the configuration settings for the audit daemon. This file is typically located under /etc/audit/auditd.conf' on UNIX and Linux platforms."
+    example "
+      describe auditd_conf do
+        its('space_left_action') { should eq 'email' }
+      end
+    "
+
+    include FileReader
+
+    def initialize(path = nil)
+      @conf_path = path || '/etc/audit/auditd.conf'
+      @content = read_file_content(@conf_path)
+    end
+
+    def method_missing(name)
+      read_params[name.to_s]
+    end
+
+    def to_s
+      'Audit Daemon Config'
+    end
+
+    private
+
+    def read_params
+      return @params if defined?(@params)
+
+      # parse the file
+      conf = SimpleConfig.new(
+        @content,
+        multiple_values: false,
+      )
+      @params = conf.params
+    end
+  end
+end

data/lib/resources/bash.rb

@@ -0,0 +1,35 @@
+# encoding: utf-8
+
+require 'utils/command_wrapper'
+require 'resources/command'
+
+module Inspec::Resources
+  class Bash < Cmd
+    name 'bash'
+    supports platform: 'unix'
+    desc 'Run a command or script in BASH.'
+    example "
+      describe bash('ls -al /') do
+        its('stdout') { should match /bin/ }
+        its('stderr') { should eq '' }
+        its('exit_status') { should eq 0 }
+      end
+
+      # Specify the path of the executable:
+      bash('...', path: '/bin/bash')
+
+      # Specify arguments (defaults to -c)
+      bash('...', args: '-x -c')
+    "
+
+    def initialize(command, options = {})
+      @raw_command = command
+      options[:shell] = 'bash' if options.is_a?(Hash)
+      super(CommandWrapper.wrap(command, options))
+    end
+
+    def to_s
+      "Bash command #{@raw_command}"
+    end
+  end
+end

data/lib/resources/bond.rb

@@ -0,0 +1,69 @@
+# encoding: utf-8
+
+require 'resources/file'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class Bond < FileResource
+    name 'bond'
+    supports platform: 'unix'
+    desc 'Use the bond InSpec audit resource to test a logical, bonded network interface (i.e. "two or more network interfaces aggregated into a single, logical network interface"). On Linux platforms, any value in the /proc/net/bonding directory may be tested.'
+    example "
+      describe bond('bond0') do
+        it { should exist }
+      end
+    "
+
+    include FileReader
+
+    def initialize(bond)
+      @bond = bond
+      @path = "/proc/net/bonding/#{bond}"
+      @file = inspec.file(@path)
+      @content = read_file_content(@path, allow_empty: true)
+      @params = {}
+      @loaded = false
+    end
+
+    def read_content
+      @params = SimpleConfig.new(
+        @content,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        multiple_values: true,
+      ).params if @file.exist?
+      @loaded = true
+      @content
+    end
+
+    # ensures the content is loaded before we return the params
+    def params
+      read_content if @loaded == false
+      @params
+    end
+
+    def content
+      read_content if @loaded == false
+      @content
+    end
+
+    def exist?
+      @file.exist?
+    end
+
+    def has_interface?(interface)
+      params['Slave Interface'].include?(interface)
+    end
+
+    def interfaces
+      params['Slave Interface']
+    end
+
+    def mode
+      params['Bonding Mode'].first
+    end
+
+    def to_s
+      "Bond #{@bond}"
+    end
+  end
+end

data/lib/resources/bridge.rb

@@ -0,0 +1,122 @@
+# encoding: utf-8
+
+# Usage:
+# describe bridge('br0') do
+#   it { should exist }
+#   it { should have_interface 'eth0' }
+# end
+
+module Inspec::Resources
+  class Bridge < Inspec.resource(1)
+    name 'bridge'
+    supports platform: 'unix'
+    desc 'Use the bridge InSpec audit resource to test basic network bridge properties, such as name, if an interface is defined, and the associations for any defined interface.'
+    example "
+      describe bridge 'br0' do
+        it { should exist }
+        it { should have_interface 'eth0' }
+      end
+    "
+
+    def initialize(bridge_name)
+      @bridge_name = bridge_name
+
+      @bridge_provider = nil
+      if inspec.os.linux?
+        @bridge_provider = LinuxBridge.new(inspec)
+      elsif inspec.os.windows?
+        @bridge_provider = WindowsBridge.new(inspec)
+      else
+        return skip_resource 'The `bridge` resource is not supported on your OS yet.'
+      end
+    end
+
+    def exists?
+      !bridge_info.nil? && !bridge_info[:name].nil?
+    end
+
+    def has_interface?(interface)
+      return skip_resource 'The `bridge` resource does not provide interface detection for Windows yet' if inspec.os.windows?
+      bridge_info.nil? ? false : bridge_info[:interfaces].include?(interface)
+    end
+
+    def interfaces
+      bridge_info.nil? ? nil : bridge_info[:interfaces]
+    end
+
+    def to_s
+      "Bridge #{@bridge_name}"
+    end
+
+    private
+
+    def bridge_info
+      return @cache if defined?(@cache)
+      @cache = @bridge_provider.bridge_info(@bridge_name) if !@bridge_provider.nil?
+    end
+  end
+
+  class BridgeDetection
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+  end
+
+  # Linux Bridge
+  # If /sys/class/net/{interface}/bridge exists then it must be a bridge
+  # /sys/class/net/{interface}/brif contains the network interfaces
+  # @see http://www.tldp.org/HOWTO/BRIDGE-STP-HOWTO/set-up-the-bridge.html
+  # @see http://unix.stackexchange.com/questions/40560/how-to-know-if-a-network-interface-is-tap-tun-bridge-or-physical
+  class LinuxBridge < BridgeDetection
+    def bridge_info(bridge_name)
+      # read bridge information
+      bridge = inspec.file("/sys/class/net/#{bridge_name}/bridge").directory?
+      return nil unless bridge
+
+      # load interface names
+      interfaces = inspec.command("ls -1 /sys/class/net/#{bridge_name}/brif/")
+      interfaces = interfaces.stdout.chomp.split("\n")
+      {
+        name: bridge_name,
+        interfaces: interfaces,
+      }
+    end
+  end
+
+  # Windows Bridge
+  # select netadapter by adapter binding for windows
+  # Get-NetAdapterBinding -ComponentID ms_bridge | Get-NetAdapter
+  # @see https://technet.microsoft.com/en-us/library/jj130921(v=wps.630).aspx
+  # RegKeys: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
+  class WindowsBridge < BridgeDetection
+    def bridge_info(bridge_name)
+      # find all bridge adapters
+      cmd = inspec.command('Get-NetAdapterBinding -ComponentID ms_bridge | Get-NetAdapter | Select-Object -Property Name, InterfaceDescription | ConvertTo-Json')
+
+      # filter network interface
+      begin
+        bridges = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return nil
+      end
+
+      # ensure we have an array of groups
+      bridges = [bridges] if !bridges.is_a?(Array)
+
+      # select the requested interface
+      bridges = bridges.each_with_object([]) do |adapter, adapter_collection|
+        # map object
+        info = {
+          name: adapter['Name'],
+          interfaces: nil,
+        }
+        adapter_collection.push(info) if info[:name].casecmp(bridge_name) == 0
+      end
+
+      return nil if bridges.empty?
+      warn "[Possible Error] detected multiple bridges interfaces with the name #{bridge_name}" if bridges.size > 1
+      bridges[0]
+    end
+  end
+end