inspec-core 2.1.67

data/lib/resources/chocolatey_package.rb

@@ -0,0 +1,78 @@
+# encoding: utf-8
+# frozen_string_literal: true
+
+# Check for Chocolatey packages to be installed
+module Inspec::Resources
+  class ChocoPkg < Inspec.resource(1)
+    name 'chocolatey_package'
+    supports platform: 'windows'
+    desc 'Use the chocolatey_package Inspec audit resource to test if the named package and/or package version is installed on the system.'
+    example <<-EOH
+      describe chocolatey_package('git') do
+        it { should be_installed }
+        its('version') { should eq '2.15.1' }
+      end
+    EOH
+
+    attr_reader :package_name
+
+    def initialize(package_name, _opts = {})
+      raise 'Chocolatey is not installed' unless inspec.command('choco').exist?
+      @package_name = package_name
+      @cache = base_data.update(generate_cache)
+    end
+
+    def installed?
+      @cache[:installed]
+    end
+
+    def info
+      @cache.dup
+    end
+
+    def respond_to_missing?(method_name, *)
+      @cache.key?(method_name) || super
+    end
+
+    def method_missing(method_name, *args, &block)
+      if @cache.key?(method_name)
+        @cache.fetch(method_name)
+      else
+        super
+      end
+    end
+
+    def to_s
+      "Chocolatey package #{package_name}"
+    end
+
+    private
+
+    def base_data
+      {
+        name: package_name,
+        version: nil,
+        installed: false,
+        type: 'chocolatey',
+      }
+    end
+
+    def generate_cache
+      command = <<-EOH
+      (choco list --local-only --exact --include-programs --limit-output '#{package_name.gsub("'", "\`'")}') -Replace "\\|", "=" | ConvertFrom-StringData | ConvertTo-JSON
+      EOH
+
+      cmd = inspec.powershell(command.strip)
+
+      return {} if cmd.exit_status != 0 || cmd.stdout.strip.empty?
+      out = JSON.parse(cmd.stdout)
+
+      return {
+        version: out.fetch(package_name),
+        installed: true,
+      }
+    rescue JSON::ParserError, KeyError
+      return {}
+    end
+  end
+end

data/lib/resources/command.rb

@@ -0,0 +1,73 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+module Inspec::Resources
+  class Cmd < Inspec.resource(1)
+    name 'command'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the command InSpec audit resource to test an arbitrary command that is run on the system.'
+    example "
+      describe command('ls -al /') do
+        its('stdout') { should match /bin/ }
+        its('stderr') { should eq '' }
+        its('exit_status') { should eq 0 }
+      end
+
+      command('ls -al /').exist? will return false. Existence of command should be checked this way.
+      describe command('ls') do
+        it { should exist }
+      end
+    "
+
+    attr_reader :command
+
+    def initialize(cmd)
+      if cmd.nil?
+        raise 'InSpec `command` was called with `nil` as the argument. This is not supported. Please provide a valid command instead.'
+      end
+      @command = cmd
+    end
+
+    def result
+      @result ||= inspec.backend.run_command(@command)
+    end
+
+    def stdout
+      result.stdout
+    end
+
+    def stderr
+      result.stderr
+    end
+
+    def exit_status
+      result.exit_status.to_i
+    end
+
+    def exist? # rubocop:disable Metrics/AbcSize
+      # silent for mock resources
+      return false if inspec.os.name.nil? || inspec.os.name == 'mock'
+
+      if inspec.os.linux?
+        res = if inspec.platform.name == 'alpine'
+                inspec.backend.run_command("which \"#{@command}\"")
+              else
+                inspec.backend.run_command("bash -c 'type \"#{@command}\"'")
+              end
+      elsif inspec.os.windows?
+        res = inspec.backend.run_command("Get-Command \"#{@command}\"")
+      elsif inspec.os.unix?
+        res = inspec.backend.run_command("type \"#{@command}\"")
+      else
+        warn "`command(#{@command}).exist?` is not supported on your OS: #{inspec.os[:name]}"
+        return false
+      end
+      res.exit_status.to_i == 0
+    end
+
+    def to_s
+      "Command #{@command}"
+    end
+  end
+end

data/lib/resources/cpan.rb

@@ -0,0 +1,58 @@
+# encoding: utf-8
+
+# Usage:
+# describe cpan('DBD::Pg') do
+#   it { should be_installed }
+# end
+#
+
+module Inspec::Resources
+  class CpanPackage < Inspec.resource(1)
+    name 'cpan'
+    supports platform: 'unix'
+    desc 'Use the `cpan` InSpec audit resource to test Perl modules that are installed by system packages or the CPAN installer.'
+    example "
+      describe cpan('DBD::Pg') do
+        it { should be_installed }
+      end
+    "
+
+    def initialize(package_name, perl_lib_path = nil)
+      @package_name = package_name
+      @perl_lib_path = perl_lib_path
+      @perl_cmd = 'perl'
+
+      # this resource is not supported on Windows
+      return skip_resource 'The `cpan` resource is not supported on your OS yet.' if inspec.os.windows?
+      return skip_resource 'perl not found' unless inspec.command(@perl_cmd).exist?
+    end
+
+    def info
+      return @info if defined?(@info)
+
+      @info = {}
+      @info[:type] = 'cpan'
+      @info[:name] = @package_name
+      # set PERL5LIB environment variable if a custom lib path is given
+      lib_path = @perl_lib_path.nil? ? '' : "PERL5LIB=#{@perl_lib_path} "
+      cmd = inspec.command("#{lib_path+@perl_cmd} -le 'eval \"require $ARGV[0]\" and print $ARGV[0]->VERSION or exit 1' #{@package_name}")
+      @info[:installed] = cmd.exit_status.zero?
+      return @info unless cmd.exit_status.zero?
+
+      @info[:version] = cmd.stdout.strip
+      @info
+    end
+
+    def installed?
+      info[:installed] == true
+    end
+
+    def version
+      info[:version]
+    end
+
+    def to_s
+      "Perl Module #{@package_name}"
+    end
+  end
+end

data/lib/resources/cran.rb

@@ -0,0 +1,64 @@
+# encoding: utf-8
+
+# Usage:
+# describe cran('DBI') do
+#   it { should be_installed }
+# end
+#
+
+module Inspec::Resources
+  class CranPackage < Inspec.resource(1)
+    name 'cran'
+    supports platform: 'unix'
+    desc 'Use the `cran` InSpec audit resource to test R modules that are installed from CRAN package repository.'
+    example "
+      describe cran('DBI') do
+        it { should be_installed }
+      end
+    "
+
+    def initialize(package_name)
+      @package_name = package_name
+      @r_cmd = 'Rscript'
+
+      # this resource is not supported on Windows
+      return skip_resource 'The `cran` resource is not supported on your OS yet.' if inspec.os.windows?
+      return skip_resource 'Rscript not found' unless inspec.command(@r_cmd).exist?
+    end
+
+    def info
+      return @info if defined?(@info)
+
+      @info = {}
+      @info[:type] = 'cran'
+      @info[:name] = @package_name
+      cmd = inspec.command("#{@r_cmd} -e 'packageVersion(\"#{@package_name}\")'")
+      return @info unless cmd.exit_status.zero?
+
+      # Extract package version from Rscript output
+      # Output includes unicode punctuation (backticks) characters like so:
+      # [1] '0.5.1'
+      #
+      # So make sure command output is converted to unicode, as it returns ASCII-8BIT by default
+      utf8_stdout = cmd.stdout.chomp.force_encoding(Encoding::UTF_8)
+      params = /^\[\d+\]\s+(?:\p{Initial_Punctuation})(.+)(?:\p{Final_Punctuation})$/.match(utf8_stdout)
+      @info[:installed] = !params.nil?
+      return @info unless @info[:installed]
+
+      @info[:version] = params[1]
+      @info
+    end
+
+    def installed?
+      info[:installed] == true
+    end
+
+    def version
+      info[:version]
+    end
+
+    def to_s
+      "R Module #{@package_name}"
+    end
+  end
+end

data/lib/resources/crontab.rb

@@ -0,0 +1,169 @@
+# encoding: utf-8
+
+require 'utils/parser'
+require 'utils/filter'
+
+module Inspec::Resources
+  class Crontab < Inspec.resource(1)
+    name 'crontab'
+    supports platform: 'unix'
+    desc 'Use the crontab InSpec audit resource to test the contents of the crontab for a given user which contains information about scheduled tasks owned by that user.'
+    example "
+      describe crontab(user: 'root') do
+        its('commands') { should include '/path/to/some/script' }
+      end
+
+      describe crontab('myuser').commands('/home/myuser/build.sh') do
+        its('hours') { should cmp '*' }
+        its('minutes') { should cmp '*' }
+      end
+
+      describe crontab.where({'hour' => '*', 'minute' => '*'}) do
+        its('entries.length') { should cmp '0' }
+      end
+
+      describe crontab.where { command =~ /a partial command string/ } do
+        its('entries.length') { should cmp 1 }
+      end
+
+      describe crontab(path: '/etc/cron.d/some_crontab') do
+        its('commands') { should include '/path/to/some/script' }
+      end
+    "
+
+    attr_reader :params
+
+    include CommentParser
+
+    def initialize(opts = nil)
+      if opts.respond_to?(:fetch)
+        Hash[opts.map { |k, v| [k.to_sym, v] }]
+        @user = opts.fetch(:user, nil)
+        @path = opts.fetch(:path, nil)
+        raise Inspec::Exceptions::ResourceFailed, 'A user or path must be supplied.' if @user.nil? && @path.nil?
+      else
+        @user = opts
+        @path = nil
+      end
+      @params = read_crontab
+    end
+
+    def read_crontab
+      ct = is_system_crontab? ? inspec.file(@path).content : inspec.command(crontab_cmd).stdout
+      ct.lines.map { |l| parse_crontab_line(l) }.compact
+    end
+
+    def parse_crontab_line(l)
+      data, = parse_comment_line(l, comment_char: '#', standalone_comments: false)
+      return nil if data.nil? || data.empty?
+
+      is_system_crontab? ? parse_system_crontab(data) : parse_user_crontab(data)
+    end
+
+    def crontab_cmd
+      @user.nil? ? 'crontab -l' : "crontab -l -u #{@user}"
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:minutes,  field: 'minute')
+          .add(:hours,    field: 'hour')
+          .add(:days,     field: 'day')
+          .add(:months,   field: 'month')
+          .add(:weekdays, field: 'weekday')
+          .add(:user,     field: 'user')
+          .add(:commands, field: 'command')
+
+    # rebuild the crontab line from raw content
+    filter.add(:content) { |t, _|
+      t.entries.map do |e|
+        [e.minute, e.hour, e.day, e.month, e.weekday, e.user, e.command].compact.join(' ')
+      end.join("\n")
+    }
+
+    filter.connect(self, :params)
+
+    def to_s
+      if is_system_crontab?
+        "crontab for path #{@path}"
+      elsif is_user_crontab?
+        "crontab for user #{@user}"
+      else
+        'crontab for current user'
+      end
+    end
+
+    private
+
+    def is_system_crontab?
+      !@path.nil?
+    end
+
+    def is_user_crontab?
+      !@user.nil?
+    end
+
+    def parse_system_crontab(data)
+      case data
+      when /@hourly .*/
+        elements = data.split(/\s+/, 3)
+        { 'minute' => '0', 'hour' => '*', 'day' => '*', 'month' => '*', 'weekday' => '*', 'user' => elements.at(1), 'command' => elements.at(2) }
+      when /@(midnight|daily) .*/
+        elements = data.split(/\s+/, 3)
+        { 'minute' => '0', 'hour' => '0', 'day' => '*', 'month' => '*', 'weekday' => '*', 'user' => elements.at(1), 'command' => elements.at(2) }
+      when /@weekly .*/
+        elements = data.split(/\s+/, 3)
+        { 'minute' => '0', 'hour' => '0', 'day' => '*', 'month' => '*', 'weekday' => '0', 'user' => elements.at(1), 'command' => elements.at(2) }
+      when /@monthly ./
+        elements = data.split(/\s+/, 3)
+        { 'minute' => '0', 'hour' => '0', 'day' => '1', 'month' => '*', 'weekday' => '*', 'user' => elements.at(1), 'command' => elements.at(2) }
+      when /@(annually|yearly) .*/
+        elements = data.split(/\s+/, 3)
+        { 'minute' => '0', 'hour' => '0', 'day' => '1', 'month' => '1', 'weekday' => '*', 'user' => elements.at(1), 'command' => elements.at(2) }
+      when /@reboot .*/
+        elements = data.split(/\s+/, 3)
+        { 'minute' => '-1', 'hour' => '-1', 'day' => '-1', 'month' => '-1', 'weekday' => '-1', 'user' => elements.at(1), 'command' => elements.at(2) }
+      else
+        elements = data.split(/\s+/, 7)
+        {
+          'minute'  => elements.at(0),
+          'hour'    => elements.at(1),
+          'day'     => elements.at(2),
+          'month'   => elements.at(3),
+          'weekday' => elements.at(4),
+          'user'    => elements.at(5),
+          'command' => elements.at(6),
+        }
+      end
+    end
+
+    def parse_user_crontab(data)
+      case data
+      when /@hourly .*/
+        { 'minute' => '0', 'hour' => '*', 'day' => '*', 'month' => '*', 'weekday' => '*', 'user' => @user, 'command' => data.split(/\s+/, 2).at(1) }
+      when /@(midnight|daily) .*/
+        { 'minute' => '0', 'hour' => '0', 'day' => '*', 'month' => '*', 'weekday' => '*', 'user' => @user, 'command' => data.split(/\s+/, 2).at(1) }
+      when /@weekly .*/
+        { 'minute' => '0', 'hour' => '0', 'day' => '*', 'month' => '*', 'weekday' => '0', 'user' => @user, 'command' => data.split(/\s+/, 2).at(1) }
+      when /@monthly ./
+        { 'minute' => '0', 'hour' => '0', 'day' => '1', 'month' => '*', 'weekday' => '*', 'user' => @user, 'command' => data.split(/\s+/, 2).at(1) }
+      when /@(annually|yearly) .*/
+        { 'minute' => '0', 'hour' => '0', 'day' => '1', 'month' => '1', 'weekday' => '*', 'user' => @user, 'command' => data.split(/\s+/, 2).at(1) }
+      when /@reboot .*/
+        { 'minute' => '-1', 'hour' => '-1', 'day' => '-1', 'month' => '-1', 'weekday' => '-1', 'user' => @user, 'command' => data.split(/\s+/, 2).at(1) }
+      else
+        elements = data.split(/\s+/, 6)
+        {
+          'minute'  => elements.at(0),
+          'hour'    => elements.at(1),
+          'day'     => elements.at(2),
+          'month'   => elements.at(3),
+          'weekday' => elements.at(4),
+          'user'    => @user,
+          'command' => elements.at(5),
+        }
+      end
+    end
+  end
+end

data/lib/resources/csv.rb

@@ -0,0 +1,56 @@
+# encoding: utf-8
+
+# Parses a csv document
+# This implementation was inspired by a blog post
+# @see http://technicalpickles.com/posts/parsing-csv-with-ruby
+module Inspec::Resources
+  class CsvConfig < JsonConfig
+    name 'csv'
+    desc 'Use the csv InSpec audit resource to test configuration data in a CSV file.'
+    example "
+      describe csv('example.csv') do
+        its('name') { should eq(['John', 'Alice']) }
+      end
+    "
+
+    # override the parse method from JsonConfig
+    # Assuming a header row of name,col1,col2, it will output an array of hashes like so:
+    #    [
+    #      { 'name' => 'row1', 'col1' => 'value1', 'col2' => 'value2' },
+    #      { 'name' => 'row2', 'col1' => 'value3', 'col2' => 'value4' }
+    #    ]
+    def parse(content)
+      require 'csv'
+
+      # convert empty field to nil
+      CSV::Converters[:blank_to_nil] = lambda do |field|
+        field && field.empty? ? nil : field
+      end
+
+      # implicit conversion of values
+      csv = CSV.new(content, headers: true, converters: [:all, :blank_to_nil])
+
+      # convert to hash
+      csv.to_a.map(&:to_hash)
+    rescue => e
+      raise Inspec::Exceptions::ResourceFailed, "Unable to parse CSV: #{e.message}"
+    end
+
+    # override the value method from JsonConfig
+    # The format of the CSV hash as created by #parse is very different
+    # than what the YAML, JSON, and INI resources create, so using the
+    # #value method from JsonConfig (which uses ObjectTraverser.extract_value)
+    # doesn't make sense here.
+    def value(key)
+      @params.map { |x| x[key.first.to_s] }.compact
+    end
+
+    private
+
+    # used by JsonConfig to build up a full to_s method
+    # based on whether a file path, content, or command was supplied.
+    def resource_base_name
+      'CSV'
+    end
+  end
+end