inspec-core 2.1.67

data/lib/resources/packages.rb

@@ -0,0 +1,111 @@
+# encoding: utf-8
+# copyright: 2017, Chef Software, Inc. <legal@chef.io>
+
+require 'utils/filter'
+
+module Inspec::Resources
+  class Packages < Inspec.resource(1)
+    name 'packages'
+    supports platform: 'unix'
+    desc 'Use the packages InSpec audit resource to test properties for multiple packages installed on the system'
+    example "
+      describe packages(/xserver-xorg.*/) do
+        its('entries') { should be_empty }
+      end
+      describe packages('vim').entries.length do
+        it { should be > 1 }
+      end
+      describe packages(/vi.+/).where { status != 'installed' } do
+        its('statuses') { should be_empty }
+      end
+    "
+
+    def initialize(pattern)
+      os = inspec.os
+      if os.debian?
+        @pkgs = Debs.new(inspec)
+      elsif os.redhat? || %w{suse amazon fedora}.include?(os[:family])
+        @pkgs = Rpms.new(inspec)
+      else
+        return skip_resource "The packages resource is not yet supported on OS #{inspec.os.name}"
+      end
+
+      @pattern = pattern_regexp(pattern)
+      all_pkgs = @pkgs.build_package_list
+      @list = all_pkgs.find_all do |hm|
+        hm[:name] =~ @pattern
+      end
+    end
+
+    def to_s
+      "Packages #{@pattern.class == String ? @pattern : @pattern.inspect}"
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:statuses,  field: 'status', style: :simple)
+          .add(:names,     field: 'name')
+          .add(:versions,  field: 'version')
+          .add(:architectures, field: 'architecture')
+          .connect(self, :filtered_packages)
+
+    private
+
+    def pattern_regexp(p)
+      if p.class == String
+        Regexp.new(Regexp.escape(p))
+      elsif p.class == Regexp
+        p
+      else
+        raise 'Invalid name argument to packages resource, please use a "string" or /regexp/'
+      end
+    end
+
+    def filtered_packages
+      warn "The packages resource is not yet supported on OS #{inspec.os.name}" if resource_skipped?
+      @list
+    end
+  end
+
+  class PkgsManagement
+    PackageStruct = Struct.new(:status, :name, :version, :architecture)
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+  end
+
+  # Debian / Ubuntu
+  class Debs < PkgsManagement
+    def build_package_list
+      # use two spaces as delimiter in case any of the fields has a space in it
+      command = "dpkg-query -W -f='${db:Status-Abbrev}  ${Package}  ${Version}  ${Architecture}\\n'"
+      cmd = inspec.command(command)
+      all = cmd.stdout.split("\n")
+      return [] if all.nil?
+      all.map do |m|
+        a = m.split(/ {2,}/)
+        a[0] = 'installed' if a[0] =~ /^.i/
+        a[2] = a[2].split(':').last
+        PackageStruct.new(*a)
+      end
+    end
+  end
+
+  # RedHat family
+  class Rpms < PkgsManagement
+    def build_package_list
+      # use two spaces as delimiter in case any of the fields has a space in it
+      command = "rpm -qa --queryformat '%{NAME}  %{VERSION}-%{RELEASE}  %{ARCH}\\n'" # rubocop:disable Style/FormatStringToken
+      cmd = inspec.command(command)
+      all = cmd.stdout.split("\n")
+      return [] if all.nil?
+      all.map do |m|
+        a = m.split('  ')
+        a.unshift('installed')
+        PackageStruct.new(*a)
+      end
+    end
+  end
+end

data/lib/resources/parse_config.rb

@@ -0,0 +1,112 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+# Usage example:
+#
+#  audit = command('/sbin/auditctl -l').stdout
+#  options = {
+#    assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+#    multiple_values: true
+#  }
+#  describe parse_config(audit, options ) do
+
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class PConfig < Inspec.resource(1)
+    name 'parse_config'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the parse_config InSpec audit resource to test arbitrary configuration files.'
+    example "
+      output = command('some-command').stdout
+      describe parse_config(output, { data_config_option: value } ) do
+        its('setting') { should eq 1 }
+      end
+
+      output2 = command('curl http://127.0.0.1/php_status').stdout
+      # php status is in format 'key : value', and we do not allow for multiple values
+      options2 = {
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        multiple_values: false
+      }
+
+      describe parse_config(output2, options2) do
+        its('pool') { should eq 'www'}
+        its('process manager') { should eq process_manager }
+      end
+
+      # getting specific key from the output above, convert it to integer and then compare
+      # make sure 'listen queue' is below 100
+      describe parse_config(output2, options2 ).params['listen queue'].to_i do
+        it { should be < 100 }
+      end
+    "
+
+    include FileReader
+
+    attr_reader :content
+    def initialize(content = nil, useropts = nil)
+      @opts = {}
+      @opts = useropts.dup unless useropts.nil?
+      @files_contents = {}
+
+      @content = content
+      read_params unless @content.nil?
+    end
+
+    def method_missing(name)
+      read_params[name.to_s]
+    end
+
+    def params(*opts)
+      opts.inject(read_params) do |res, nxt|
+        res.respond_to?(:key) ? res[nxt] : nil
+      end
+    end
+
+    def to_s
+      "Parse Config #{@conf_path}"
+    end
+
+    private
+
+    def parse_file(conf_path)
+      @conf_path = conf_path
+      @content = read_file(conf_path).to_s
+
+      read_params
+    end
+
+    def read_file(path)
+      @files_contents[path] ||= read_file_content(path)
+    end
+
+    def read_params
+      @params ||= if content.nil?
+                    {}
+                  else
+                    SimpleConfig.new(content, @opts).params
+                  end
+    end
+  end
+
+  class PConfigFile < PConfig
+    name 'parse_config_file'
+    desc 'Use the parse_config_file InSpec resource to test arbitrary configuration files. It works identically to parse_config. Instead of using a command output, this resource works with files.'
+    example "
+      describe parse_config_file('/path/to/file') do
+        its('setting') { should eq 1 }
+      end
+    "
+
+    def initialize(path, opts = nil)
+      super(nil, opts)
+      parse_file(path)
+    end
+
+    def to_s
+      "Parse Config File #{@conf_path}"
+    end
+  end
+end

data/lib/resources/passwd.rb

@@ -0,0 +1,76 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+# The file format consists of
+# - username
+# - password
+# - userid
+# - groupid
+# - user id info
+# - home directory
+# - command
+
+require 'utils/parser'
+require 'utils/filter'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class Passwd < Inspec.resource(1)
+    name 'passwd'
+    supports platform: 'unix'
+    desc 'Use the passwd InSpec audit resource to test the contents of /etc/passwd, which contains the following information for users that may log into the system and/or as users that own running processes.'
+    example "
+      describe passwd do
+        its('users') { should_not include 'forbidden_user' }
+      end
+
+      describe passwd.uids(0) do
+        its('users') { should cmp 'root' }
+      end
+
+      describe passwd.shells(/nologin/) do
+        # find all users with a nologin shell
+        its('users') { should_not include 'my_login_user' }
+      end
+    "
+
+    include PasswdParser
+    include FileReader
+
+    attr_reader :params
+    attr_reader :content
+    attr_reader :lines
+
+    def initialize(path = nil, opts = nil)
+      opts ||= {}
+      @path = path || '/etc/passwd'
+      @content = opts[:content] || read_file_content(@path, allow_empty: true)
+      @lines = @content.to_s.split("\n")
+      @params = parse_passwd(@content)
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:users,     field: 'user')
+          .add(:passwords, field: 'password')
+          .add(:uids,      field: 'uid')
+          .add(:gids,      field: 'gid')
+          .add(:descs,     field: 'desc')
+          .add(:homes,     field: 'home')
+          .add(:shells,    field: 'shell')
+
+    # rebuild the passwd line from raw content
+    filter.add(:content) { |t, _|
+      t.entries.map do |e|
+        [e.user, e.password, e.uid, e.gid, e.desc, e.home, e.shell].join(':')
+      end.join("\n")
+    }
+
+    filter.connect(self, :params)
+
+    def to_s
+      '/etc/passwd'
+    end
+  end
+end

data/lib/resources/pip.rb

@@ -0,0 +1,130 @@
+# encoding: utf-8
+
+# Usage:
+# describe pip('Jinja2') do
+#   it { should be_installed }
+# end
+#
+
+module Inspec::Resources
+  class PipPackage < Inspec.resource(1)
+    name 'pip'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the pip InSpec audit resource to test packages that are installed using the pip installer.'
+    example "
+      describe pip('Jinja2') do
+        it { should be_installed }
+      end
+
+      describe pip('django', '/path/to/virtualenv/bin/pip') do
+        it { should be_installed }
+        its('version') { should eq('1.11.4')}
+      end
+    "
+
+    def initialize(package_name, pip_path = nil)
+      @package_name = package_name
+      @pip_cmd = pip_path || default_pip_path
+
+      return skip_resource 'pip not found' if @pip_cmd.nil?
+    end
+
+    def info
+      return @info if defined?(@info)
+
+      @info = {}
+      @info[:type] = 'pip'
+      return @info unless cmd_successful?
+
+      params = SimpleConfig.new(
+        cmd.stdout,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        multiple_values: false,
+      ).params
+      @info[:name] = params['Name']
+      @info[:version] = params['Version']
+      @info[:installed] = true
+      @info
+    end
+
+    def installed?
+      info[:installed] == true
+    end
+
+    def version
+      info[:version]
+    end
+
+    def to_s
+      "Pip Package #{@package_name}"
+    end
+
+    private
+
+    def cmd
+      @__cmd ||= inspec.command("#{@pip_cmd} show #{@package_name}")
+    end
+
+    def cmd_successful?
+      return true if cmd.exit_status == 0
+
+      if cmd.exit_status != 0
+        # If pip on windows is not the latest, it will create a stderr value along with stdout
+        # Example:
+        #   stdout: "Name: Jinja2\r\nVersion: 2.10..."
+        #   stderr: "You are using pip version 9.0.1, however version 9.0.3 is available..."
+        if inspec.os.windows? && !cmd.stdout.empty?
+          return true
+        end
+      end
+
+      false
+    end
+
+    # Paths of Python and Pip on windows
+    # {"Pip" => nil, "Python" => "/path/to/python"}
+    #
+    # @return [Hash] of windows_paths
+    def windows_paths
+      return @__windows_paths if @__windows_paths
+      cmd = inspec.command(
+        'New-Object -Type PSObject |
+         Add-Member -MemberType NoteProperty -Name Pip -Value (Invoke-Command -ScriptBlock {where.exe pip}) -PassThru |
+         Add-Member -MemberType NoteProperty -Name Python -Value (Invoke-Command -ScriptBlock {where.exe python}) -PassThru |
+         ConvertTo-Json',
+      )
+
+      @__windows_paths = JSON.parse(cmd.stdout)
+    end
+
+    # Default path of python pip installation
+    #
+    # @return [String] of python pip path
+    def default_pip_path
+      return 'pip' unless inspec.os.windows?
+
+      # If python is not found, return with skip_resource
+      return skip_resource 'python not found' if windows_paths['Python'].nil?
+
+      # Pip is not on the default path for Windows, therefore we do some logic
+      # to find the binary on Windows
+      begin
+        # use pip if it on system path
+        pipcmd = windows_paths['Pip']
+        # calculate path on windows
+        if defined?(windows_paths['Python']) && pipcmd.nil?
+          return nil if windows_paths['Pip'].nil?
+          pipdir = windows_paths['Python'].split('\\')
+          # remove python.exe
+          pipdir.pop
+          pipcmd = pipdir.push('Scripts').push('pip.exe').join('/')
+        end
+      rescue JSON::ParserError => _e
+        return nil
+      end
+
+      pipcmd
+    end
+  end
+end

data/lib/resources/platform.rb

@@ -0,0 +1,109 @@
+# encoding: utf-8
+
+module Inspec::Resources
+  class PlatformResource < Inspec.resource(1)
+    name 'platform'
+    desc 'Use the platform InSpec resource to test the platform on which the system is running.'
+    example "
+      describe platform do
+        its('name') { should eq 'redhat' }
+      end
+
+      describe platform do
+        it { should be_in_family('unix') }
+      end
+    "
+
+    def initialize
+      @platform = inspec.backend.platform
+    end
+
+    # add helper methods for easy access of properties
+    %w{family release arch}.each do |property|
+      define_method(property.to_sym) do
+        @platform[property]
+      end
+    end
+
+    def families
+      @platform.family_hierarchy
+    end
+
+    def name
+      @platform.name
+    end
+
+    def [](key)
+      # convert string to symbol
+      key = key.to_sym if key.is_a? String
+      return name if key == :name
+
+      @platform[key]
+    end
+
+    def platform?(name)
+      @platform.name == name ||
+        @platform.family_hierarchy.include?(name)
+    end
+
+    def in_family?(family)
+      @platform.family_hierarchy.include?(family)
+    end
+
+    def params
+      h = {
+        name: name,
+        families: families,
+        release: release,
+      }
+
+      # Avoid adding Arch for APIs (not applicable)
+      unless in_family?('api')
+        h[:arch] = arch
+      end
+
+      h
+    end
+
+    def supported?(supports)
+      return true if supports.nil? || supports.empty?
+
+      status = true
+      supports.each do |s|
+        s.each do |k, v|
+          if %i(os_family os-family platform_family platform-family).include?(k)
+            status = in_family?(v)
+          elsif %i(os platform).include?(k)
+            status = platform?(v)
+          elsif %i(os_name os-name platform_name platform-name).include?(k)
+            status = name == v
+          elsif k == :release
+            status = check_release(v)
+          else
+            status = false
+          end
+          break if status == false
+        end
+        return true if status == true
+      end
+
+      status
+    end
+
+    def to_s
+      'Platform Detection'
+    end
+
+    private
+
+    def check_release(value)
+      # allow wild card matching
+      if value.include?('*')
+        cleaned = Regexp.escape(value).gsub('\*', '.*?')
+        !(release =~ /#{cleaned}/).nil?
+      else
+        release == value
+      end
+    end
+  end
+end