inspec-core 4.3.2 → 4.6.3

data/lib/{resources → inspec/resources}/firewalld.rb

@@ -1,4 +1,4 @@
-# encoding: utf-8
+require "inspec/resources/command"
 
 module Inspec::Resources
   class FirewallD < Inspec.resource(1)
@@ -7,9 +7,9 @@ module Inspec::Resources
     #  set to allow users in group "wheel" to perform any commands without authentication.
     ###
 
-    name 'firewalld'
-    supports platform: 'linux'
-    desc 'Use the firewalld resource to check and see if firewalld is configured to grand or deny access to specific hosts or services'
+    name "firewalld"
+    supports platform: "linux"
+    desc "Use the firewalld resource to check and see if firewalld is configured to grand or deny access to specific hosts or services"
     example <<~EXAMPLE
       describe firewalld do
         it { should be_running }
@@ -28,10 +28,10 @@ module Inspec::Resources
     attr_reader :params
 
     filter = FilterTable.create
-    filter.register_column(:zone,       field: 'zone')
-          .register_column(:interfaces, field: 'interfaces')
-          .register_column(:sources,    field: 'sources')
-          .register_column(:services,   field: 'services')
+    filter.register_column(:zone,       field: "zone")
+          .register_column(:interfaces, field: "interfaces")
+          .register_column(:sources,    field: "sources")
+          .register_column(:services,   field: "services")
 
     filter.install_filter_methods_on_resource(self, :params)
 
@@ -40,50 +40,50 @@ module Inspec::Resources
     end
 
     def installed?
-      inspec.command('firewall-cmd').exist?
+      inspec.command("firewall-cmd").exist?
     end
 
     def has_zone?(query_zone)
       return false unless installed?
-      result = firewalld_command('--get-zones').split(' ')
+      result = firewalld_command("--get-zones").split(" ")
       result.include?(query_zone)
     end
 
     def running?
       return false unless installed?
-      result = firewalld_command('--state')
+      result = firewalld_command("--state")
       result =~ /^running/ ? true : false
     end
 
     def default_zone
       # return: word associated with the name of the default zone
       # example: 'public'
-      firewalld_command('--get-default-zone')
+      firewalld_command("--get-default-zone")
     end
 
     def has_service_enabled_in_zone?(query_service, query_zone = default_zone)
-      firewalld_command("--zone=#{query_zone} --query-service=#{query_service}") == 'yes'
+      firewalld_command("--zone=#{query_zone} --query-service=#{query_service}") == "yes"
     end
 
     def service_ports_enabled_in_zone(query_service, query_zone = default_zone)
       # return: String of ports open
       # example: ['22/tcp', '4722/tcp']
-      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-ports --permanent").split(' ')
+      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-ports --permanent").split(" ")
     end
 
     def service_protocols_enabled_in_zone(query_service, query_zone = default_zone)
       # return: String of protocoals open
       # example: ['icmp', 'ipv4', 'igmp']
-      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-protocols --permanent").split(' ')
+      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-protocols --permanent").split(" ")
     end
 
     def has_port_enabled_in_zone?(query_port, query_zone = default_zone)
-      firewalld_command("--zone=#{query_zone} --query-port=#{query_port}") == 'yes'
+      firewalld_command("--zone=#{query_zone} --query-port=#{query_port}") == "yes"
     end
 
     def has_rule_enabled?(rule, query_zone = default_zone)
-      rule = "rule #{rule}" unless rule.start_with?('rule')
-      firewalld_command("--zone=#{query_zone} --query-rich-rule='#{rule}'") == 'yes'
+      rule = "rule #{rule}" unless rule.start_with?("rule")
+      firewalld_command("--zone=#{query_zone} --query-rich-rule='#{rule}'") == "yes"
     end
 
     private
@@ -96,7 +96,7 @@ module Inspec::Resources
       # example:
       #   public
       #       interfaces: enp0s3
-      firewalld_command('--get-active-zones')
+      firewalld_command("--get-active-zones")
     end
 
     def parse_active_zones(content)
@@ -110,29 +110,29 @@ module Inspec::Resources
     def parse_line(line)
       zone = line.split("\n")[0]
       {
-        'zone' => zone,
-        'interfaces' => line.split(':')[1].split(' '),
-        'services' =>   services_bound(zone),
-        'sources' =>    sources_bound(zone),
+        "zone" => zone,
+        "interfaces" => line.split(":")[1].split(" "),
+        "services" => services_bound(zone),
+        "sources" => sources_bound(zone),
       }
     end
 
     def sources_bound(query_zone)
       # result: a list containing either an ip address or ip address with a mask, or a ipset or an ipset with the ipset prefix.
       # example: ['192.168.0.4', '192.168.0.0/16', '2111:DB28:ABC:12::', '2111:db89:ab3d:0112::0/64']
-      firewalld_command("--zone=#{query_zone} --list-sources").split(' ')
+      firewalld_command("--zone=#{query_zone} --list-sources").split(" ")
     end
 
     def services_bound(query_zone)
       # result: a list of services bound to a zone.
       # example: ['ssh', 'dhcpv6-client']
-      firewalld_command("--zone=#{query_zone} --list-services").split(' ')
+      firewalld_command("--zone=#{query_zone} --list-services").split(" ")
     end
 
     def firewalld_command(command)
       command = "firewall-cmd #{command}"
       result = inspec.command(command)
-      if result.stderr != ''
+      if result.stderr != ""
         return "Error on command #{command}: #{result.stderr}"
       end
       result.stdout.strip

data/lib/{resources → inspec/resources}/gem.rb

@@ -1,11 +1,11 @@
-# encoding: utf-8
+require "inspec/resources/command"
 
 module Inspec::Resources
   class GemPackage < Inspec.resource(1)
-    name 'gem'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    desc 'Use the gem InSpec audit resource to test if a global gem package is installed.'
+    name "gem"
+    supports platform: "unix"
+    supports platform: "windows"
+    desc "Use the gem InSpec audit resource to test if a global gem package is installed."
     example <<~EXAMPLE
       describe gem('rubocop') do
         it { should be_installed }
@@ -19,37 +19,37 @@ module Inspec::Resources
       @package_name = package_name
       @gem_binary = case gem_binary
                     when nil
-                      'gem'
+                      "gem"
                     when :chef
                       if inspec.os.windows?
                         'c:\opscode\chef\embedded\bin\gem.bat'
                       else
-                        '/opt/chef/embedded/bin/gem'
+                        "/opt/chef/embedded/bin/gem"
                       end
                     when :chef_server
-                      '/opt/opscode/embedded/bin/gem'
+                      "/opt/opscode/embedded/bin/gem"
                     else
                       gem_binary
                     end
-      skip_resource 'Unable to retrieve gem information' if info.empty?
+      skip_resource "Unable to retrieve gem information" if info.empty?
     end
 
     def info
       return @info if defined?(@info)
 
       cmd = inspec.command("#{@gem_binary} list --local -a -q \^#{@package_name}\$")
-      return {} unless cmd.exit_status.zero?
+      return {} unless cmd.exit_status == 0
 
       # extract package name and version
       # parses data like winrm (1.3.4, 1.3.3)
       params = /^\s*([^\(]*?)\s*\((.*?)\)\s*$/.match(cmd.stdout.chomp)
       @info = {
         installed: !params.nil?,
-        type: 'gem',
+        type: "gem",
       }
       return @info unless @info[:installed]
 
-      versions = params[2].split(',').map(&:strip)
+      versions = params[2].split(",").map(&:strip)
       @info[:name] = params[1]
       @info[:version] = versions[0]
       @info[:versions] = versions

data/lib/{resources → inspec/resources}/groups.rb

@@ -1,6 +1,7 @@
-# encoding: utf-8
-
-require 'utils/filter'
+require "inspec/resources/etc_group"
+require "inspec/resources/powershell"
+require "inspec/resources/parse_config"
+require "inspec/utils/filter"
 
 module Inspec::Resources
   # This file contains two resources, the `group` and `groups` resource.
@@ -24,10 +25,10 @@ module Inspec::Resources
   class Groups < Inspec.resource(1)
     include GroupManagementSelector
 
-    name 'groups'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    desc 'Use the group InSpec audit resource to test groups on the system. Groups can be filtered.'
+    name "groups"
+    supports platform: "unix"
+    supports platform: "windows"
+    desc "Use the group InSpec audit resource to test groups on the system. Groups can be filtered."
     example <<~EXAMPLE
       describe groups.where { name == 'root'} do
         its('names') { should eq ['root'] }
@@ -43,19 +44,19 @@ module Inspec::Resources
     def initialize
       # select group manager
       @group_provider = select_group_manager(inspec.os)
-      return skip_resource 'The `groups` resource is not supported on your OS yet.' if @group_provider.nil?
+      return skip_resource "The `groups` resource is not supported on your OS yet." if @group_provider.nil?
     end
 
     filter = FilterTable.create
     filter.register_custom_matcher(:exists?) { |x| !x.entries.empty? }
-    filter.register_column(:names,     field: 'name')
-          .register_column(:gids,      field: 'gid')
-          .register_column(:domains,   field: 'domain')
-          .register_column(:members,   field: 'members', style: :simple)
+    filter.register_column(:names,     field: "name")
+          .register_column(:gids,      field: "gid")
+          .register_column(:domains,   field: "domain")
+          .register_column(:members,   field: "members", style: :simple)
     filter.install_filter_methods_on_resource(self, :collect_group_details)
 
     def to_s
-      'Groups'
+      "Groups"
     end
 
     private
@@ -76,10 +77,10 @@ module Inspec::Resources
   class Group < Inspec.resource(1)
     include GroupManagementSelector
 
-    name 'group'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    desc 'Use the group InSpec audit resource to test groups on the system.'
+    name "group"
+    supports platform: "unix"
+    supports platform: "windows"
+    desc "Use the group InSpec audit resource to test groups on the system."
     example <<~EXAMPLE
       describe group('root') do
         it { should exist }
@@ -96,7 +97,7 @@ module Inspec::Resources
 
       # select group manager
       @group_provider = select_group_manager(inspec.os)
-      return skip_resource 'The `group` resource is not supported on your OS yet.' if @group_provider.nil?
+      return skip_resource "The `group` resource is not supported on your OS yet." if @group_provider.nil?
     end
 
     # verifies if a group exists
@@ -105,11 +106,11 @@ module Inspec::Resources
     end
 
     def gid
-      flatten_entry(group_info, 'gid')
+      flatten_entry(group_info, "gid")
     end
 
     def members
-      flatten_entry(group_info, 'members')
+      flatten_entry(group_info, "members")
     end
 
     def local
@@ -130,7 +131,7 @@ module Inspec::Resources
       elsif entries.size == 1
         entries.first.send(prop)
       else
-        raise 'found more than one group with the same name, please use `groups` resource'
+        raise "found more than one group with the same name, please use `groups` resource"
       end
     end
 
@@ -148,7 +149,7 @@ module Inspec::Resources
     end
 
     def groups
-      raise 'group provider must implement the `groups` method'
+      raise "group provider must implement the `groups` method"
     end
   end
 
@@ -163,7 +164,7 @@ module Inspec::Resources
   # This uses `dscacheutil` to get the group info instead of `etc_group`
   class DarwinGroup < GroupInfo
     def groups
-      group_info = inspec.command('dscacheutil -q group').stdout.split("\n\n")
+      group_info = inspec.command("dscacheutil -q group").stdout.split("\n\n")
 
       groups = []
       regex = /^([^:]*?)\s*:\s(.*?)\s*$/
@@ -172,11 +173,11 @@ module Inspec::Resources
       end
 
       # Convert the `dscacheutil` groups to match `inspec.etc_group.entries`
-      groups.each { |g| g['gid'] = g['gid'].to_i }
+      groups.each { |g| g["gid"] = g["gid"].to_i }
       groups.each do |g|
-        next if g['users'].nil?
-        g['members'] = g.delete('users')
-        g['members'].tr!(' ', ',')
+        next if g["users"].nil?
+        g["members"] = g.delete("users")
+        g["members"].tr!(" ", ",")
       end
     end
   end

data/lib/{resources → inspec/resources}/grub_conf.rb

@@ -1,12 +1,10 @@
-# encoding: utf-8
-
-require 'utils/simpleconfig'
-require 'utils/file_reader'
+require "inspec/utils/simpleconfig"
+require "inspec/utils/file_reader"
 
 class GrubConfig < Inspec.resource(1)
-  name 'grub_conf'
-  supports platform: 'unix'
-  desc 'Use the grub_conf InSpec audit resource to test the boot config of Linux systems that use Grub.'
+  name "grub_conf"
+  supports platform: "unix"
+  desc "Use the grub_conf InSpec audit resource to test the boot config of Linux systems that use Grub."
   example <<~EXAMPLE
     describe grub_conf('/etc/grub.conf',  'default') do
       its('kernel') { should include '/vmlinuz-2.6.32-573.7.1.el6.x86_64' }
@@ -28,23 +26,23 @@ class GrubConfig < Inspec.resource(1)
   def initialize(path = nil, kernel = nil)
     config_for_platform(path)
     @content = read_file(@conf_path)
-    @kernel = kernel || 'default'
+    @kernel = kernel || "default"
   rescue UnknownGrubConfig
-    return skip_resource 'The `grub_config` resource is not supported on your OS yet.'
+    skip_resource "The `grub_config` resource is not supported on your OS yet."
   end
 
   def config_for_platform(path)
     os = inspec.os
-    if os.redhat? || os[:name] == 'fedora'
+    if os.redhat? || os[:name] == "fedora"
       config_for_redhatish(path)
     elsif os.debian?
-      @conf_path = path || '/boot/grub/grub.cfg'
-      @defaults_path = '/etc/default/grub'
-      @grubenv_path = '/boot/grub2/grubenv'
-      @version = 'grub2'
-    elsif os[:name] == 'amazon'
-      @conf_path = path || '/etc/grub.conf'
-      @version = 'legacy'
+      @conf_path = path || "/boot/grub/grub.cfg"
+      @defaults_path = "/etc/default/grub"
+      @grubenv_path = "/boot/grub2/grubenv"
+      @version = "grub2"
+    elsif os[:name] == "amazon"
+      @conf_path = path || "/etc/grub.conf"
+      @version = "legacy"
     else
       raise UnknownGrubConfig
     end
@@ -52,13 +50,13 @@ class GrubConfig < Inspec.resource(1)
 
   def config_for_redhatish(path)
     if inspec.os[:release].to_f < 7
-      @conf_path = path || '/etc/grub.conf'
-      @version = 'legacy'
+      @conf_path = path || "/etc/grub.conf"
+      @version = "legacy"
     else
-      @conf_path = path || '/boot/grub2/grub.cfg'
-      @defaults_path = '/etc/default/grub'
-      @grubenv_path = '/boot/grub2/grubenv'
-      @version = 'grub2'
+      @conf_path = path || "/boot/grub2/grub.cfg"
+      @defaults_path = "/etc/default/grub"
+      @grubenv_path = "/boot/grub2/grubenv"
+      @version = "grub2"
     end
   end
 
@@ -67,7 +65,7 @@ class GrubConfig < Inspec.resource(1)
   end
 
   def to_s
-    'Grub Config'
+    "Grub Config"
   end
 
   private
@@ -79,10 +77,10 @@ class GrubConfig < Inspec.resource(1)
   def grub2_parse_kernel_lines(content, conf)
     menu_entries = extract_menu_entries(content)
 
-    if @kernel == 'default'
-      default_menu_entry(menu_entries, conf['GRUB_DEFAULT'])
+    if @kernel == "default"
+      default_menu_entry(menu_entries, conf["GRUB_DEFAULT"])
     else
-      menu_entries.find { |entry| entry['name'] == @kernel }
+      menu_entries.find { |entry| entry["name"] == @kernel }
     end
   end
 
@@ -93,7 +91,7 @@ class GrubConfig < Inspec.resource(1)
     lines.each_with_index do |line, index|
       next unless line =~ /^menuentry\s+.*/
       entry = {}
-      entry['insmod'] = []
+      entry["insmod"] = []
 
       # Extract name from menuentry line
       capture_data = line.match(/(?:^|\s+).*menuentry\s*['|"](.*)['|"]\s*--/)
@@ -101,20 +99,20 @@ class GrubConfig < Inspec.resource(1)
         raise Inspec::Exceptions::ResourceFailed "Failed to extract menuentry name from #{line}"
       end
 
-      entry['name'] = capture_data.captures[0]
+      entry["name"] = capture_data.captures[0]
 
       # Begin processing from index forward until a `}` line is met
-      lines.drop(index+1).each do |mline|
+      lines.drop(index + 1).each do |mline|
         break if mline =~ /^\s*}\s*$/
         case mline
         when /(?:^|\s*)initrd.*/
-          entry['initrd'] = mline.split(' ')[1]
+          entry["initrd"] = mline.split(" ")[1]
         when /(?:^|\s*)linux.*/
-          entry['kernel'] = mline.split
+          entry["kernel"] = mline.split
         when /(?:^|\s*)set root=.*/
-          entry['root'] = mline.split('=')[1].tr('\'', '')
+          entry["root"] = mline.split("=")[1].tr("'", "")
         when /(?:^|\s*)insmod.*/
-          entry['insmod'] << mline.split(' ')[1]
+          entry["insmod"] << mline.split(" ")[1]
         end
       end
 
@@ -127,7 +125,7 @@ class GrubConfig < Inspec.resource(1)
   def default_menu_entry(menu_entries, default)
     # If the default entry isn't `saved` then a number is used as an index.
     # By default this is `0`, which would be the first item in the list.
-    return menu_entries[default.to_i] unless default == 'saved'
+    return menu_entries[default.to_i] unless default == "saved"
 
     grubenv_contents = inspec.file(@grubenv_path).content
 
@@ -137,8 +135,8 @@ class GrubConfig < Inspec.resource(1)
     # of these reflect the default Grub2 behavior.
     return menu_entries[0] if grubenv_contents.nil?
 
-    default_name = SimpleConfig.new(grubenv_contents).params['saved_entry']
-    default_entry = menu_entries.select { |k| k['name'] == default_name }[0]
+    default_name = SimpleConfig.new(grubenv_contents).params["saved_entry"]
+    default_entry = menu_entries.select { |k| k["name"] == default_name }[0]
     return default_entry unless default_entry.nil?
 
     # It is possible for the saved entry to not be valid . For example, grubenv
@@ -157,14 +155,14 @@ class GrubConfig < Inspec.resource(1)
     kernel_opts = {}
     lines.each_with_index do |file_line, index|
       next unless file_line =~ /^title.*/
-      current_kernel = file_line.split(' ', 2)[1]
-      lines.drop(index+1).each do |kernel_line|
+      current_kernel = file_line.split(" ", 2)[1]
+      lines.drop(index + 1).each do |kernel_line|
         if kernel_line =~ /^\s.*/
-          option_type = kernel_line.split(' ')[0]
-          line_options = kernel_line.split(' ').drop(1)
-          if (menu_entry == conf['default'].to_i && @kernel == 'default') || current_kernel == @kernel
-            if option_type == 'kernel'
-              kernel_opts['kernel'] = line_options
+          option_type = kernel_line.split(" ")[0]
+          line_options = kernel_line.split(" ").drop(1)
+          if (menu_entry == conf["default"].to_i && @kernel == "default") || current_kernel == @kernel
+            if option_type == "kernel"
+              kernel_opts["kernel"] = line_options
             else
               kernel_opts[option_type] = line_options[0]
             end
@@ -187,11 +185,11 @@ class GrubConfig < Inspec.resource(1)
 
     content = read_file(@conf_path)
 
-    if @version == 'legacy'
+    if @version == "legacy"
       # parse the file
       conf = SimpleConfig.new(
         content,
-        multiple_values: true,
+        multiple_values: true
       ).params
       # convert single entry arrays into strings
       conf.each do |key, value|
@@ -203,13 +201,13 @@ class GrubConfig < Inspec.resource(1)
       @params = conf.merge(kernel_opts)
     end
 
-    if @version == 'grub2'
+    if @version == "grub2"
       # read defaults
       defaults = read_file(@defaults_path)
 
       conf = SimpleConfig.new(
         defaults,
-        multiple_values: true,
+        multiple_values: true
       ).params
 
       # convert single entry arrays into strings