inspec-core 4.31.1 → 4.37.8
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile +14 -1
- data/inspec-core.gemspec +2 -2
- data/lib/inspec/base_cli.rb +5 -3
- data/lib/inspec/cli.rb +12 -4
- data/lib/inspec/control_eval_context.rb +1 -0
- data/lib/inspec/fetcher/local.rb +1 -1
- data/lib/inspec/input.rb +39 -4
- data/lib/inspec/input_registry.rb +1 -0
- data/lib/inspec/objects/input.rb +1 -1
- data/lib/inspec/plugin/v2/loader.rb +9 -0
- data/lib/inspec/profile_context.rb +1 -1
- data/lib/inspec/reporters/cli.rb +63 -0
- data/lib/inspec/resources.rb +1 -0
- data/lib/inspec/resources/command.rb +3 -9
- data/lib/inspec/resources/groups.rb +21 -6
- data/lib/inspec/resources/http.rb +1 -1
- data/lib/inspec/resources/mssql_session.rb +1 -1
- data/lib/inspec/resources/mysql_session.rb +1 -1
- data/lib/inspec/resources/pip.rb +1 -1
- data/lib/inspec/resources/registry_key.rb +1 -1
- data/lib/inspec/resources/selinux.rb +154 -0
- data/lib/inspec/resources/users.rb +1 -1
- data/lib/inspec/resources/windows_feature.rb +2 -1
- data/lib/inspec/resources/windows_firewall_rule.rb +1 -1
- data/lib/inspec/rule.rb +9 -1
- data/lib/inspec/runner.rb +1 -1
- data/lib/inspec/utils/erlang_parser.rb +2 -2
- data/lib/inspec/utils/filter.rb +7 -7
- data/lib/inspec/utils/nginx_parser.rb +3 -3
- data/lib/inspec/version.rb +1 -1
- data/lib/plugins/inspec-compliance/README.md +125 -2
- data/lib/plugins/inspec-compliance/lib/inspec-compliance.rb +5 -0
- data/lib/plugins/inspec-compliance/lib/inspec-compliance/api.rb +18 -1
- data/lib/plugins/inspec-compliance/lib/inspec-compliance/api/login.rb +23 -8
- data/lib/plugins/inspec-compliance/lib/inspec-compliance/cli.rb +24 -25
- data/lib/plugins/inspec-compliance/lib/inspec-compliance/target.rb +5 -4
- metadata +11 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: d915bf11e35804382285502f46a3a37b35017a10ab34c4e2f78d7420b0e3f589
|
4
|
+
data.tar.gz: b85a4f9cda0e1da7461b6d23248e935ceb6fbb2d9028f5bd9eec0683426c1ec3
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: e1925d3c20bcd18a711dfa9d2df7ff98bd522b4afd3fbc8f4c5bc16648e60101fd6984a5a3d4bebf568b2993ec29ecae1ca58380e8d1a5bb55498f335dd144ff
|
7
|
+
data.tar.gz: da6f422af63ddfa51d96b945cc8d34d0bc67d26557114367406108ff43bada35a2c9dd83e4c0c29081cb3a29fe6c545fcd7cf1e8a8d8a4618da1058b6e562883
|
data/Gemfile
CHANGED
@@ -28,7 +28,7 @@ group :omnibus do
|
|
28
28
|
end
|
29
29
|
|
30
30
|
group :test do
|
31
|
-
gem "chefstyle", "~>
|
31
|
+
gem "chefstyle", "~> 2.0.3"
|
32
32
|
gem "concurrent-ruby", "~> 1.0"
|
33
33
|
gem "html-proofer", platforms: :ruby # do not attempt to run proofer on windows
|
34
34
|
gem "json_schemer", ">= 0.2.1", "< 0.2.19"
|
@@ -48,3 +48,16 @@ end
|
|
48
48
|
group :deploy do
|
49
49
|
gem "inquirer"
|
50
50
|
end
|
51
|
+
|
52
|
+
# Only include Test Kitchen support if we are on Ruby 2.7 or higher
|
53
|
+
# as chef-zero support requires Ruby 2.6
|
54
|
+
# See https://github.com/inspec/inspec/pull/5341
|
55
|
+
if Gem.ruby_version >= Gem::Version.new("2.7.0")
|
56
|
+
group :kitchen do
|
57
|
+
gem "berkshelf"
|
58
|
+
gem "test-kitchen", ">= 2.8"
|
59
|
+
gem "kitchen-inspec", ">= 2.0"
|
60
|
+
gem "kitchen-dokken", ">= 2.11"
|
61
|
+
gem "git"
|
62
|
+
end
|
63
|
+
end
|
data/inspec-core.gemspec
CHANGED
@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
|
|
23
23
|
.reject { |f| File.directory?(f) }
|
24
24
|
|
25
25
|
# Implementation dependencies
|
26
|
-
spec.add_dependency "chef-telemetry", "~> 1.0"
|
26
|
+
spec.add_dependency "chef-telemetry", "~> 1.0", ">= 1.0.8" # 1.0.8+ removes the http dep
|
27
27
|
spec.add_dependency "license-acceptance", ">= 0.2.13", "< 3.0"
|
28
28
|
spec.add_dependency "thor", ">= 0.20", "< 2.0"
|
29
29
|
spec.add_dependency "method_source", ">= 0.8", "< 2.0"
|
@@ -35,7 +35,7 @@ Gem::Specification.new do |spec|
|
|
35
35
|
spec.add_dependency "mixlib-log", "~> 3.0"
|
36
36
|
spec.add_dependency "sslshake", "~> 1.2"
|
37
37
|
spec.add_dependency "parallel", "~> 1.9"
|
38
|
-
spec.add_dependency "faraday", ">= 0.9.0", "< 1.
|
38
|
+
spec.add_dependency "faraday", ">= 0.9.0", "< 1.5"
|
39
39
|
spec.add_dependency "faraday_middleware", "~> 1.0"
|
40
40
|
spec.add_dependency "tty-table", "~> 0.10"
|
41
41
|
spec.add_dependency "tty-prompt", "~> 0.17"
|
data/lib/inspec/base_cli.rb
CHANGED
@@ -168,9 +168,11 @@ module Inspec
|
|
168
168
|
desc: "After normal execution order, results are sorted by control ID, or by file (default), or randomly. None uses legacy unsorted mode."
|
169
169
|
option :filter_empty_profiles, type: :boolean, default: false,
|
170
170
|
desc: "Filter empty profiles (profiles without controls) from the report."
|
171
|
-
option :command_timeout, type: :numeric,
|
172
|
-
desc: "Maximum seconds to allow commands to run during execution.
|
173
|
-
long_desc: "Maximum seconds to allow commands to run during execution.
|
171
|
+
option :command_timeout, type: :numeric,
|
172
|
+
desc: "Maximum seconds to allow commands to run during execution.",
|
173
|
+
long_desc: "Maximum seconds to allow commands to run during execution. A timed out command is considered an error."
|
174
|
+
option :reporter_include_source, type: :boolean, default: false,
|
175
|
+
desc: "Include full source code of controls in the CLI report"
|
174
176
|
end
|
175
177
|
|
176
178
|
def self.help(*args)
|
data/lib/inspec/cli.rb
CHANGED
@@ -218,9 +218,13 @@ class Inspec::InspecCLI < Inspec::BaseCLI
|
|
218
218
|
|
219
219
|
Automate:
|
220
220
|
```
|
221
|
-
#{Inspec::Dist::EXEC_NAME}
|
221
|
+
#{Inspec::Dist::EXEC_NAME} automate login
|
222
222
|
#{Inspec::Dist::EXEC_NAME} exec compliance://username/linux-baseline
|
223
223
|
```
|
224
|
+
`inspec compliance` is a backwards compatible alias for `inspec automate` and works the same way:
|
225
|
+
```
|
226
|
+
#{Inspec::Dist::EXEC_NAME} compliance login
|
227
|
+
```
|
224
228
|
|
225
229
|
Supermarket:
|
226
230
|
```
|
@@ -321,10 +325,14 @@ class Inspec::InspecCLI < Inspec::BaseCLI
|
|
321
325
|
desc: "A space-delimited list of local folders containing profiles whose libraries and resources will be loaded into the new shell"
|
322
326
|
option :distinct_exit, type: :boolean, default: true,
|
323
327
|
desc: "Exit with code 100 if any tests fail, and 101 if any are skipped but none failed (default). If disabled, exit 0 on skips and 1 for failures."
|
324
|
-
option :command_timeout, type: :numeric,
|
325
|
-
desc: "Maximum seconds to allow a command to run.
|
326
|
-
long_desc: "Maximum seconds to allow commands to run.
|
328
|
+
option :command_timeout, type: :numeric,
|
329
|
+
desc: "Maximum seconds to allow a command to run.",
|
330
|
+
long_desc: "Maximum seconds to allow commands to run. A timed out command is considered an error."
|
327
331
|
option :inspect, type: :boolean, default: false, desc: "Use verbose/debugging output for resources."
|
332
|
+
option :input_file, type: :array,
|
333
|
+
desc: "Load one or more input files, a YAML file with values for the shell to use"
|
334
|
+
option :input, type: :array, banner: "name1=value1 name2=value2",
|
335
|
+
desc: "Specify one or more inputs directly on the command line to the shell, as --input NAME=VALUE. Accepts single-quoted YAML and JSON structures."
|
328
336
|
def shell_func
|
329
337
|
o = config
|
330
338
|
diagnose(o)
|
@@ -194,6 +194,7 @@ module Inspec
|
|
194
194
|
|
195
195
|
# Check if the given control exist in the --controls option
|
196
196
|
def control_exist_in_controls_list?(id)
|
197
|
+
id_exist_in_list = false
|
197
198
|
if profile_config_exist?
|
198
199
|
id_exist_in_list = @conf["profile"].include_controls_list.any? do |inclusion|
|
199
200
|
# Try to see if the inclusion is a regex, and if it matches
|
data/lib/inspec/fetcher/local.rb
CHANGED
data/lib/inspec/input.rb
CHANGED
@@ -19,12 +19,17 @@ module Inspec
|
|
19
19
|
attr_accessor :input_name
|
20
20
|
attr_accessor :input_value
|
21
21
|
attr_accessor :input_type
|
22
|
+
attr_accessor :input_pattern
|
22
23
|
end
|
23
24
|
|
24
25
|
class TypeError < Error
|
25
26
|
attr_accessor :input_type
|
26
27
|
end
|
27
28
|
|
29
|
+
class PatternError < Error
|
30
|
+
attr_accessor :input_pattern
|
31
|
+
end
|
32
|
+
|
28
33
|
class RequiredError < Error
|
29
34
|
attr_accessor :input_name
|
30
35
|
end
|
@@ -56,7 +61,6 @@ module Inspec
|
|
56
61
|
|
57
62
|
def initialize(properties = {})
|
58
63
|
@value_has_been_set = false
|
59
|
-
|
60
64
|
properties.each do |prop_name, prop_value|
|
61
65
|
if EVENT_PROPERTIES.include? prop_name
|
62
66
|
# OK, save the property
|
@@ -174,7 +178,7 @@ module Inspec
|
|
174
178
|
# are free to go higher.
|
175
179
|
DEFAULT_PRIORITY_FOR_VALUE_SET = 60
|
176
180
|
|
177
|
-
attr_reader :description, :events, :identifier, :name, :required, :sensitive, :title, :type
|
181
|
+
attr_reader :description, :events, :identifier, :name, :required, :sensitive, :title, :type, :pattern
|
178
182
|
|
179
183
|
def initialize(name, options = {})
|
180
184
|
@name = name
|
@@ -192,7 +196,6 @@ module Inspec
|
|
192
196
|
# debugging record of when and how the value changed.
|
193
197
|
@events = []
|
194
198
|
events.push make_creation_event(options)
|
195
|
-
|
196
199
|
update(options)
|
197
200
|
end
|
198
201
|
|
@@ -213,6 +216,7 @@ module Inspec
|
|
213
216
|
def update(options)
|
214
217
|
_update_set_metadata(options)
|
215
218
|
normalize_type_restriction!
|
219
|
+
normalize_pattern_restriction!
|
216
220
|
|
217
221
|
# Values are set by passing events in; but we can also infer an event.
|
218
222
|
if options.key?(:value) || options.key?(:default)
|
@@ -227,6 +231,7 @@ module Inspec
|
|
227
231
|
events << options[:event] if options.key? :event
|
228
232
|
|
229
233
|
enforce_type_restriction!
|
234
|
+
enforce_pattern_restriction!
|
230
235
|
end
|
231
236
|
|
232
237
|
# We can determine a value:
|
@@ -268,6 +273,7 @@ module Inspec
|
|
268
273
|
@identifier = options[:identifier] if options.key?(:identifier) # TODO: determine if this is ever used
|
269
274
|
@type = options[:type] if options.key?(:type)
|
270
275
|
@sensitive = options[:sensitive] if options.key?(:sensitive)
|
276
|
+
@pattern = options[:pattern] if options.key?(:pattern)
|
271
277
|
end
|
272
278
|
|
273
279
|
def make_creation_event(options)
|
@@ -310,7 +316,9 @@ module Inspec
|
|
310
316
|
file: location.path,
|
311
317
|
line: location.lineno
|
312
318
|
)
|
319
|
+
|
313
320
|
enforce_type_restriction!
|
321
|
+
enforce_pattern_restriction!
|
314
322
|
end
|
315
323
|
|
316
324
|
def value
|
@@ -324,7 +332,7 @@ module Inspec
|
|
324
332
|
|
325
333
|
def to_hash
|
326
334
|
as_hash = { name: name, options: {} }
|
327
|
-
%i{description title identifier type required value sensitive}.each do |field|
|
335
|
+
%i{description title identifier type required value sensitive pattern}.each do |field|
|
328
336
|
val = send(field)
|
329
337
|
next if val.nil?
|
330
338
|
|
@@ -407,6 +415,33 @@ module Inspec
|
|
407
415
|
@type = type_req
|
408
416
|
end
|
409
417
|
|
418
|
+
def enforce_pattern_restriction!
|
419
|
+
return unless pattern
|
420
|
+
return unless has_value?
|
421
|
+
|
422
|
+
string_value = current_value(false).to_s
|
423
|
+
|
424
|
+
valid_pattern = string_value.match?(pattern)
|
425
|
+
unless valid_pattern
|
426
|
+
error = Inspec::Input::ValidationError.new
|
427
|
+
error.input_name = @name
|
428
|
+
error.input_value = string_value
|
429
|
+
error.input_pattern = pattern
|
430
|
+
raise error, "Input '#{error.input_name}' with value '#{error.input_value}' does not validate to pattern '#{error.input_pattern}'."
|
431
|
+
end
|
432
|
+
end
|
433
|
+
|
434
|
+
def normalize_pattern_restriction!
|
435
|
+
return unless pattern
|
436
|
+
|
437
|
+
unless valid_regexp?(pattern)
|
438
|
+
error = Inspec::Input::PatternError.new
|
439
|
+
error.input_pattern = pattern
|
440
|
+
raise error, "Pattern '#{error.input_pattern}' is not a valid regex pattern."
|
441
|
+
end
|
442
|
+
@pattern = pattern
|
443
|
+
end
|
444
|
+
|
410
445
|
def valid_numeric?(value)
|
411
446
|
Float(value)
|
412
447
|
true
|
data/lib/inspec/objects/input.rb
CHANGED
@@ -20,7 +20,7 @@ module Inspec
|
|
20
20
|
|
21
21
|
def to_hash
|
22
22
|
as_hash = { name: name, options: {} }
|
23
|
-
%i{description title identifier type required value}.each do |field|
|
23
|
+
%i{description title identifier type required value pattern}.each do |field|
|
24
24
|
val = send(field)
|
25
25
|
next if val.nil?
|
26
26
|
|
@@ -117,6 +117,15 @@ module Inspec::Plugin::V2
|
|
117
117
|
# `inspec dosomething` => activate the :dosomething hook
|
118
118
|
activate_me ||= cli_args.include?(act.activator_name.to_s)
|
119
119
|
|
120
|
+
# Only one compliance command to be activated at one time.
|
121
|
+
# Since both commands are defined in the same class,
|
122
|
+
# activators were not getting fetched uniquely.
|
123
|
+
if cli_args.include?("automate") && act.activator_name.to_s.eql?("compliance")
|
124
|
+
activate_me = false
|
125
|
+
elsif cli_args.include?("compliance") && act.activator_name.to_s.eql?("automate")
|
126
|
+
activate_me = false
|
127
|
+
end
|
128
|
+
|
120
129
|
# OK, activate.
|
121
130
|
if activate_me
|
122
131
|
act.activate
|
data/lib/inspec/reporters/cli.rb
CHANGED
@@ -41,12 +41,14 @@ module Inspec::Reporters
|
|
41
41
|
MULTI_TEST_CONTROL_SUMMARY_MAX_LEN = 60
|
42
42
|
|
43
43
|
def render
|
44
|
+
@src_extent_map = {}
|
44
45
|
run_data[:profiles].each do |profile|
|
45
46
|
if profile[:status] == "skipped"
|
46
47
|
platform = run_data[:platform]
|
47
48
|
output("Skipping profile: '#{profile[:name]}' on unsupported platform: '#{platform[:name]}/#{platform[:release]}'.")
|
48
49
|
next
|
49
50
|
end
|
51
|
+
read_control_source(profile)
|
50
52
|
@control_count = 0
|
51
53
|
output("")
|
52
54
|
print_profile_header(profile)
|
@@ -89,6 +91,7 @@ module Inspec::Reporters
|
|
89
91
|
next if control.results.nil?
|
90
92
|
|
91
93
|
output(format_control_header(control))
|
94
|
+
output(format_control_source(control)) if Inspec::Config.cached[:reporter_include_source]
|
92
95
|
control.results.each do |result|
|
93
96
|
output(format_result(control, result, :standard))
|
94
97
|
@control_count += 1
|
@@ -127,6 +130,62 @@ module Inspec::Reporters
|
|
127
130
|
)
|
128
131
|
end
|
129
132
|
|
133
|
+
def format_control_source(control)
|
134
|
+
src = @control_source[control.id]
|
135
|
+
message = "Control Source from #{src[:path]}:#{src[:start]}..#{src[:end]}\n"
|
136
|
+
message += src[:content]
|
137
|
+
format_message(
|
138
|
+
color: "skipped",
|
139
|
+
indentation: 5,
|
140
|
+
message: message
|
141
|
+
)
|
142
|
+
end
|
143
|
+
|
144
|
+
def read_control_source(profile)
|
145
|
+
return unless Inspec::Config.cached[:reporter_include_source]
|
146
|
+
|
147
|
+
@control_source = {}
|
148
|
+
src_extent_map = {}
|
149
|
+
|
150
|
+
# First pass: build map of paths => ids => [start]
|
151
|
+
all_unique_controls.each do |control|
|
152
|
+
id = control[:id]
|
153
|
+
path = control[:source_location][:ref]
|
154
|
+
start = control[:source_location][:line]
|
155
|
+
next if path.nil? || start.nil?
|
156
|
+
|
157
|
+
src_extent_map[path] ||= []
|
158
|
+
src_extent_map[path] << { start: start, id: id }
|
159
|
+
end
|
160
|
+
|
161
|
+
# Now sort the controls by their starting line in their control file
|
162
|
+
src_extent_map.values.each do |extent_list|
|
163
|
+
extent_list.sort! { |a, b| a[:start] <=> b[:start] }
|
164
|
+
end
|
165
|
+
|
166
|
+
# Third pass: Read in files and split into lines
|
167
|
+
src_extent_map.keys.each do |path|
|
168
|
+
control_file_lines = File.read(path).lines # TODO error handling
|
169
|
+
last_line_in_file = control_file_lines.count
|
170
|
+
extent_list = src_extent_map[path]
|
171
|
+
extent_list.each_with_index do |extent, idx|
|
172
|
+
if idx == extent_list.count - 1 # Last entry
|
173
|
+
extent[:end] = last_line_in_file
|
174
|
+
else
|
175
|
+
extent[:end] = extent_list[idx + 1][:start] - 1
|
176
|
+
end
|
177
|
+
|
178
|
+
@control_source[extent[:id]] =
|
179
|
+
{
|
180
|
+
path: path,
|
181
|
+
start: extent[:start],
|
182
|
+
end: extent[:end],
|
183
|
+
content: control_file_lines.slice(extent[:start] - 1, extent[:end] - extent[:start] + 1).join(""),
|
184
|
+
}
|
185
|
+
end
|
186
|
+
end
|
187
|
+
end
|
188
|
+
|
130
189
|
def format_result(control, result, type)
|
131
190
|
impact = control.impact_string_for_result(result)
|
132
191
|
|
@@ -312,6 +371,10 @@ module Inspec::Reporters
|
|
312
371
|
data[:impact]
|
313
372
|
end
|
314
373
|
|
374
|
+
def source_location
|
375
|
+
data[:source_location]
|
376
|
+
end
|
377
|
+
|
315
378
|
def anonymous?
|
316
379
|
id.start_with?("(generated from ")
|
317
380
|
end
|
data/lib/inspec/resources.rb
CHANGED
@@ -103,6 +103,7 @@ require "inspec/resources/rabbitmq_config"
|
|
103
103
|
require "inspec/resources/registry_key"
|
104
104
|
require "inspec/resources/security_identifier"
|
105
105
|
require "inspec/resources/security_policy"
|
106
|
+
require "inspec/resources/selinux"
|
106
107
|
require "inspec/resources/service"
|
107
108
|
require "inspec/resources/shadow"
|
108
109
|
require "inspec/resources/ssh_config"
|
@@ -31,17 +31,11 @@ module Inspec::Resources
|
|
31
31
|
end
|
32
32
|
|
33
33
|
@command = cmd
|
34
|
-
|
35
|
-
cli_timeout = Inspec::Config.cached["command_timeout"].to_i
|
34
|
+
cli_timeout = Inspec::Config.cached["command_timeout"]&.to_i
|
36
35
|
# Can access this via Inspec::InspecCLI.commands["exec"].options[:command_timeout].default,
|
37
36
|
# but that may not be loaded for kitchen-inspec and other pure gem consumers
|
38
|
-
|
39
|
-
|
40
|
-
if cli_timeout != default_cli_timeout
|
41
|
-
@timeout = cli_timeout
|
42
|
-
else
|
43
|
-
@timeout = options[:timeout]&.to_i || default_cli_timeout
|
44
|
-
end
|
37
|
+
cli_timeout = nil if cli_timeout == 0 # Under test-kitchen we get a 0 timeout, which can't be a resonable value
|
38
|
+
@timeout = cli_timeout || options[:timeout]&.to_i
|
45
39
|
|
46
40
|
if options[:redact_regex]
|
47
41
|
unless options[:redact_regex].is_a?(Regexp)
|
@@ -49,10 +49,11 @@ module Inspec::Resources
|
|
49
49
|
|
50
50
|
filter = FilterTable.create
|
51
51
|
filter.register_custom_matcher(:exists?) { |x| !x.entries.empty? }
|
52
|
-
filter.register_column(:names,
|
53
|
-
.register_column(:gids,
|
54
|
-
.register_column(:domains,
|
55
|
-
.register_column(:members,
|
52
|
+
filter.register_column(:names, field: "name")
|
53
|
+
.register_column(:gids, field: "gid")
|
54
|
+
.register_column(:domains, field: "domain")
|
55
|
+
.register_column(:members, field: "members", style: :simple)
|
56
|
+
.register_column(:members_array, field: "members_array", style: :simple)
|
56
57
|
filter.install_filter_methods_on_resource(self, :collect_group_details)
|
57
58
|
|
58
59
|
def to_s
|
@@ -63,7 +64,13 @@ module Inspec::Resources
|
|
63
64
|
|
64
65
|
# collects information about every group
|
65
66
|
def collect_group_details
|
66
|
-
|
67
|
+
unless @group_provider.nil?
|
68
|
+
modified_groups_info = @group_provider.groups
|
69
|
+
unless modified_groups_info.empty?
|
70
|
+
modified_groups_info.each { |hashmap| hashmap["members_array"] = hashmap["members"].is_a?(Array) ? hashmap["members"] : hashmap["members"]&.split(",") }
|
71
|
+
end
|
72
|
+
return @groups_cache ||= modified_groups_info
|
73
|
+
end
|
67
74
|
|
68
75
|
[]
|
69
76
|
end
|
@@ -111,7 +118,11 @@ module Inspec::Resources
|
|
111
118
|
end
|
112
119
|
|
113
120
|
def members
|
114
|
-
flatten_entry(group_info, "members")
|
121
|
+
flatten_entry(group_info, "members") || empty_value_for_members
|
122
|
+
end
|
123
|
+
|
124
|
+
def members_array
|
125
|
+
flatten_entry(group_info, "members_array") || []
|
115
126
|
end
|
116
127
|
|
117
128
|
def local
|
@@ -141,6 +152,10 @@ module Inspec::Resources
|
|
141
152
|
group = @group.dup
|
142
153
|
@groups_cache ||= inspec.groups.where { name == group }
|
143
154
|
end
|
155
|
+
|
156
|
+
def empty_value_for_members
|
157
|
+
inspec.os.windows? ? [] : ""
|
158
|
+
end
|
144
159
|
end
|
145
160
|
|
146
161
|
class GroupInfo
|