inspec-core 4.49.0 → 4.56.17

data/lib/inspec/resources/selinux.rb

@@ -84,8 +84,13 @@ module Inspec::Resources
 
     def initialize(selinux_path = "/etc/selinux/config")
       @path = selinux_path
-      cmd = inspec.command("sestatus")
+      if inspec.os.redhat? && inspec.os.name == "amazon"
+        lcmd = "/usr/sbin/sestatus"
+      else
+        lcmd = "sestatus"
+      end
 
+      cmd = inspec.command(lcmd)
       if cmd.exit_status != 0
         # `sestatus` command not found error message comes in stdout so handling both here
         out = cmd.stdout + "\n" + cmd.stderr

data/lib/inspec/resources/service.rb

@@ -163,7 +163,12 @@ module Inspec::Resources
       when "mac_os_x", "darwin"
         LaunchCtl.new(inspec, service_ctl)
       when "freebsd"
-        BSDInit.new(inspec, service_ctl)
+        version = os[:release].to_f
+        if version < 10
+          BSDInit.new(inspec, service_ctl)
+        else
+          FreeBSD10Init.new(inspec, service_ctl)
+        end
       when "arch"
         Systemd.new(inspec, service_ctl)
       when "coreos"
@@ -186,6 +191,8 @@ module Inspec::Resources
         Svcs.new(inspec)
       when "yocto"
         Systemd.new(inspec, service_ctl)
+      when "alpine"
+        SysV.new(inspec, service_ctl)
       end
     end
 
@@ -478,6 +485,7 @@ module Inspec::Resources
 
   # @see: https://www.freebsd.org/doc/en/articles/linux-users/startup.html
   # @see: https://www.freebsd.org/cgi/man.cgi?query=rc.conf&sektion=5
+  # @see: https://www.freebsd.org/cgi/man.cgi?query=rc&apropos=0&sektion=8&manpath=FreeBSD+9.3-RELEASE&arch=default&format=html
   class BSDInit < ServiceManager
     def initialize(service_name, service_ctl = nil)
       @service_ctl = service_ctl || "service"
@@ -485,17 +493,20 @@ module Inspec::Resources
     end
 
     def info(service_name)
-      # check if service is enabled
-      # services are enabled in /etc/rc.conf and /etc/defaults/rc.conf
-      # via #{service_name}_enable="YES"
-      # service SERVICE status returns the following result if not activated:
-      #   Cannot 'status' sshd. Set sshd_enable to YES in /etc/rc.conf or use 'onestatus' instead of 'status'.
-      # gather all enabled services
+      # `service -e` lists all enabled services. Output format:
+      # % service -e
+      # /etc/rc.d/hostid
+      # /etc/rc.d/hostid_save
+      # /etc/rc.d/cleanvar
+      # /etc/rc.d/ip6addrctl
+      # /etc/rc.d/devd
+
       cmd = inspec.command("#{service_ctl} -e")
       return nil if cmd.exit_status != 0
 
       # search for the service
-      srv = /(^.*#{service_name}$)/.match(cmd.stdout)
+
+      srv = %r{^.*/(#{service_name}$)}.match(cmd.stdout)
       return nil if srv.nil? || srv[0].nil?
 
       enabled = true
@@ -516,6 +527,37 @@ module Inspec::Resources
     end
   end
 
+  # @see: https://www.freebsd.org/doc/en/articles/linux-users/startup.html
+  # @see: https://www.freebsd.org/cgi/man.cgi?query=rc.conf&sektion=5
+  # @see: https://www.freebsd.org/cgi/man.cgi?query=rc&apropos=0&sektion=8&manpath=FreeBSD+10.0-RELEASE&arch=default&format=html
+  class FreeBSD10Init < ServiceManager
+    def initialize(service_name, service_ctl = nil)
+      @service_ctl = service_ctl || "service"
+      super
+    end
+
+    def info(service_name)
+      # check if service is enabled
+      cmd = inspec.command("#{service_ctl} #{service_name} enabled")
+
+      enabled = cmd.exit_status == 0
+
+      # check if the service is running
+      # if the service is not available or not running, we always get an error code
+      cmd = inspec.command("#{service_ctl} #{service_name} onestatus")
+      running = cmd.exit_status == 0
+
+      {
+        name: service_name,
+        description: nil,
+        installed: true,
+        running: running,
+        enabled: enabled,
+        type: "bsd-init",
+      }
+    end
+  end
+
   class Runit < ServiceManager
     def initialize(service_name, service_ctl = nil)
       @service_ctl = service_ctl || "sv"
@@ -782,7 +824,14 @@ module Inspec::Resources
     EXAMPLE
 
     def select_service_mgmt
-      BSDInit.new(inspec, service_ctl)
+      os = inspec.os
+      version = os[:release].to_f
+
+      if version >= 10
+        FreeBSD10Init.new(inspec, service_ctl)
+      else
+        BSDInit.new(inspec, service_ctl)
+      end
     end
   end
 

data/lib/inspec/resources/ssl.rb

@@ -38,6 +38,7 @@ module Inspec::Resources
       "tls1.0",
       "tls1.1",
       "tls1.2",
+      "tls1.3",
     ].freeze
 
     attr_reader :host, :port, :timeout, :retries
@@ -72,6 +73,11 @@ module Inspec::Resources
             protocol: proto, ciphers: e.map(&:cipher),
             timeout: x.resource.timeout, retries: x.resource.retries, servername: x.resource.host)]
         end
+
+        if !res[0].empty? && res[0][1].key?("error") && res[0][1]["error"].include?("Connection error Errno::ECONNREFUSED")
+          raise "#{res[0][1]["error"]}"
+        end
+
         Hash[res]
       end
       .install_filter_methods_on_resource(self, :scan_config)
@@ -89,6 +95,7 @@ module Inspec::Resources
         { "protocol" => "tls1.0", "ciphers" => SSLShake::TLS::TLS10_CIPHERS.keys },
         { "protocol" => "tls1.1", "ciphers" => SSLShake::TLS::TLS10_CIPHERS.keys },
         { "protocol" => "tls1.2", "ciphers" => SSLShake::TLS::TLS_CIPHERS.keys },
+        { "protocol" => "tls1.3", "ciphers" => SSLShake::TLS::TLS13_CIPHERS.keys },
       ].map do |line|
         line["ciphers"].map do |cipher|
           { "protocol" => line["protocol"], "cipher" => cipher }

data/lib/inspec/resources/timezone.rb

@@ -0,0 +1,65 @@
+require "inspec/resources/command"
+
+module Inspec::Resources
+  class TimeZone < Cmd
+    name "timezone"
+    supports platform: "unix"
+    supports platform: "windows"
+
+    desc "Check for timezone configurations"
+    example <<~EXAMPLE
+      describe timezone do
+        its('identifier') { should eq 'Asia/Kolkata' }
+        its('name') { should eq 'IST' }
+        its('time_offset') { should eq '+0530' }
+      end
+    EXAMPLE
+
+    def initialize
+      @output = {}
+      os = inspec.os
+      cmd = if os.windows?
+              inspec.command("Get-TimeZone")
+            else
+              inspec.command("timedatectl status | grep -i 'Time zone'")
+            end
+      if cmd.exit_status != 0
+        raise Inspec::Exceptions::ResourceFailed, "Time Zone resource with error: #{cmd.stderr}"
+      else
+        if os.windows?
+          splitted_output = cmd.stdout.strip.gsub(/\r/, "").split("\n").select { |out| (out.include? "Id") || (out.include? "DisplayName") || (out.include? "BaseUtcOffset") }
+          @output["identifier"]  = split_and_fetch_last(splitted_output[1])
+          @output["name"]        = split_and_fetch_last(splitted_output[0])
+          @output["time_offset"] = split_and_fetch_last(splitted_output[2])
+        else
+          splitted_output = cmd.stdout.split(":")[-1]&.strip&.gsub(/[(),^]*/, "")&.split(" ") || []
+          @output["identifier"]  = splitted_output[0]
+          @output["name"]        = splitted_output[1]
+          @output["time_offset"] = splitted_output[2]
+        end
+      end
+    end
+
+    def identifier
+      @output["identifier"]
+    end
+
+    def name
+      @output["name"]
+    end
+
+    def time_offset
+      @output["time_offset"]
+    end
+
+    def to_s
+      "Time Zone resource"
+    end
+
+    private
+
+    def split_and_fetch_last(string_value)
+      string_value.split(" :")[-1].strip
+    end
+  end
+end

data/lib/inspec/resources.rb

@@ -41,6 +41,7 @@ require "inspec/resources/cassandradb_session"
 require "inspec/resources/cassandradb_conf"
 require "inspec/resources/cassandra"
 require "inspec/resources/crontab"
+require "inspec/resources/timezone"
 require "inspec/resources/dh_params"
 require "inspec/resources/directory"
 require "inspec/resources/docker"
@@ -72,6 +73,7 @@ require "inspec/resources/ip6tables"
 require "inspec/resources/iptables"
 require "inspec/resources/kernel_module"
 require "inspec/resources/kernel_parameter"
+require "inspec/resources/kernel_parameters"
 require "inspec/resources/key_rsa"
 require "inspec/resources/ksh"
 require "inspec/resources/limits_conf"

data/lib/inspec/runner_rspec.rb

@@ -123,6 +123,8 @@ module Inspec
     def set_optional_formatters
       return if @conf["reporter"].nil?
 
+      # This is a slightly modified version of the default RSpec JSON formatter
+      # No one in their right mind should be using this because we have a much better JSON reporter - named "json"
       if @conf["reporter"].key?("json-rspec")
         # We cannot pass in a nil output path. Rspec only accepts a valid string or a IO object.
         if @conf["reporter"]["json-rspec"]&.[]("file").nil?
@@ -133,6 +135,7 @@ module Inspec
         @conf["reporter"].delete("json-rspec")
       end
 
+      # These are built-in to rspec
       formats = @conf["reporter"].select { |k, _v| %w{documentation progress html}.include?(k) }
       formats.each do |k, v|
         # We cannot pass in a nil output path. Rspec only accepts a valid string or a IO object.
@@ -143,6 +146,33 @@ module Inspec
         end
         @conf["reporter"].delete(k)
       end
+
+      # Here we need to look for reporter names in the reporter option that
+      # are names of streaming reporter plugins. We load them, then tell RSpec to add them as formatters.
+      # They will have already been detected at this point (see v2_loader.load_all in cli.rb)
+      # but they will not be activated activated at this point.
+      # then list all plugins by type by name
+      reg = Inspec::Plugin::V2::Registry.instance
+      streaming_reporters = reg\
+        .find_activators(plugin_type: :streaming_reporter)\
+        .map(&:activator_name).map(&:to_s)
+
+      @conf["reporter"].each do |streaming_reporter_name, file_target|
+        # It could be a non-streaming reporter
+        next unless streaming_reporters.include? streaming_reporter_name
+
+        # Activate the plugin so the formatter ID gets registered with RSpec, presumably
+        activator = reg.find_activator(plugin_type: :streaming_reporter, activator_name: streaming_reporter_name.to_sym)
+        activator.activate!
+
+        # We cannot pass in a nil output path. Rspec only accepts a valid string or a IO object.
+        if file_target&.[]("file").nil?
+          RSpec.configuration.add_formatter(activator.implementation_class)
+        else
+          RSpec.configuration.add_formatter(activator.implementation_class, file_target["file"])
+        end
+        @conf["reporter"].delete(streaming_reporter_name)
+      end
     end
 
     # Configure the output formatter and stream to be used with RSpec.

data/lib/inspec/utils/filter.rb

@@ -114,6 +114,7 @@ module FilterTable
         raise(ArgumentError, "'#{decorate_symbols(raw_field_name)}' is not a recognized criterion - expected one of #{decorate_symbols(list_fields).join(", ")}'") unless field?(raw_field_name)
 
         populate_lazy_field(raw_field_name, desired_value) if is_field_lazy?(raw_field_name)
+        populate_lazy_instance_field(raw_field_name, desired_value) if is_field_lazy_instance?(raw_field_name)
         new_criteria_string += " #{raw_field_name} == #{desired_value.inspect}"
         filtered_raw_data = filter_raw_data(filtered_raw_data, raw_field_name, desired_value)
       end
@@ -188,6 +189,8 @@ module FilterTable
       is_field ||= list_fields.include?(proposed_field.to_sym)
       is_field ||= is_field_lazy?(proposed_field.to_s)
       is_field ||= is_field_lazy?(proposed_field.to_sym)
+      is_field ||= is_field_lazy_instance?(proposed_field.to_s)
+      is_field ||= is_field_lazy_instance?(proposed_field.to_sym)
 
       is_field
     end
@@ -210,6 +213,23 @@ module FilterTable
       mark_lazy_field_populated(field_name)
     end
 
+    def populate_lazy_instance_field(field_name, criterion)
+      return unless is_field_lazy_instance?(field_name)
+      return if field_populated?(field_name)
+
+      raw_data.each do |row|
+        next if row.key?(field_name) # skip row if pre-existing data is present
+
+        lazy_caller = callback_for_lazy_instance_field(field_name)
+        if lazy_caller.is_a?(Proc)
+          lazy_caller.call(row, criterion, resource_instance)
+        elsif lazy_caller.is_a?(Symbol)
+          resource_instance.send(lazy_caller, row, criterion, self)
+        end
+      end
+      mark_lazy_field_populated(field_name)
+    end
+
     def is_field_lazy?(sought_field_name)
       custom_properties_schema.values.any? do |property_struct|
         sought_field_name == property_struct.field_name && \
@@ -217,6 +237,13 @@ module FilterTable
       end
     end
 
+    def is_field_lazy_instance?(sought_field_name)
+      custom_properties_schema.values.any? do |property_struct|
+        sought_field_name == property_struct.field_name && \
+          property_struct.opts[:lazy_instance]
+      end
+    end
+
     def callback_for_lazy_field(field_name)
       return unless is_field_lazy?(field_name)
 
@@ -225,6 +252,14 @@ module FilterTable
       end.opts[:lazy]
     end
 
+    def callback_for_lazy_instance_field(field_name)
+      return unless is_field_lazy_instance?(field_name)
+
+      custom_properties_schema.values.find do |property_struct|
+        property_struct.field_name == field_name
+      end.opts[:lazy_instance]
+    end
+
     def field_populated?(field_name)
       @populated_lazy_columns[field_name]
     end
@@ -349,12 +384,18 @@ module FilterTable
       # args of the row struct; also the Struct class will already have provided
       # a setter for each field.
       @custom_properties.values.each do |property_info|
-        next unless property_info.opts[:lazy]
+        next unless property_info.opts[:lazy] || property_info.opts[:lazy_instance]
 
         field_name = property_info.field_name.to_sym
         row_eval_context_type.send(:define_method, field_name) do
           unless filter_table.field_populated?(field_name)
-            filter_table.populate_lazy_field(field_name, NoCriteriaProvided) # No access to criteria here
+            if property_info.opts[:lazy]
+              filter_table.populate_lazy_field(field_name, NoCriteriaProvided)
+            end # No access to criteria here
+            if property_info.opts[:lazy_instance]
+              filter_table.populate_lazy_instance_field(field_name,
+                                                        NoCriteriaProvided)
+            end
             # OK, the underlying raw data has the value in the first row
             # (because we would trigger population only on the first row)
             # We could just return the value, but we need to set it on this Struct in case it is referenced multiple times
@@ -449,7 +490,10 @@ module FilterTable
             result = where(nil)
             if custom_property_struct.opts[:lazy]
               result.populate_lazy_field(custom_property_struct.field_name, filter_criteria_value)
+            elsif custom_property_struct.opts[:lazy_instance]
+              result.populate_lazy_instance_field(custom_property_struct.field_name, filter_criteria_value)
             end
+
             result = where(nil).get_column_values(custom_property_struct.field_name) # TODO: the where(nil). is likely unneeded
             result = result.flatten.uniq.compact if custom_property_struct.opts[:style] == :simple
             result

data/lib/inspec/utils/run_data_filters.rb

@@ -65,7 +65,7 @@ module Inspec
             c[:results]&.each do |r|
               next unless r[:message] # :message only set on failure
 
-              pos = r[:message].index("\n\nDiff:")
+              pos = r[:message].index(/\n{1,2}Diff.*:/)
               next unless pos # Only textual tests get Diffs
 
               r[:message] = r[:message].slice(0, pos)

data/lib/inspec/version.rb

@@ -1,3 +1,3 @@
 module Inspec
-  VERSION = "4.49.0".freeze
+  VERSION = "4.56.17".freeze
 end

data/lib/plugins/inspec-compliance/lib/inspec-compliance/api.rb

@@ -84,7 +84,7 @@ module InspecPlugins
         return {} if data.nil? || data.empty?
 
         parsed = JSON.parse(data)
-        return {} unless parsed.key?("version") && !parsed["version"].empty?
+        return {} unless parsed.key?("build_timestamp") && !parsed["build_timestamp"].empty?
 
         parsed
       end

data/lib/plugins/inspec-compliance/lib/inspec-compliance/cli.rb

@@ -219,9 +219,10 @@ module InspecPlugins
       def version
         config = InspecPlugins::Compliance::Configuration.new
         info = InspecPlugins::Compliance::API.version(config)
-        if !info.nil? && info["version"]
-          puts "Name:    #{info["api"]}"
-          puts "Version: #{info["version"]}"
+        if !info.nil? && info["build_timestamp"]
+          # key info["api"] is not longer available in latest version api response
+          puts "Name: automate"
+          puts "Version: #{info["build_timestamp"]}"
         else
           puts "Could not determine server version."
           exit 1

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-core
 version: !ruby/object:Gem::Version
-  version: 4.49.0
+  version: 4.56.17
 platform: ruby
 authors:
 - Chef InSpec Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-10-25 00:00:00.000000000 Z
+date: 2022-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef-telemetry
@@ -117,7 +117,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.9'
-    - - "<"
+    - - "<="
       - !ruby/object:Gem::Version
         version: '3.11'
   type: :runtime
@@ -127,7 +127,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.9'
-    - - "<"
+    - - "<="
       - !ruby/object:Gem::Version
         version: '3.11'
 - !ruby/object:Gem::Dependency
@@ -479,6 +479,7 @@ files:
 - lib/inspec/plugin/v2/plugin_types/input.rb
 - lib/inspec/plugin/v2/plugin_types/mock.rb
 - lib/inspec/plugin/v2/plugin_types/reporter.rb
+- lib/inspec/plugin/v2/plugin_types/streaming_reporter.rb
 - lib/inspec/plugin/v2/registry.rb
 - lib/inspec/plugin/v2/status.rb
 - lib/inspec/profile.rb
@@ -554,6 +555,7 @@ files:
 - lib/inspec/resources/json.rb
 - lib/inspec/resources/kernel_module.rb
 - lib/inspec/resources/kernel_parameter.rb
+- lib/inspec/resources/kernel_parameters.rb
 - lib/inspec/resources/key_rsa.rb
 - lib/inspec/resources/ksh.rb
 - lib/inspec/resources/launchd_service.rb
@@ -619,6 +621,7 @@ files:
 - lib/inspec/resources/sys_info.rb
 - lib/inspec/resources/systemd_service.rb
 - lib/inspec/resources/sysv_service.rb
+- lib/inspec/resources/timezone.rb
 - lib/inspec/resources/toml.rb
 - lib/inspec/resources/upstart_service.rb
 - lib/inspec/resources/user.rb
@@ -788,7 +791,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.5'
+      version: '2.6'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="