inspec-core 5.12.2 → 5.18.14

data/lib/inspec/resources/interface.rb

@@ -83,6 +83,10 @@ module Inspec::Resources
       interface_info && Array(interface_info[:ipv6_addresses])
     end
 
+    def resource_id
+      @iface || "Interface"
+    end
+
     def to_s
       "Interface #{@iface}"
     end

data/lib/inspec/resources/ip6tables.rb

@@ -62,6 +62,10 @@ module Inspec::Resources
       @ip6tables_cache = cmd.stdout.split("\n").map(&:strip)
     end
 
+    def resource_id
+      format("Ip6tables %s %s", @table && "table: #{@table}", @chain && "chain: #{@chain}").strip
+    end
+
     def to_s
       format("Ip6tables %s %s", @table && "table: #{@table}", @chain && "chain: #{@chain}").strip
     end

data/lib/inspec/resources/ipfilter.rb

@@ -42,6 +42,10 @@ module Inspec::Resources
       @ipfilter_cache = cmd.stdout.split("\n").map(&:strip)
     end
 
+    def resource_id
+      "Ipfilter"
+    end
+
     def to_s
       "Ipfilter"
     end

data/lib/inspec/resources/ipnat.rb

@@ -41,6 +41,10 @@ module Inspec::Resources
       @ipnat_cache = cmd.stdout.split("\n").map(&:strip)
     end
 
+    def resource_id
+      "Ipnat"
+    end
+
     def to_s
       "Ipnat"
     end

data/lib/inspec/resources/iptables.rb

@@ -69,6 +69,10 @@ module Inspec::Resources
       end
     end
 
+    def resource_id
+      format("Iptables %s %s", @table && "table: #{@table}", @chain && "chain: #{@chain}").strip
+    end
+
     def to_s
       format("Iptables %s %s", @table && "table: #{@table}", @chain && "chain: #{@chain}").strip
     end

data/lib/inspec/resources/json.rb

@@ -59,6 +59,10 @@ module Inspec::Resources
       extract_value(key, params)
     end
 
+    def resource_id
+      @resource_name_supplement || "#{resource_base_name}'s content"
+    end
+
     def to_s
       "#{resource_base_name} #{@resource_name_supplement || "content"}"
     end

data/lib/inspec/resources/kernel_module.rb

@@ -69,6 +69,10 @@ module Inspec::Resources
       cmd.exit_status == 0 ? cmd.stdout.delete("\n") : nil
     end
 
+    def resource_id
+      @module || "Kernel Module"
+    end
+
     def to_s
       "Kernel Module #{@module}"
     end

data/lib/inspec/resources/kernel_parameter.rb

@@ -29,6 +29,10 @@ module Inspec::Resources
       cmd
     end
 
+    def resource_id
+      @parameter || "Kernel Parameter"
+    end
+
     def to_s
       "Kernel Parameter #{@parameter}"
     end

data/lib/inspec/resources/key_rsa.rb

@@ -59,6 +59,10 @@ module Inspec::Resources
       @key.public_key.n.num_bytes * 8
     end
 
+    def resource_id
+      @key_path || "RSA Key"
+    end
+
     def to_s
       "rsa_key #{@key_path}"
     end

data/lib/inspec/resources/ksh.rb

@@ -26,6 +26,10 @@ module Inspec::Resources
       super(CommandWrapper.wrap(command, options))
     end
 
+    def resource_id
+      @raw_command || "Kornshell command"
+    end
+
     def to_s
       "KornShell command #{@raw_command}"
     end

data/lib/inspec/resources/limits_conf.rb

@@ -38,6 +38,10 @@ module Inspec::Resources
       @params = conf.params
     end
 
+    def resource_id
+      @conf_path
+    end
+
     def to_s
       "limits.conf"
     end

data/lib/inspec/resources/linux_audit_system.rb

@@ -0,0 +1,81 @@
+require "inspec/resources/command"
+module Inspec::Resources
+  class LinuxAuditSystem < Inspec.resource(1)
+    # Resource's internal name.
+    name "linux_audit_system"
+
+    # Restrict to only run on the below platforms (if none were given,
+    # all OS's and cloud API's supported)
+    supports platform: "linux"
+
+    desc "Use the `linux_audit_system` Chef InSpec audit resource to test the configuration of linux audit system."
+
+    example <<~EXAMPLE
+      describe linux_audit_system do
+        it { should be_enabled }
+        it { should be_running }
+        its("rules") { should include "-w /etc -p wa" }
+        its("rules") { should include %r{-w /etc -p wa} }
+        its("rules") { should include %r!-w /etc -p wa! }
+      end
+    EXAMPLE
+
+    attr_reader :auditctl_utility
+
+    # Resource initialization.
+    def initialize
+      skip_resource "The `linux_audit_system` resource is not yet available on your OS." unless inspec.os.linux?
+      @auditctl_utility = find_auditctl_or_error
+    end
+
+    # Resource appearance in test reports.
+    def to_s
+      "linux_audit_system"
+    end
+
+    # The be_enabled matcher checks if the auditing is enabled.
+    # The enabled flag 1 indicates that the auditing is enabled.
+    def enabled?
+      auditctl_cmd = inspec.command("#{auditctl_utility} -s | grep enabled")
+
+      raise Inspec::Exceptions::ResourceFailed, "Executing #{auditctl_utility} -s | grep enabled failed: #{auditctl_cmd.stderr}" if auditctl_cmd.exit_status.to_i != 0
+
+      # Sample stdout: enabled 1
+      auditctl_enabled_status = auditctl_cmd.stdout.strip.split
+      auditctl_enabled_status[1].to_i == 1
+    end
+
+    # The be_running matcher checks if the audit daemon is running.
+    # A pid of 0 indicates that the audit daemon is not running.
+    def running?
+      auditctl_cmd = inspec.command("#{auditctl_utility} -s | grep pid")
+
+      raise Inspec::Exceptions::ResourceFailed, "Executing #{auditctl_utility} -s | grep enabled failed: #{auditctl_cmd.stderr}" if auditctl_cmd.exit_status.to_i != 0
+
+      # Sample stdout: pid 682462
+      auditctl_running_status = auditctl_cmd.stdout.strip.split
+      !auditctl_running_status[1].nil? && auditctl_running_status[1].to_i != 0
+    end
+
+    # The rules property returns the array of audit rules obtained on auditctl -l.
+    # The auditctl -l list all rules, 1 per line.
+    def rules
+      auditctl_cmd = inspec.command("#{auditctl_utility} -l")
+
+      raise Inspec::Exceptions::ResourceFailed, "Executing #{auditctl_utility} -l: #{auditctl_cmd.stderr}" if auditctl_cmd.exit_status.to_i != 0
+
+      auditctl_cmd.stdout.strip.split("\n")
+    end
+
+    private
+
+    # Check if auditctl is available on the system.
+    def find_auditctl_or_error
+      %w{/usr/sbin/auditctl /sbin/auditctl auditctl}.each do |cmd|
+        return cmd if inspec.command(cmd).exist?
+      end
+
+      raise Inspec::Exceptions::ResourceFailed, "Could not find `auditctl`. This resource requires `auditctl` utility to be available on the system."
+    end
+  end
+end

data/lib/inspec/resources/login_defs.rb

@@ -49,6 +49,10 @@ module Inspec::Resources
       @params = conf.params
     end
 
+    def resource_id
+      @conf_path
+    end
+
     def to_s
       "login.defs"
     end

data/lib/inspec/resources/mongodb.rb

@@ -19,6 +19,10 @@ module Inspec::Resources
       end
     end
 
+    def resource_id
+      @conf_path
+    end
+
     def to_s
       "MongoDB"
     end

data/lib/inspec/resources/mongodb_conf.rb

@@ -24,6 +24,11 @@ module Inspec::Resources
       super(@conf_path)
     end
 
+    # set resource_id to "" if system is not able to determine the @conf_path
+    def resource_id
+      @conf_path || "mongodb_conf"
+    end
+
     private
 
     def parse(content)

data/lib/inspec/resources/mongodb_session.rb

@@ -4,9 +4,10 @@ module Inspec::Resources
   class Lines
     attr_reader :params
 
-    def initialize(raw, desc)
+    def initialize(raw, desc, exit_status = nil)
       @params = raw
       @desc = desc
+      @exit_status = exit_status
     end
 
     def to_s
@@ -62,6 +63,10 @@ module Inspec::Resources
       raise Inspec::Exceptions::ResourceFailed, "Can't run MongoDB command Error: #{e.message}"
     end
 
+    def resource_id
+      "mongodb_session:User:#{@user}:Host:#{@host}:Database:#{@database}"
+    end
+
     private
 
     def create_session

data/lib/inspec/resources/mount.rb

@@ -51,6 +51,10 @@ module Inspec::Resources
       @mount_options[name]
     end
 
+    def resource_id
+      @path || "mount"
+    end
+
     def to_s
       "Mount #{@path}"
     end

data/lib/inspec/resources/mssql_session.rb

@@ -80,6 +80,10 @@ module Inspec::Resources
       end
     end
 
+    def resource_id
+      "mssql_session:User:#{@user}:Host:#{@host}:Database:#{@db_name}:Instance:#{@instance}"
+    end
+
     def to_s
       "MSSQL session"
     end

data/lib/inspec/resources/mssql_sys_conf.rb

@@ -19,6 +19,8 @@ module Inspec::Resources
     attr_reader :mssql_session, :sql_query
 
     def initialize(conf_param_name, opts = {})
+      @conf_param_name = conf_param_name
+      @opts = opts
       opts[:username] ||= "SA"
       @mssql_session = inspec.mssql_session(opts)
       setting = conf_param_name.to_s.gsub("_", " ").split.map(&:capitalize).join(" ")
@@ -37,6 +39,11 @@ module Inspec::Resources
       "MsSql DB Configuration"
     end
 
+    def resource_id
+      username = @opts[:username] || "SA"
+      "#{@conf_param_name}-#{username}"
+    end
+
     private
 
     def determine_system_configurations(setting)

data/lib/inspec/resources/mysql_conf.rb

@@ -121,6 +121,10 @@ module Inspec::Resources
       @files_contents[path] ||= read_file_content(path)
     end
 
+    def resource_id
+      @conf_path || "mysql_conf"
+    end
+
     def to_s
       "MySQL Configuration"
     end

data/lib/inspec/resources/mysql_session.rb

@@ -43,6 +43,7 @@ module Inspec::Resources
       @host = host
       @port = port
       @socket = socket
+      @db = nil
       init_fallback if user.nil? || pass.nil?
       raise Inspec::Exceptions::ResourceFailed, "Can't run MySQL SQL checks without authentication." if @user.nil? || @pass.nil?
 
@@ -52,7 +53,9 @@ module Inspec::Resources
     def query(q, db = "")
       raise Inspec::Exceptions::ResourceFailed, "#{resource_exception_message}" if resource_failed?
 
-      mysql_cmd = create_mysql_cmd(q, db)
+      @db = db
+      mysql_cmd = create_mysql_cmd(q, @db)
+
       cmd = if !@pass.nil?
               inspec.command(mysql_cmd, redact_regex: /(mysql -u\w+ -p).+(\s-(h|S).*)/)
             else
@@ -66,6 +69,10 @@ module Inspec::Resources
       end
     end
 
+    def resource_id
+      "mysql_session:User:#{@user}:Host:#{@host}:Database:#{@db}"
+    end
+
     def to_s
       "MySQL Session"
     end

data/lib/inspec/resources/nginx.rb

@@ -18,12 +18,13 @@ module Inspec::Resources
         its('modules') { should include 'my_module' }
       end
     EXAMPLE
-    attr_reader :params, :bin_dir
+    attr_reader :params, :bin_dir, :nginx_path
 
     def initialize(nginx_path = "/usr/sbin/nginx")
       return skip_resource "The `nginx` resource is not yet available on your OS." if inspec.os.windows?
       return skip_resource "The `nginx` binary not found in the path provided." unless inspec.command(nginx_path).exist?
 
+      @nginx_path = nginx_path
       cmd = inspec.command("#{nginx_path} -V 2>&1")
       if cmd.exit_status != 0
         return skip_resource "Error using the command nginx -V"
@@ -59,6 +60,10 @@ module Inspec::Resources
       @data.scan(/--with-(\S+)_module/).flatten
     end
 
+    def resource_id
+      nginx_path || "nginx"
+    end
+
     def to_s
       "Nginx Environment"
     end

data/lib/inspec/resources/nginx_conf.rb

@@ -50,6 +50,10 @@ module Inspec::Resources
 
     def_delegators :http, :servers, :locations
 
+    def resource_id
+      @conf_path || "nginx_conf"
+    end
+
     def to_s
       "nginx_conf #{@conf_path}"
     end

data/lib/inspec/resources/noop.rb

@@ -2,6 +2,10 @@ module Inspec::Resources
   class Noop < Inspec.resource(1)
     name "noop"
 
+    def resource_id
+      "No-op"
+    end
+
     def to_s
       "No-op"
     end

data/lib/inspec/resources/npm.rb

@@ -61,6 +61,10 @@ module Inspec::Resources
       info[:version]
     end
 
+    def resource_id
+      @package_name || "npm"
+    end
+
     def to_s
       "Npm Package #{@package_name}"
     end

data/lib/inspec/resources/ntp_conf.rb

@@ -30,6 +30,10 @@ module Inspec::Resources
       param
     end
 
+    def resource_id
+      @conf_path || "ntp_conf"
+    end
+
     def to_s
       "ntp.conf"
     end

data/lib/inspec/resources/oneget.rb

@@ -64,6 +64,10 @@ module Inspec::Resources
       info[:version]
     end
 
+    def resource_id
+      @package_name || "oneget"
+    end
+
     def to_s
       "OneGet Package #{@package_name}"
     end

data/lib/inspec/resources/opa_api.rb

@@ -6,6 +6,12 @@ module Inspec::Resources
     supports platform: "unix"
     supports platform: "windows"
 
+    example <<~EXAMPLE
+      describe opa_api(url: "localhost:8181/v1/data/example/violation", data: "input.json") do
+        its(["result"]) { should eq 'value' }
+      end
+    EXAMPLE
+
     def initialize(opts = {})
       @url = opts[:url] || nil
       @data = opts[:data] || nil
@@ -18,6 +24,10 @@ module Inspec::Resources
       @content["result"]
     end
 
+    def resource_id
+      @url || "opa_api"
+    end
+
     def to_s
       "OPA api"
     end

data/lib/inspec/resources/opa_cli.rb

@@ -6,6 +6,12 @@ module Inspec::Resources
     supports platform: "unix"
     supports platform: "windows"
 
+    example <<~EXAMPLE
+      describe opa_cli(policy: "example.rego", data: "input.json", query: "data.example.allow") do
+        its(["result"]) { should eq "value" }
+      end
+    EXAMPLE
+
     def initialize(opts = {})
       @opa_executable_path = opts[:opa_executable_path] || "opa" # if this path is not provided then we will assume that it's been set in the ENV PATH
       @policy = opts[:policy] || nil
@@ -22,6 +28,14 @@ module Inspec::Resources
       @content["result"][0]["expressions"][0]["value"] if @content["result"][0]["expressions"][0]["text"].include?("allow")
     end
 
+    def resource_id
+      if @policy.nil? && @query.nil?
+        "opa_cli"
+      else
+        "#{@policy}:#{@query}"
+      end
+    end
+
     def to_s
       "OPA cli"
     end

data/lib/inspec/resources/oracledb_conf.rb

@@ -17,6 +17,7 @@ module Inspec::Resources
 
     def initialize(opts = {})
       @oracledb_session = inspec.oracledb_session(opts)
+      @opts = opts
     end
 
     def method_missing(name)
@@ -28,6 +29,10 @@ module Inspec::Resources
       "Oracle DB Configuration"
     end
 
+    def resource_id
+      @opts[:user] || ""
+    end
+
     private
 
     def determine_database_setting(setting)

data/lib/inspec/resources/oracledb_listener_conf.rb

@@ -73,6 +73,10 @@ module Inspec::Resources
       "Oracle Listener Configuration"
     end
 
+    def resource_id
+      @conf_path
+    end
+
     private
 
     def read_content

data/lib/inspec/resources/oracledb_session.rb

@@ -76,6 +76,16 @@ module Inspec::Resources
       "Oracle Session"
     end
 
+    def resource_id
+      if @user
+        "#{@host}-#{@port}-#{@user}"
+      elsif @su_user
+        "#{@host}-#{@port}-#{@su_user}"
+      else
+        ""
+      end
+    end
+
     private
 
     # 3 commands

data/lib/inspec/resources/os.rb

@@ -27,6 +27,10 @@ module Inspec::Resources
       end
     end
 
+    def resource_id
+      @platform.name || "OS"
+    end
+
     def to_s
       "Operating System Detection"
     end

data/lib/inspec/resources/os_env.rb

@@ -47,6 +47,10 @@ module Inspec::Resources
       @content = value_for(@osenv, @target) unless @osenv.nil?
     end
 
+    def resource_id
+      @osenv || ""
+    end
+
     def to_s
       if @osenv.nil?
         "Environment variables"

data/lib/inspec/resources/package.rb

@@ -96,6 +96,10 @@ module Inspec::Resources
       @latest_version ||= ( @pkgman.latest_version(@package_name) || info[:latest_version] )
     end
 
+    def resource_id
+      @package_name || "System Package"
+    end
+
     def to_s
       "System Package #{@package_name}"
     end

data/lib/inspec/resources/parse_config.rb

@@ -68,6 +68,10 @@ module Inspec::Resources
       end
     end
 
+    def resource_id
+      @content || "parse_config"
+    end
+
     def to_s
       "Parse Config #{@conf_path}"
     end
@@ -104,8 +108,13 @@ module Inspec::Resources
     EXAMPLE
 
     def initialize(path, opts = nil)
+      @path = path
       super(nil, opts)
-      parse_file(path)
+      parse_file(@path)
+    end
+
+    def resource_id
+      @path || "parse_config_file"
     end
 
     def to_s