inspec-core 3.0.9 → 3.0.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a431d03f25295c36b0f8794f4ffe8b171b92aad79359002e6e902f695e81a5d8
-  data.tar.gz: 75895f344a4112e743b6f0a71c012cd77ccf82c3fc864510635c9571ae477a33
+  metadata.gz: 4d7f25755317e631219a5c447f33cba097794330620601d137f8a9445c859f2c
+  data.tar.gz: 864647b41c81eaa85b3d397c7b8532a8d0f801ae4ede1ad2a2e225abbbeb982d
 SHA512:
-  metadata.gz: a02c188caf9e1e0ce8636de9ce71e69831df12fba7f2a1116c0086e4aaf7382b4d1f470f7bb80f988302eb8d18e52f65dab60c6ab39bf628b58fed4c1a334671
-  data.tar.gz: 7ae1264c8afdaf13c1582f7d91c3c34c6ba427483bc94103be00cf54f8ea1605f9fcc38f1a29c8a66f43d2f0d3ac92d707471b9abf613db88ba1960cd5dc374b
+  metadata.gz: 8b29bf9987dbd165250adc459e96ef0a8c2808d86e462245bdddefe1ccc7868f0d639bbd2bc48c5d5385fd65ed6dc8bb174b2b9a3639582ca2c5ee7da0f6cc4b
+  data.tar.gz: f1d5622d8032fe9eb14fecbec00f9903a1e2423f68e2ac0f3b3b604373f0515e6bb597c8faa9b81eda8283de918c13287b55738620811d753d79ab40e9cf6ca5

data/CHANGELOG.md

@@ -1,32 +1,44 @@
 # Change Log
 <!-- usage documentation: http://expeditor-docs.es.chef.io/configuration/changelog/ -->
-<!-- latest_release 3.0.9 -->
-## [v3.0.9](https://github.com/inspec/inspec/tree/v3.0.9) (2018-10-18)
+<!-- latest_release 3.0.12 -->
+## [v3.0.12](https://github.com/inspec/inspec/tree/v3.0.12) (2018-10-24)
 
-#### Merged Pull Requests
-- Add missing tests for groups resource, document members property, and assorted fixes. [#3467](https://github.com/inspec/inspec/pull/3467) ([miah](https://github.com/miah))
+#### Bug Fixes
+- Update to safe navigation exit code search [#3541](https://github.com/inspec/inspec/pull/3541) ([jquick](https://github.com/jquick))
 <!-- latest_release -->
 
-<!-- release_rollup since=3.0.0 -->
-### Changes since 3.0.0 release
-
-#### Enhancements
-- Minor cleanups of plugin documentation. &#39;Plugin&#39; instead of &#39;PluginDefinition&#39; [#3527](https://github.com/inspec/inspec/pull/3527) ([mattray](https://github.com/mattray)) <!-- 3.0.5 -->
+<!-- release_rollup since=3.0.9 -->
+### Changes since 3.0.9 release
 
 #### Bug Fixes
-- Fixes corrupt plugins.json when testing a plugin outside of core [#3526](https://github.com/inspec/inspec/pull/3526) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 3.0.7 -->
-- FilterTable: allow Strings or Symbols as fields [#3481](https://github.com/inspec/inspec/pull/3481) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 3.0.2 -->
+- Update to safe navigation exit code search [#3541](https://github.com/inspec/inspec/pull/3541) ([jquick](https://github.com/jquick)) <!-- 3.0.12 -->
 
 #### Merged Pull Requests
-- Add missing tests for groups resource, document members property, and assorted fixes. [#3467](https://github.com/inspec/inspec/pull/3467) ([miah](https://github.com/miah)) <!-- 3.0.9 -->
-- Pin inspec to the new train [#3531](https://github.com/inspec/inspec/pull/3531) ([jquick](https://github.com/jquick)) <!-- 3.0.8 -->
-- Add debug and sort options for plugins [#3530](https://github.com/inspec/inspec/pull/3530) ([jquick](https://github.com/jquick)) <!-- 3.0.6 -->
-- docs: Fix small issues with the `file` resource [#3515](https://github.com/inspec/inspec/pull/3515) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 3.0.4 -->
-- Filter out inspec-k8s and inspec-release [#3525](https://github.com/inspec/inspec/pull/3525) ([miah](https://github.com/miah)) <!-- 3.0.3 -->
-- style: Fix quotes/style on the `docker` resource [#3516](https://github.com/inspec/inspec/pull/3516) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 3.0.1 -->
+- Add inspec/train vault to plugin exclusion [#3532](https://github.com/inspec/inspec/pull/3532) ([jquick](https://github.com/jquick)) <!-- 3.0.11 -->
+
+#### New Resources
+- New resource to work with Windows security identifiers (SIDs) [#3405](https://github.com/inspec/inspec/pull/3405) ([james-stocks](https://github.com/james-stocks)) <!-- 3.0.10 -->
 <!-- release_rollup -->
 
 <!-- latest_stable_release -->
+## [v3.0.9](https://github.com/inspec/inspec/tree/v3.0.9) (2018-10-18)
+
+#### Enhancements
+- Minor cleanups of plugin documentation. &#39;Plugin&#39; instead of &#39;PluginDefinition&#39; [#3527](https://github.com/inspec/inspec/pull/3527) ([mattray](https://github.com/mattray))
+
+#### Bug Fixes
+- FilterTable: allow Strings or Symbols as fields [#3481](https://github.com/inspec/inspec/pull/3481) ([clintoncwolfe](https://github.com/clintoncwolfe))
+- Fixes corrupt plugins.json when testing a plugin outside of core [#3526](https://github.com/inspec/inspec/pull/3526) ([clintoncwolfe](https://github.com/clintoncwolfe))
+
+#### Merged Pull Requests
+- style: Fix quotes/style on the `docker` resource [#3516](https://github.com/inspec/inspec/pull/3516) ([jerryaldrichiii](https://github.com/jerryaldrichiii))
+- Filter out inspec-k8s and inspec-release [#3525](https://github.com/inspec/inspec/pull/3525) ([miah](https://github.com/miah))
+- docs: Fix small issues with the `file` resource [#3515](https://github.com/inspec/inspec/pull/3515) ([jerryaldrichiii](https://github.com/jerryaldrichiii))
+- Add debug and sort options for plugins [#3530](https://github.com/inspec/inspec/pull/3530) ([jquick](https://github.com/jquick))
+- Pin inspec to the new train [#3531](https://github.com/inspec/inspec/pull/3531) ([jquick](https://github.com/jquick))
+- Add missing tests for groups resource, document members property, and assorted fixes. [#3467](https://github.com/inspec/inspec/pull/3467) ([miah](https://github.com/miah))
+<!-- latest_stable_release -->
+
 ## [v3.0.0](https://github.com/inspec/inspec/tree/v3.0.0) (2018-10-15)
 
 #### Enhancements
@@ -35,7 +47,6 @@
 #### Merged Pull Requests
 - Change `Inspec ` to `InSpec ` where appropriate [#3494](https://github.com/inspec/inspec/pull/3494) ([jerryaldrichiii](https://github.com/jerryaldrichiii))
 - Update the text on the generic default attribute [#3508](https://github.com/inspec/inspec/pull/3508) ([jquick](https://github.com/jquick))
-<!-- latest_stable_release -->
 
 ## [v2.3.24](https://github.com/inspec/inspec/tree/v2.3.24) (2018-10-12)
 

data/etc/plugin_filters.json

@@ -15,7 +15,15 @@
     },
     {
       "plugin_name": "inspec-release",
-      "rationale": "It is not plugin."
+      "rationale": "This gem is currently only a placeholder, waiting to be built."
+    },
+    {
+      "plugin_name": "inspec-vault",
+      "rationale": "This gem is currently only a placeholder, waiting to be built."
+    },
+    {
+      "plugin_name": "train-vault",
+      "rationale": "This gem is currently only a placeholder, waiting to be built."
     },
     {
       "plugin_name": "train-tax-calculator",

data/lib/inspec/resource.rb

@@ -144,6 +144,7 @@ require 'resources/json'
 require 'resources/kernel_module'
 require 'resources/kernel_parameter'
 require 'resources/key_rsa'
+require 'resources/ksh'
 require 'resources/limits_conf'
 require 'resources/login_def'
 require 'resources/mount'
@@ -175,6 +176,7 @@ require 'resources/powershell'
 require 'resources/processes'
 require 'resources/rabbitmq_conf'
 require 'resources/registry_key'
+require 'resources/security_identifier'
 require 'resources/security_policy'
 require 'resources/service'
 require 'resources/shadow'

data/lib/inspec/runner_rspec.rb

@@ -84,7 +84,7 @@ module Inspec
     def exit_code
       return @rspec_exit_code if @formatter.results.empty?
       stats = @formatter.results[:statistics][:controls]
-      skipped = @formatter.results[:profiles].first[:status] == 'skipped'
+      skipped = @formatter.results&.fetch(:profiles, nil)&.first&.fetch(:status, nil) == 'skipped'
       if stats[:failed][:total] == 0 && stats[:skipped][:total] == 0 && !skipped
         0
       elsif stats[:failed][:total] > 0

data/lib/inspec/version.rb

@@ -4,5 +4,5 @@
 # author: Christoph Hartmann
 
 module Inspec
-  VERSION = '3.0.9'
+  VERSION = '3.0.12'
 end

data/lib/resources/ksh.rb

@@ -0,0 +1,35 @@
+# encoding: utf-8
+
+require 'utils/command_wrapper'
+require 'resources/command'
+
+module Inspec::Resources
+  class Ksh < Cmd
+    name 'ksh'
+    supports platform: 'unix'
+    desc 'Run a command or script in KornShell.'
+    example "
+      describe ksh('ls -al /') do
+        its('stdout') { should match /bin/ }
+        its('stderr') { should eq '' }
+        its('exit_status') { should eq 0 }
+      end
+
+      # Specify the path of the executable:
+      ksh('...', path: '/usr/bin/ksh93')
+
+      # Specify arguments (defaults to -c)
+      ksh('...', args: '-x -c')
+    "
+
+    def initialize(command, options = {})
+      @raw_command = command
+      options[:shell] = 'ksh' if options.is_a?(Hash)
+      super(CommandWrapper.wrap(command, options))
+    end
+
+    def to_s
+      "KornShell command #{@raw_command}"
+    end
+  end
+end

data/lib/resources/security_identifier.rb

@@ -0,0 +1,84 @@
+# encoding: utf-8
+# frozen_string_literal: true
+
+module Inspec::Resources
+  class SecurityIdentifier < Inspec.resource(1)
+    name 'security_identifier'
+    supports platform: 'windows'
+    desc 'Resource that returns a Security Identifier for a given entity name in Windows.'
+    example <<-EOD
+      describe security_identifier(group: 'Everyone') do
+        it { should exist }
+        its('sid') { should eq 'S-1-1-0' }
+      end
+    EOD
+
+    def initialize(opts = {})
+      supported_opt_keys = [:user, :group, :unspecified]
+      raise ArgumentError, "Invalid security_identifier param '#{opts}'. Please pass a hash with these supported keys: #{supported_opt_keys}" unless opts.respond_to?(:keys)
+      raise ArgumentError, "Unsupported security_identifier options '#{opts.keys - supported_opt_keys}'. Supported keys: #[supported_opt_keys]" unless (opts.keys - supported_opt_keys).empty?
+      raise ArgumentError, 'Specifying more than one of :user :group or :unspecified for security_identifier is not supported' unless opts.keys && (opts.keys & supported_opt_keys).length == 1
+      if opts[:user]
+        @type = :user
+        @name = opts[:user]
+      end
+      if opts[:group]
+        @type = :group
+        @name = opts[:group]
+      end
+      if opts[:unspecified]
+        @type = :unspecified
+        @name = opts[:unspecified]
+      end
+      raise ArgumentError, 'Specify one of :user :group or :unspecified for security_identifier' unless @name
+      @sids = nil
+    end
+
+    def sid
+      fetch_sids unless @sids
+      @sids[@name] # nil if not found
+    end
+
+    def exist?
+      fetch_sids unless @sids
+      @sids.key?(@name)
+    end
+
+    private
+
+    def fetch_sids
+      @sids = {}
+      case @type
+      when :group
+        sid_data = wmi_results(:group)
+      when :user
+        sid_data = wmi_results(:user)
+      when :unspecified
+        # try group first, then user
+        sid_data = wmi_results(:group)
+        if sid_data.empty?
+          sid_data = wmi_results(:user)
+        end
+      else
+        raise "Unhandled entity type '#{@type}'"
+      end
+      sid_data.each { |sid| @sids[sid[1]] = sid[2] }
+    end
+
+    def wmi_results(type)
+      query = 'wmic '
+      case type
+      when :group
+        query += 'group'
+      when :user
+        query += 'useraccount'
+      end
+      query += " where 'Name=\"#{@name}\"' get Name\",\"SID /format:csv"
+      # Example output:
+      #     inspec> command("wmic useraccount where 'Name=\"Administrator\"' get Name\",\"SID /format:csv").stdout
+      #     => "\r\n\r\nNode,Name,SID\r\n\r\nComputer1,Administrator,S-1-5-21-650485088-1194226989-968533923-500\r\n\r\n"
+      # Remove the \r characters, split on \n\n, ignore the CSV header row
+      inspec.command(query).stdout.strip.tr("\r", '').split("\n\n")[1..-1].map { |entry| entry.split(',') }
+    end
+  end
+end

data/lib/utils/command_wrapper.rb

@@ -5,7 +5,7 @@
 require 'shellwords'
 
 class CommandWrapper
-  UNIX_SHELLS = %w{sh bash zsh}.freeze
+  UNIX_SHELLS = %w{sh bash zsh ksh}.freeze
 
   def self.wrap(cmd, options)
     unless options.is_a?(Hash)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-core
 version: !ruby/object:Gem::Version
-  version: 3.0.9
+  version: 3.0.12
 platform: ruby
 authors:
 - Dominik Richter
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-10-18 00:00:00.000000000 Z
+date: 2018-10-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: train-core
@@ -510,6 +510,7 @@ files:
 - lib/resources/kernel_module.rb
 - lib/resources/kernel_parameter.rb
 - lib/resources/key_rsa.rb
+- lib/resources/ksh.rb
 - lib/resources/limits_conf.rb
 - lib/resources/login_def.rb
 - lib/resources/mount.rb
@@ -541,6 +542,7 @@ files:
 - lib/resources/processes.rb
 - lib/resources/rabbitmq_conf.rb
 - lib/resources/registry_key.rb
+- lib/resources/security_identifier.rb
 - lib/resources/security_policy.rb
 - lib/resources/service.rb
 - lib/resources/shadow.rb