inspec 0.10.1 → 0.11.0

data/lib/inspec/version.rb

@@ -3,5 +3,5 @@
 # author: Christoph Hartmann
 
 module Inspec
-  VERSION = '0.10.1'.freeze
+  VERSION = '0.11.0'.freeze
 end

data/lib/resources/apache_conf.rb

@@ -40,6 +40,14 @@ class ApacheConf < Inspec.resource(1)
     res
   end
 
+  def method_missing(name)
+    # ensure params are loaded
+    @params || read_content
+
+    # extract values
+    @params[name.to_s] unless @params.nil?
+  end
+
   def filter_comments(data)
     content = ''
     data.each_line do |line|

data/lib/resources/auditd_rules.rb

@@ -4,21 +4,12 @@
 # author: Dominik Richter
 # license: All rights reserved
 
-class AuditDaemonRules < Inspec.resource(1)
-  name 'auditd_rules'
-  desc 'Use the auditd_rules InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files.'
-  example "
-    describe auditd_rules do
-      its('LIST_RULES') {should contain_match(/^exit,always arch=.* key=time-change syscall=adjtimex,settimeofday/) }
-      its('LIST_RULES') {should contain_match(/^exit,always arch=.* key=time-change syscall=stime,settimeofday,adjtimex/) }
-      its('LIST_RULES') {should contain_match(/^exit,always arch=.* key=time-change syscall=clock_settime/)}
-      its('LIST_RULES') {should contain_match(/^exit,always watch=\/etc\/localtime perm=wa key=time-change/)}
-    end
-  "
-
-  def initialize
-    @content = inspec.command('/sbin/auditctl -l').stdout.chomp
+require 'forwardable'
+require 'utils/filter_array'
 
+class AuditdRulesLegacy
+  def initialize(content)
+    @content = content
     @opts = {
       assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
       multiple_values: true,
@@ -48,7 +39,165 @@ class AuditDaemonRules < Inspec.resource(1)
     items[name]
   end
 
+  def to_s
+    'Audit Daemon Rules (for auditd version < 2.3)'
+  end
+end
+
+# rubocop:disable Metrics/ClassLength
+class AuditDaemonRules < Inspec.resource(1)
+  extend Forwardable
+  attr_accessor :rules, :lines
+
+  name 'auditd_rules'
+  desc 'Use the auditd_rules InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files.'
+  example "
+    # syntax for auditd < 2.3
+    describe auditd_rules do
+      its('LIST_RULES') {should contain_match(/^exit,always arch=.* key=time-change syscall=adjtimex,settimeofday/) }
+      its('LIST_RULES') {should contain_match(/^exit,always arch=.* key=time-change syscall=stime,settimeofday,adjtimex/) }
+      its('LIST_RULES') {should contain_match(/^exit,always arch=.* key=time-change syscall=clock_settime/)}
+      its('LIST_RULES') {should contain_match(/^exit,always watch=\/etc\/localtime perm=wa key=time-change/)}
+    end
+
+    # syntax for auditd >= 2.3
+    describe auditd_rules.syscall('open').action do
+      it { should eq(['always']) }
+    end
+
+    describe auditd_rules.key('sshd_config') do
+      its(:permissions) { should contain_match(/x/) }
+    end
+
+    describe auditd_rules do
+      its(:lines) { should contain_match(%r{-w /etc/ssh/sshd_config/}) }
+    end
+  "
+
+  def initialize
+    @content = inspec.command('/sbin/auditctl -l').stdout.chomp
+
+    if @content =~ /^LIST_RULES:/
+      # do not warn on centos 5
+      unless inspec.os[:family] == 'centos' && inspec.os[:release].to_i == 5
+        warn '[WARN] this version of auditd is outdated. Updating it allows for using more precise matchers.'
+      end
+      @legacy = AuditdRulesLegacy.new(@content)
+    else
+      parse_content
+    end
+  end
+
+  # non-legacy instances are not asked for `its('LIST_RULES')`
+  # rubocop:disable Style/MethodName
+  def LIST_RULES
+    return @legacy.LIST_RULES if @legacy
+    fail 'Using legacy auditd_rules LIST_RULES interface with non-legacy audit package. Please use the new syntax.'
+  end
+
+  def status(name = nil)
+    return @legacy.status(name) if @legacy
+
+    @status_content ||= inspec.command('/sbin/auditctl -s').stdout.chomp
+    @status_params ||= Hash[@status_content.scan(/^([^ ]+) (.*)$/)]
+
+    return @status_params[name] if name
+    @status_params
+  end
+
+  def parse_content
+    @rules = {
+      syscalls: [],
+      files: [],
+    }
+    @lines = @content.lines.map(&:chomp)
+
+    lines.each do |line|
+      if is_syscall?(line)
+        syscalls = get_syscalls line
+        action, list = get_action_list line
+        fields, opts = get_fields line
+
+        # create a 'flatter' structure because sanity
+        syscalls.each do |s|
+          @rules[:syscalls] << { syscall: s, list: list, action: action, fields: fields }.merge(opts)
+        end
+      elsif is_file?(line)
+        file = get_file line
+        perms = get_permissions line
+        key = get_key line
+
+        @rules[:files] << { file: file, key: key, permissions: perms }
+      end
+    end
+  end
+
+  def syscall(name)
+    select_name(:syscall, name)
+  end
+
+  def file(name)
+    select_name(:file, name)
+  end
+
+  # both files and syscalls have `key` identifiers
+  def key(name)
+    res = rules.values.flatten.find_all { |rule| rule[:key] == name }
+    FilterArray.new(res)
+  end
+
   def to_s
     'Audit Daemon Rules'
   end
+
+  private
+
+  def select_name(key, name)
+    plural = "#{key}s".to_sym
+    res = rules[plural].find_all { |rule| rule[key] == name }
+    FilterArray.new(res)
+  end
+
+  def is_syscall?(line)
+    line.match(/\ -S /)
+  end
+
+  def is_file?(line)
+    line.match(/-w /)
+  end
+
+  def get_syscalls(line)
+    line.scan(/-S ([^ ]+) /).flatten.first.split(',')
+  end
+
+  def get_action_list(line)
+    line.scan(/-a ([^,]+),([^ ]+)/).flatten
+  end
+
+  # NB only in file lines
+  def get_key(line)
+    line.match(/-k ([^ ]+)/)[1]
+  end
+
+  # NOTE there are NO precautions wrt. filenames containing spaces in auditctl
+  # `auditctl -w /foo\ bar` gives the following line: `-w /foo bar -p rwxa`
+  def get_file(line)
+    line.match(/-w (.+) -p/)[1]
+  end
+
+  def get_permissions(line)
+    line.match(/-p ([^ ]+)/)[1]
+  end
+
+  def get_fields(line)
+    fields = line.gsub(/-[aS] [^ ]+ /, '').split('-F ').map { |l| l.split(' ') }.flatten
+
+    opts = {}
+    fields.find_all { |x| x.match(/[a-z]+=.*/) }.each do |kv|
+      k, v = kv.split('=')
+      opts[k.to_sym] = v
+    end
+
+    [fields, opts]
+  end
 end

data/lib/resources/registry_key.rb

@@ -92,7 +92,7 @@ class RegistryKey < Inspec.resource(1)
   end
 
   def registry_key(path)
-    return @registy_cache if defined?(@registy_cache)
+    return @registry_cache if defined?(@registry_cache)
 
     # load registry key and all properties
     script = <<-EOH
@@ -115,16 +115,16 @@ class RegistryKey < Inspec.resource(1)
     # cannot rely on exit code for now, successful command returns exit code 1
     # return nil if cmd.exit_status != 0, try to parse json
     begin
-      @registy_cache = JSON.parse(cmd.stdout)
+      @registry_cache = JSON.parse(cmd.stdout)
       # convert keys to lower case
-      @registy_cache = Hash[@registy_cache.map do |key, value|
+      @registry_cache = Hash[@registry_cache.map do |key, value|
         [key.downcase, value]
       end]
     rescue JSON::ParserError => _e
-      @registy_cache = nil
+      @registry_cache = nil
     end
 
-    @registy_cache
+    @registry_cache
   end
 
   # Registry key value types

data/lib/resources/script.rb

@@ -18,17 +18,15 @@ class Script < Cmd
   "
 
   def initialize(script)
-    case inspec.os[:family]
-    when 'windows'
-      # encodes a script as base64 to run as powershell encodedCommand
-      # this comes with performance issues: @see https://gist.github.com/fnichol/7b20596b950e65fb96f9
-      require 'winrm'
-      script = WinRM::PowershellScript.new(script)
-      cmd = "powershell -encodedCommand #{script.encoded}"
-    else
-      cmd = ''
+    unless inspec.os.windows?
       return skip_resource 'The `script` resource is not supported on your OS yet.'
     end
+
+    # encodes a script as base64 to run as powershell encodedCommand
+    # this comes with performance issues: @see https://gist.github.com/fnichol/7b20596b950e65fb96f9
+    require 'winrm'
+    script = WinRM::PowershellScript.new(script)
+    cmd = "powershell -encodedCommand #{script.encoded}"
     super(cmd)
   end
 

data/lib/utils/filter_array.rb

@@ -0,0 +1,28 @@
+# encoding: utf-8
+# copyright: 2015, Chef Software, Inc.
+# license: All rights reserved
+# author: Stephan Renatus
+
+class FilterArray
+  attr_accessor :rules
+  alias content rules
+
+  def initialize(rules)
+    @rules = rules
+  end
+
+  # allows for chaining
+  # .field('arch', 'b32').field('key', 'access').rules
+  def field(key, value = nil)
+    if value
+      res = rules.find_all { |r| r[key.to_sym] == value }
+      FilterArray.new(res)
+    else
+      rules.map { |h| h[key.to_sym] }.uniq
+    end
+  end
+
+  def method_missing(meth, *args)
+    field(meth, args[0])
+  end
+end

data/test/helper.rb

@@ -121,10 +121,12 @@ class MockLoader
       'Remove-Item win_secpol.cfg' => cmd.call('success'),
       'env' => cmd.call('env'),
       '$Env:PATH'  => cmd.call('$env-PATH'),
-      # registry key test
+      # registry key test (winrm 1.6.0, 1.6.1)
       '2790db1e88204a073ed7fd3493f5445e5ce531afd0d2724a0e36c17110c535e6' => cmd.call('reg_schedule'),
+      'b00eb49a98c96a808c469e4894b5123a913e354c9ffea5b785898fe30d288ee0' => cmd.call('reg_schedule'),
       'Auditpol /get /subcategory:\'User Account Management\' /r' => cmd.call('auditpol'),
       '/sbin/auditctl -l' => cmd.call('auditctl'),
+      '/sbin/auditctl -s' => cmd.call('auditctl-s'),
       'yum -v repolist all'  => cmd.call('yum-repolist-all'),
       'dpkg -s curl' => cmd.call('dpkg-s-curl'),
       'rpm -qia curl' => cmd.call('rpm-qia-curl'),
@@ -179,8 +181,9 @@ class MockLoader
       'dscl -q . -read /Users/chartmann NFSHomeDirectory PrimaryGroupID RecordName UniqueID UserShell' => cmd.call('dscl'),
       # user info for freebsd
       'pw usershow root -7' => cmd.call('pw-usershow-root-7'),
-      # user info for windows
+      # user info for windows (winrm 1.6.0, 1.6.1)
       '650b6b72a66316418b25421a54afe21a230704558082914c54711904bb10e370' => cmd.call('GetUserAccount'),
+      '272e1d767fe6e28c86cfba1a75c3d458acade1f4a36cfd5e711b97884879de24' => cmd.call('GetUserAccount'),
       # group info for windows
       'Get-WmiObject Win32_Group | Select-Object -Property Caption, Domain, Name, SID, LocalAccount | ConvertTo-Json' => cmd.call('GetWin32Group'),
       # network interface

data/test/integration/cookbooks/os_prepare/metadata.rb

@@ -4,7 +4,9 @@ maintainer 'Chef Software, Inc.'
 maintainer_email 'support@chef.io'
 description 'This cookbook prepares the test operating systems'
 version '1.0.0'
+
 depends 'apt'
 depends 'yum'
 depends 'runit'
 depends 'postgresql'
+depends 'httpd', '~> 0.2'

data/test/integration/cookbooks/os_prepare/recipes/auditctl.rb

@@ -0,0 +1,8 @@
+# encoding: utf-8
+# author: Stephan Renatus
+
+case node['platform']
+when 'centos'
+  execute 'auditctl -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access'
+  execute 'auditctl -w /etc/ssh/sshd_config -p rwxa -k sshd_config'
+end

data/test/integration/cookbooks/os_prepare/recipes/default.rb

@@ -4,11 +4,21 @@
 #
 # prepare all operating systems with the required configuration
 
-include_recipe('os_prepare::apt')
+
+# basic tests
 include_recipe('os_prepare::file')
 include_recipe('os_prepare::mount')
-include_recipe('os_prepare::json_yaml_csv_ini')
+include_recipe('os_prepare::service')
 include_recipe('os_prepare::package')
 include_recipe('os_prepare::registry_key')
-include_recipe('os_prepare::service')
+
+# configure repos, eg. nginx
+include_recipe('os_prepare::apt')
+
+# application configuration
 include_recipe('os_prepare::postgres')
+include_recipe('os_prepare::auditctl')
+include_recipe('os_prepare::apache')
+
+# config file parsing
+include_recipe('os_prepare::json_yaml_csv_ini')

data/test/integration/test/integration/default/apache_conf_spec.rb

@@ -0,0 +1,15 @@
+# encoding: utf-8
+
+if os.linux?
+
+  # direct access to params of apache conf
+  describe apache_conf do
+    its('LogLevel') { should eq 'warn' }
+    its('MaxKeepAliveRequests') { should eq '100' }
+  end
+
+  # only read one param
+  describe apache_conf.params('LogLevel') do
+    it { should include 'warn' }
+  end
+end

data/test/integration/test/integration/default/auditd_rules_spec.rb

@@ -0,0 +1,32 @@
+# encoding: utf-8
+
+# based on operating system we select the available service
+return unless os[:family] == 'centos'
+
+describe auditd_rules.syscall('open') do
+  its(:action) { should eq(['always']) }
+end
+
+describe auditd_rules.syscall('open').action do
+  it { should eq(['always']) }
+end
+
+describe auditd_rules.key('sshd_config') do
+  its(:permissions) { should contain_match(/x/) }
+end
+
+describe auditd_rules.file('/etc/ssh/sshd_config').permissions do
+  it { should eq(['rwxa']) }
+end
+
+describe auditd_rules do
+  its(:lines) { should contain_match(%r{-w /etc/ssh/sshd_config/}) }
+end
+
+describe auditd_rules.syscall('open').action('always').list do
+  it { should eq(['exit']) }
+end
+
+describe auditd_rules.status('backlog') do
+  it { should cmp 0 }
+end

data/test/unit/mock/cmd/auditctl

@@ -1,7 +1,3 @@
-LIST_RULES: exit,always syscall=rmdir,unlink
-LIST_RULES: exit,always auid=1001 (0x3e9) syscall=open
-LIST_RULES: exit,always watch=/etc/group perm=wa
-LIST_RULES: exit,always watch=/etc/passwd perm=wa
-LIST_RULES: exit,always watch=/etc/shadow perm=wa
-LIST_RULES: exit,always watch=/etc/sudoers perm=wa
-LIST_RULES: exit,always watch=/etc/secret_directory perm=r
+-a always,exit -F arch=b64 -S open,openat -F exit=-EACCES -F key=access
+-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=500 f24!=0 -F key=perm_mod
+-w /etc/ssh/sshd_config -p rwxa -k CFG_sshd_config

data/test/unit/mock/cmd/auditctl-legacy

@@ -0,0 +1,7 @@
+LIST_RULES: exit,always syscall=rmdir,unlink
+LIST_RULES: exit,always auid=1001 (0x3e9) syscall=open
+LIST_RULES: exit,always watch=/etc/group perm=wa
+LIST_RULES: exit,always watch=/etc/passwd perm=wa
+LIST_RULES: exit,always watch=/etc/shadow perm=wa
+LIST_RULES: exit,always watch=/etc/sudoers perm=wa
+LIST_RULES: exit,always watch=/etc/secret_directory perm=r

data/test/unit/mock/cmd/auditctl-s

@@ -0,0 +1,8 @@
+enabled 1
+flag 2
+pid 547
+rate_limit 0
+backlog_limit 8192
+lost 0
+backlog 0
+loginuid_immutable 0 unlocked