inspec 0.34.1 → 1.0.0

data/lib/resources/groups.rb

@@ -0,0 +1,190 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+require 'utils/filter'
+
+module Inspec::Resources
+  # This file contains two resources, the `group` and `groups` resource.
+  # The `group` resource is optimized for requests that verify specific groups
+  # that you know upfront for testing. If you need to query all groups or search
+  # specific groups with certain properties, use the `groups` resource.
+  module GroupManagementSelector
+    # select group provider based on the operating system
+    # returns nil, if no group manager was found for the operating system
+    def select_group_manager(os)
+      if os.unix?
+        @group_provider = UnixGroup.new(inspec)
+      elsif os.windows?
+        @group_provider = WindowsGroup.new(inspec)
+      end
+    end
+  end
+
+  class Groups < Inspec.resource(1)
+    include GroupManagementSelector
+
+    name 'groups'
+    desc 'Use the group InSpec audit resource to test groups on the system. Groups can be filtered.'
+    example "
+      describe groups.where { name == 'root'} do
+        its('names') { should eq ['root'] }
+        its('gids') { should eq [0] }
+      end
+
+      describe groups.where { name == 'Administrators'} do
+        its('names') { should eq ['Administrators'] }
+        its('gids') { should eq ['S-1-5-32-544'] }
+      end
+    "
+
+    def initialize
+      # select group manager
+      @group_provider = select_group_manager(inspec.os)
+      return skip_resource 'The `groups` resource is not supported on your OS yet.' if @group_provider.nil?
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:names,     field: 'name')
+          .add(:gids,      field: 'gid')
+          .add(:domains,   field: 'domain')
+          .add(:exists?) { |x| !x.entries.empty? }
+    filter.connect(self, :collect_group_details)
+
+    def to_s
+      'Groups'
+    end
+
+    private
+
+    # collects information about every group
+    def collect_group_details
+      return @groups_cache ||= @group_provider.groups unless @group_provider.nil?
+      []
+    end
+  end
+
+  # Usage:
+  # describe group('root') do
+  #   it { should exist }
+  #   its('gid') { should eq 0 }
+  # end
+  #
+  # deprecated has matcher
+  # describe group('root') do
+  #  it { should have_gid 0 }
+  # end
+  class Group < Inspec.resource(1)
+    include GroupManagementSelector
+
+    name 'group'
+    desc 'Use the group InSpec audit resource to test groups on the system.'
+    example "
+      describe group('root') do
+        it { should exist }
+        its('gid') { should eq 0 }
+      end
+    "
+
+    def initialize(groupname)
+      @group = groupname
+      @group = @group.downcase unless inspec.os.windows?
+
+      # select group manager
+      @group_provider = select_group_manager(inspec.os)
+      return skip_resource 'The `group` resource is not supported on your OS yet.' if @group_provider.nil?
+    end
+
+    # verifies if a group exists
+    def exists?
+      group_info.entries.size > 0
+    end
+
+    def gid
+      gids = group_info.gids
+      if gids.size == 0
+        nil
+      # the default case should be one group
+      elsif gids.size == 1
+        gids.entries[0]
+      else
+        fail 'found more than one group with the same name, please use `groups` resource'
+      end
+    end
+
+    # implements rspec has matcher, to be compatible with serverspec
+    def has_gid?(compare_gid)
+      gid == compare_gid
+    end
+
+    def local
+      # at this point the implementation only returns local groups
+      true
+    end
+
+    def to_s
+      "Group #{@group}"
+    end
+
+    private
+
+    def group_info
+      # we need a local copy for the block
+      group = @group.dup
+      @groups_cache ||= inspec.groups.where { name == group }
+    end
+  end
+
+  class GroupInfo
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+
+    def groups
+      fail 'group provider must implement the `groups` method'
+    end
+  end
+
+  # implements generic unix groups via /etc/group
+  class UnixGroup < GroupInfo
+    def groups
+      inspec.etc_group.entries
+    end
+  end
+
+  class WindowsGroup < GroupInfo
+    # returns all local groups
+    def groups
+      script = <<-EOH
+Function  ConvertTo-SID { Param([byte[]]$BinarySID)
+  (New-Object  System.Security.Principal.SecurityIdentifier($BinarySID,0)).Value
+}
+
+$Computername =  $Env:Computername
+$adsi  = [ADSI]"WinNT://$Computername"
+$groups = $adsi.Children | where {$_.SchemaClassName -eq  'group'} |  ForEach {
+  $name = $_.Name[0]
+  $sid = ConvertTo-SID -BinarySID $_.ObjectSID[0]
+  $group =[ADSI]$_.Path
+  new-object psobject -property @{name = $group.Name[0]; gid = $sid; domain=$Computername}
+}
+$groups | ConvertTo-Json -Depth 3
+      EOH
+      cmd = inspec.powershell(script)
+      # cannot rely on exit code for now, successful command returns exit code 1
+      # return nil if cmd.exit_status != 0, try to parse json
+      begin
+        groups = JSON.parse(cmd.stdout)
+      rescue JSON::ParserError => _e
+        return []
+      end
+
+      # ensure we have an array of groups
+      groups = [groups] if !groups.is_a?(Array)
+      groups
+    end
+  end
+end

data/lib/resources/oneget.rb

@@ -16,6 +16,7 @@ module Inspec::Resources
     example "
       describe oneget('zoomit') do
         it { should be_installed }
+        its('version') { should eq '1.2.3' }
       end
     "
 

data/lib/resources/os.rb

@@ -7,7 +7,7 @@ module Inspec::Resources
     name 'os'
     desc 'Use the os InSpec audit resource to test the platform on which the system is running.'
     example "
-      describe os.family do
+      describe os[:family] do
         it { should eq 'redhat' }
       end
 

data/lib/resources/package.rb

@@ -91,9 +91,11 @@ module Inspec::Resources
         assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         multiple_values: false,
       ).params
+      # If the package is removed and not purged, Status is "deinstall ok config-files" with exit_status 0
+      # If the package is purged cmd fails with non-zero exit status
       {
         name: params['Package'],
-        installed: true,
+        installed: params['Status'].split(' ').first == 'install',
         version: params['Version'],
         type: 'deb',
       }

data/lib/resources/parse_config.rb

@@ -19,10 +19,27 @@ module Inspec::Resources
     desc 'Use the parse_config InSpec audit resource to test arbitrary configuration files.'
     example "
       output = command('some-command').stdout
-
       describe parse_config(output, { data_config_option: value } ) do
         its('setting') { should eq 1 }
       end
+
+      output2 = command('curl http://127.0.0.1/php_status').stdout
+      # php status is in format 'key : value', and we do not allow for multiple values
+      options2 = {
+        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        multiple_values: false
+      }
+
+      describe parse_config(output2, options2) do
+        its('pool') { should eq 'www'}
+        its('process manager') { should eq process_manager }
+      end
+
+      # getting specific key from the output above, convert it to integer and then compare
+      # make sure 'listen queue' is below 100
+      describe parse_config(output2, options2 ).params['listen queue'].to_i do
+        it { should be < 100 }
+      end
     "
 
     attr_reader :content

data/lib/resources/pip.rb

@@ -49,7 +49,7 @@ module Inspec::Resources
     end
 
     def to_s
-      "Pip Package  #{@package_name}"
+      "Pip Package #{@package_name}"
     end
 
     private

data/lib/resources/security_policy.rb

@@ -16,6 +16,57 @@
 require 'hashie'
 
 module Inspec::Resources
+  # known and supported MS privilege rights
+  # @see https://technet.microsoft.com/en-us/library/dd277311.aspx
+  # @see https://msdn.microsoft.com/en-us/library/windows/desktop/bb530716(v=vs.85).aspx
+  MS_PRIVILEGES_RIGHTS = [
+    'SeNetworkLogonRight',
+    'SeBackupPrivilege',
+    'SeChangeNotifyPrivilege',
+    'SeSystemtimePrivilege',
+    'SeCreatePagefilePrivilege',
+    'SeDebugPrivilege',
+    'SeRemoteShutdownPrivilege',
+    'SeAuditPrivilege',
+    'SeIncreaseQuotaPrivilege',
+    'SeIncreaseBasePriorityPrivilege',
+    'SeLoadDriverPrivilege',
+    'SeBatchLogonRight',
+    'SeServiceLogonRight',
+    'SeInteractiveLogonRight',
+    'SeSecurityPrivilege',
+    'SeSystemEnvironmentPrivilege',
+    'SeProfileSingleProcessPrivilege',
+    'SeSystemProfilePrivilege',
+    'SeAssignPrimaryTokenPrivilege',
+    'SeRestorePrivilege',
+    'SeShutdownPrivilege',
+    'SeTakeOwnershipPrivilege',
+    'SeUndockPrivilege',
+    'SeManageVolumePrivilege',
+    'SeRemoteInteractiveLogonRight',
+    'SeImpersonatePrivilege',
+    'SeCreateGlobalPrivilege',
+    'SeIncreaseWorking',
+    'SeTimeZonePrivilege',
+    'SeCreateSymbolicLinkPrivilege',
+    'SeDenyNetworkLogonRight', # Deny access to this computer from the network
+    'SeDenyInteractiveLogonRight', # Deny logon locally
+    'SeDenyBatchLogonRight', # Deny logon as a batch job
+    'SeDenyServiceLogonRight', # Deny logon as a service
+    'SeTcbPrivilege',
+    'SeMachineAccountPrivilege',
+    'SeCreateTokenPrivilege',
+    'SeCreatePermanentPrivilege',
+    'SeEnableDelegationPrivilege',
+    'SeLockMemoryPrivilege',
+    'SeSyncAgentPrivilege',
+    'SeUnsolicitedInputPrivilege',
+    'SeTrustedCredManAccessPrivilege',
+    'SeRelabelPrivilege', # the privilege to change a Windows integrity label (new to Windows Vista)
+    'SeDenyRemoteInteractiveLogonRight', # Deny logon through Terminal Services
+  ].freeze
+
   class SecurityPolicy < Inspec.resource(1)
     name 'security_policy'
     desc 'Use the security_policy InSpec audit resource to test security policies on the Microsoft Windows platform.'
@@ -42,6 +93,9 @@ module Inspec::Resources
       # deep search for hash key
       params.extend Hashie::Extensions::DeepFind
       res = params.deep_find(name.to_s)
+
+      # return an empty array if configuration does not include rights configuration
+      return [] if res.nil? && MS_PRIVILEGES_RIGHTS.include?(name.to_s)
       res
     end
 

data/lib/resources/ssl.rb

@@ -44,18 +44,16 @@ class SSL < Inspec.resource(1)
   attr_reader :host, :port
 
   def initialize(opts = {})
-    @host = opts[:host] ||
-            inspec.backend.instance_variable_get(:@hostname)
-    # FIXME: This can be removed when/if @hostname is available as a property for 'Train::Transports::WinRM::Connection'
-    # Train enhancement request for this here: https://github.com/chef/train/issues/128
-    if @host.nil? && inspec.backend.class.to_s == 'Train::Transports::WinRM::Connection'
-      @host = URI.parse(inspec.backend.instance_variable_get(:@options)[:endpoint]).hostname
-    end
-    if @host.nil? && inspec.backend.class.to_s == 'Train::Transports::Local::Connection'
-      @host = 'localhost'
-    end
+    @host = opts[:host]
     if @host.nil?
-      fail 'Cannot determine host for SSL test. Please specify it or use a different target.'
+      # Transports like SSH and WinRM will provide a hostname
+      if inspec.backend.respond_to?('hostname')
+        @host = inspec.backend.hostname
+      elsif inspec.backend.class.to_s == 'Train::Transports::Local::Connection'
+        @host = 'localhost'
+      else
+        fail 'Cannot determine host for SSL test. Please specify it or use a different target.'
+      end
     end
     @port = opts[:port] || 443
     @timeout = opts[:timeout]

data/lib/resources/sys_info.rb

@@ -6,7 +6,7 @@ module Inspec::Resources
 
     desc 'Use the user InSpec system resource to test for operating system properties.'
     example "
-      describe sysinfo do
+      describe sys_info do
         its('hostname') { should eq 'example.com' }
       end
     "

data/lib/resources/users.rb

@@ -4,11 +4,12 @@
 
 require 'utils/parser'
 require 'utils/convert'
+require 'utils/filter'
 
 module Inspec::Resources
   # This file contains two resources, the `user` and `users` resource.
   # The `user` resource is optimized for requests that verify specific users
-  # that you know upfront for testing. If you need to query all users or find
+  # that you know upfront for testing. If you need to query all users or search
   # specific users with certain properties, use the `users` resource.
   module UserManagementSelector
     # select user provider based on the operating system
@@ -65,7 +66,7 @@ module Inspec::Resources
     def initialize
       # select user provider
       @user_provider = select_user_manager(inspec.os)
-      return skip_resource 'The `user` resource is not supported on your OS yet.' if @user_provider.nil?
+      return skip_resource 'The `users` resource is not supported on your OS yet.' if @user_provider.nil?
     end
 
     filter = FilterTable.create
@@ -546,21 +547,12 @@ module Inspec::Resources
     end
   end
 
-  # For now, we stick with WMI Win32_UserAccount
+  # This optimization was inspired by
+  # @see https://mcpmag.com/articles/2015/04/15/reporting-on-local-accounts.aspx
+  # Alternative solutions are WMI Win32_UserAccount
   # @see https://msdn.microsoft.com/en-us/library/aa394507(v=vs.85).aspx
   # @see https://msdn.microsoft.com/en-us/library/aa394153(v=vs.85).aspx
-  #
-  # using Get-AdUser would be the best command for domain machines, but it will not be installed
-  # on client machines by default
-  # @see https://technet.microsoft.com/en-us/library/ee617241.aspx
-  # @see https://technet.microsoft.com/en-us/library/hh509016(v=WS.10).aspx
-  # @see http://woshub.com/get-aduser-getting-active-directory-users-data-via-powershell/
-  # @see http://stackoverflow.com/questions/17548523/the-term-get-aduser-is-not-recognized-as-the-name-of-a-cmdlet
-  #
-  # Just for reference, we could also use ADSI (Active Directory Service Interfaces)
-  # @see https://mcpmag.com/articles/2015/04/15/reporting-on-local-accounts.aspx
   class WindowsUser < UserInfo
-    # parse windows account name
     def parse_windows_account(username)
       account = username.split('\\')
       name = account.pop
@@ -569,67 +561,92 @@ module Inspec::Resources
     end
 
     def identity(username)
-      # extract domain/user information
-      account, domain = parse_windows_account(username)
-
-      # TODO: escape content
-      if !domain.nil?
-        filter = "Name = '#{account}' and Domain = '#{domain}'"
-      else
-        filter = "Name = '#{account}' and LocalAccount = true"
-      end
+      # TODO: we look for local users only at this point
+      name, _domain = parse_windows_account(username)
+      return if collect_user_details.nil?
+      res = collect_user_details.select { |user| user[:username] == name }
+      res[0] if res.length > 0
+    end
+
+    def list_users
+      collect_user_details.map { |user| user[:username] }
+    end
 
+    # https://msdn.microsoft.com/en-us/library/aa746340(v=vs.85).aspx
+    def collect_user_details # rubocop:disable Metrics/MethodLength
+      return @users_cache if defined?(@users_cache)
       script = <<-EOH
-        # find user
-        $user = Get-WmiObject Win32_UserAccount -filter "#{filter}"
-        # get related groups
-        $groups = $user.GetRelated('Win32_Group') | Select-Object -Property Caption, Domain, Name, LocalAccount, SID, SIDType, Status
-        # filter user information
-        $user = $user | Select-Object -Property Caption, Description, Domain, Name, LocalAccount, Lockout, PasswordChangeable, PasswordExpires, PasswordRequired, SID, SIDType, Status, Disabled
-        # build response object
-        New-Object -Type PSObject | `
-        Add-Member -MemberType NoteProperty -Name User -Value ($user) -PassThru | `
-        Add-Member -MemberType NoteProperty -Name Groups -Value ($groups) -PassThru | `
-        ConvertTo-Json
+Function  ConvertTo-SID { Param([byte[]]$BinarySID)
+  (New-Object  System.Security.Principal.SecurityIdentifier($BinarySID,0)).Value
+}
+
+Function  Convert-UserFlag { Param  ($UserFlag)
+  $List  = @()
+  Switch  ($UserFlag) {
+    ($UserFlag  -BOR 0x0001)  { $List += 'SCRIPT' }
+    ($UserFlag  -BOR 0x0002)  { $List += 'ACCOUNTDISABLE' }
+    ($UserFlag  -BOR 0x0008)  { $List += 'HOMEDIR_REQUIRED' }
+    ($UserFlag  -BOR 0x0010)  { $List += 'LOCKOUT' }
+    ($UserFlag  -BOR 0x0020)  { $List += 'PASSWD_NOTREQD' }
+    ($UserFlag  -BOR 0x0040)  { $List += 'PASSWD_CANT_CHANGE' }
+    ($UserFlag  -BOR 0x0080)  { $List += 'ENCRYPTED_TEXT_PWD_ALLOWED' }
+    ($UserFlag  -BOR 0x0100)  { $List += 'TEMP_DUPLICATE_ACCOUNT' }
+    ($UserFlag  -BOR 0x0200)  { $List += 'NORMAL_ACCOUNT' }
+    ($UserFlag  -BOR 0x0800)  { $List += 'INTERDOMAIN_TRUST_ACCOUNT' }
+    ($UserFlag  -BOR 0x1000)  { $List += 'WORKSTATION_TRUST_ACCOUNT' }
+    ($UserFlag  -BOR 0x2000)  { $List += 'SERVER_TRUST_ACCOUNT' }
+    ($UserFlag  -BOR 0x10000)  { $List += 'DONT_EXPIRE_PASSWORD' }
+    ($UserFlag  -BOR 0x20000)  { $List += 'MNS_LOGON_ACCOUNT' }
+    ($UserFlag  -BOR 0x40000)  { $List += 'SMARTCARD_REQUIRED' }
+    ($UserFlag  -BOR 0x80000)  { $List += 'TRUSTED_FOR_DELEGATION' }
+    ($UserFlag  -BOR 0x100000)  { $List += 'NOT_DELEGATED' }
+    ($UserFlag  -BOR 0x200000)  { $List += 'USE_DES_KEY_ONLY' }
+    ($UserFlag  -BOR 0x400000)  { $List += 'DONT_REQ_PREAUTH' }
+    ($UserFlag  -BOR 0x800000)  { $List += 'PASSWORD_EXPIRED' }
+    ($UserFlag  -BOR 0x1000000)  { $List += 'TRUSTED_TO_AUTH_FOR_DELEGATION' }
+    ($UserFlag  -BOR 0x04000000)  { $List += 'PARTIAL_SECRETS_ACCOUNT' }
+  }
+  $List
+}
+
+$Computername =  $Env:Computername
+$adsi  = [ADSI]"WinNT://$Computername"
+$adsi.Children | where {$_.SchemaClassName -eq  'user'} |  ForEach {
+  New-Object PSObject -property @{
+    uid = ConvertTo-SID -BinarySID $_.ObjectSID[0]
+    username = $_.Name[0]
+    description = $_.Description[0]
+    disabled = $_.AccountDisabled[0]
+    userflags = Convert-UserFlag  -UserFlag $_.UserFlags[0]
+    passwordage = [math]::Round($_.PasswordAge[0]/86400)
+    minpasswordlength = $_.MinPasswordLength[0]
+    mindays = [math]::Round($_.MinPasswordAge[0]/86400)
+    maxdays = [math]::Round($_.MaxPasswordAge[0]/86400)
+    warndays = $null
+    badpasswordattempts = $_.BadPasswordAttempts[0]
+    maxbadpasswords = $_.MaxBadPasswordsAllowed[0]
+    gid = $null
+    group = $null
+    groups = $null
+    home = $_.HomeDirectory[0]
+    shell = $null
+    domain = $Computername
+  }
+} | ConvertTo-Json
       EOH
-
       cmd = inspec.powershell(script)
-
       # cannot rely on exit code for now, successful command returns exit code 1
       # return nil if cmd.exit_status != 0, try to parse json
       begin
-        params = JSON.parse(cmd.stdout)
+        users = JSON.parse(cmd.stdout)
       rescue JSON::ParserError => _e
         return nil
       end
 
-      user_hash = params['User'] || {}
-      group_hashes = params['Groups'] || []
-      # if groups is no array, generate one
-      group_hashes = [group_hashes] unless group_hashes.is_a?(Array)
-      group_names = group_hashes.map { |grp| grp['Caption'] }
-      {
-        uid: user_hash['SID'],
-        username: user_hash['Caption'],
-        gid: nil,
-        group: nil,
-        groups: group_names,
-        disabled: user_hash['Disabled'],
-      }
-    end
-
-    # not implemented yet
-    def meta_info(_username)
-      {
-        home: nil,
-        shell: nil,
-      }
-    end
-
-    def list_users
-      script = 'Get-WmiObject Win32_UserAccount | Select-Object -ExpandProperty Caption'
-      cmd = inspec.powershell(script)
-      cmd.stdout.chomp.lines
+      # ensure we have an array of groups
+      users = [users] if !users.is_a?(Array)
+      # convert keys to symbols
+      @users_cache = users.map { |user| user.each_with_object({}) { |(k, v), h| h[k.to_sym] = v } }
     end
   end
 end