inspec 0.9.0

data/lib/resources/iptables.rb

@@ -0,0 +1,65 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# Usage:
+# describe iptables do
+#   it { should have_rule('-P INPUT ACCEPT') }
+# end
+#
+# The following serverspec sytax is not implemented:
+# describe iptables do
+#   it { should have_rule('-P INPUT ACCEPT').with_table('mangle').with_chain('INPUT') }
+# end
+# Please use the new sytax:
+# describe iptables(table:'mangle', chain: 'input') do
+#   it { should have_rule('-P INPUT ACCEPT') }
+# end
+#
+# Note: Docker containers normally do not have iptables installed
+#
+# @see http://ipset.netfilter.org/iptables.man.html
+# @see http://ipset.netfilter.org/iptables.man.html
+# @see https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html
+class IpTables < Inspec.resource(1)
+  name 'iptables'
+
+  def initialize(params = {})
+    @table = params[:table] || nil
+    @chain = params[:chain] || nil
+
+    # we're done if we are on linux
+    return if inspec.os.linux?
+
+    # ensures, all calls are aborted for non-supported os
+    @iptables_cache = []
+    skip_resource 'The `iptables` resource is not supported on your OS yet.'
+  end
+
+  def has_rule?(rule = nil, _table = nil, _chain = nil)
+    found = false
+    retrieve_rules.each { |line|
+      # checks if the rule is part of the ruleset
+      # for now, we expect an excact match
+      found = true if line.downcase == rule.downcase
+    }
+    found
+  end
+
+  def retrieve_rules
+    return @iptables_cache if defined?(@iptables_cache)
+
+    # construct iptables command to read all rules
+    @table.nil? ? table_cmd = '' : table_cmd = " -t #{@table} "
+    @chain.nil? ? chain_cmd = '' : chain_cmd = " #{@chain}"
+    cmd = inspec.command(format('iptables %s -S %s', table_cmd, chain_cmd).strip)
+    return [] if cmd.exit_status.to_i != 0
+
+    # split rules, returns array or rules
+    @iptables_cache = cmd.stdout.chomp.split("\n")
+  end
+
+  def to_s
+    format('Iptables %s %s', @table.nil? ? '' : "table: #{@table}", @chain.nil? ? '' : "chain: #{@chain}").strip
+  end
+end

data/lib/resources/json.rb

@@ -0,0 +1,64 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# Parses a json document
+# Usage:
+# describe json('policyfile.lock.json') do
+#   its('cookbook_locks.omnibus.version') { should eq('2.2.0') }
+# end
+class JsonConfig < Inspec.resource(1)
+  name 'json'
+
+  # make params readable
+  attr_reader :params
+
+  def initialize(path)
+    @path = path
+    @file_content = inspec.file(@path).content
+    @params = parse(@file_content)
+  end
+
+  def parse(content)
+    require 'json'
+    JSON.parse(content)
+  end
+
+  def extract_value(keys, value)
+    key = keys.shift
+    return nil if key.nil?
+
+    # check if key is a num, try to extract from array
+    if key.to_i.to_s == key
+      value = value[key.to_i]
+    # if value is an array, iterate over each child
+    elsif value.is_a?(Array)
+      value = value.map { |i|
+        extract_value([key], i)
+      }
+    # normal value extraction
+    else
+      value = value[key].nil? ? nil : value[key]
+    end
+
+    # check if further keys exist
+    if !keys.first.nil?
+      return extract_value(keys.clone, value)
+    else
+      return value
+    end
+  end
+
+  # Shorthand to retrieve a parameter name via `#its`.
+  # Example: describe json('file') { its('paramX') { should eq 'Y' } }
+  #
+  # @param [String] name name of the field to retrieve
+  # @return [Object] the value stored at this position
+  def method_missing(name)
+    @params[name.to_s]
+  end
+
+  def to_s
+    "Json #{@path}"
+  end
+end

data/lib/resources/kernel_module.rb

@@ -0,0 +1,40 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+# license: All rights reserved
+
+# Verifies if a kernel module is loaded
+# Usage:
+# describe kernel_module('bridge') do
+#   it { should be_loaded }
+# end
+class KernelModule < Inspec.resource(1)
+  name 'kernel_module'
+
+  def initialize(modulename = nil)
+    @module = modulename
+
+    # this resource is only supported on Linux
+    return skip_resource 'The `kernel_parameter` resource is not supported on your OS.' if !inspec.os.linux?
+  end
+
+  def loaded?
+    # default lsmod command
+    lsmod_cmd = 'lsmod'
+    # special care for CentOS 5 and sudo
+    lsmod_cmd = '/sbin/lsmod' if inspec.os[:family] == 'centos' && inspec.os[:release].to_i == 5
+
+    # get list of all modules
+    cmd = inspec.command(lsmod_cmd)
+    return false if cmd.exit_status != 0
+
+    # check if module is loaded
+    re = Regexp.new('^'+Regexp.quote(@module)+'\s')
+    found = cmd.stdout.match(re)
+    !found.nil?
+  end
+
+  def to_s
+    "Kernel Module #{@module}"
+  end
+end

data/lib/resources/kernel_parameter.rb

@@ -0,0 +1,55 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# license: All rights reserved
+
+# Verifies if a kernel parameter is set
+# describe kernel_parameter('net.ipv4.conf.all.forwarding') do
+#   its(:value) { should eq 0 }
+# end
+class KernelParameter < Inspec.resource(1)
+  name 'kernel_parameter'
+
+  def initialize(parameter = nil)
+    @parameter = parameter
+
+    # this resource is only supported on Linux
+    return skip_resource 'The `kernel_parameter` resource is not supported on your OS.' if !inspec.os.linux?
+  end
+
+  def value
+    cmd = inspec.command("/sbin/sysctl -q -n #{@parameter}")
+    return nil if cmd.exit_status != 0
+    # remove whitespace
+    cmd = cmd.stdout.chomp.strip
+    # convert to number if possible
+    cmd = cmd.to_i if cmd.match(/^\d+$/)
+    cmd
+  end
+
+  def to_s
+    "Kernel Parameter #{@parameter}"
+  end
+end
+
+# for compatability with serverspec
+# this is deprecated syntax and will be removed in future versions
+class LinuxKernelParameter < KernelParameter
+  name 'linux_kernel_parameter'
+
+  def initialize(parameter)
+    super(parameter)
+  end
+
+  def value
+    deprecated
+    super()
+  end
+
+  def deprecated
+    warn '[DEPRECATION] `linux_kernel_parameter(parameter)` is deprecated.  Please use `kernel_parameter(parameter)` instead.'
+  end
+
+  def to_s
+    "Kernel Parameter #{@parameter}"
+  end
+end

data/lib/resources/limits_conf.rb

@@ -0,0 +1,55 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Christoph Hartmann
+# author: Dominik Richter
+# license: All rights reserved
+
+require 'utils/simpleconfig'
+
+# Usage:
+#
+# describe limits_conf do
+#   its('*') { should include ['hard','core','0'] }
+# end
+
+class LimitsConf < Inspec.resource(1)
+  name 'limits_conf'
+
+  def initialize(path = nil)
+    @conf_path = path || '/etc/security/limits.conf'
+  end
+
+  def method_missing(name)
+    read_params[name.to_s]
+  end
+
+  def read_params
+    return @params if defined?(@params)
+
+    # read the file
+    file = inspec.file(@conf_path)
+    if !file.file?
+      skip_resource "Can't find file \"#{@conf_path}\""
+      return @params = {}
+    end
+
+    content = file.content
+    if content.empty? && file.size > 0
+      skip_resource "Can't read file \"#{@conf_path}\""
+      return @params = {}
+    end
+
+    # parse the file
+    conf = SimpleConfig.new(
+      content,
+      assignment_re: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
+      key_vals: 3,
+      multiple_values: true,
+    )
+    @params = conf.params
+  end
+
+  def to_s
+    'limits.conf'
+  end
+end

data/lib/resources/login_def.rb

@@ -0,0 +1,60 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Christoph Hartmann
+# author: Dominik Richter
+# license: All rights reserved
+
+require 'utils/simpleconfig'
+
+# Usage:
+#
+# describe login_def do
+#   its('UMASK') {
+#     should eq '077'
+#   }
+#
+#   its('PASS_MAX_DAYS.to_i') {
+#     should be <= 90
+#   }
+# end
+
+class LoginDef < Inspec.resource(1)
+  name 'login_defs'
+
+  def initialize(path = nil)
+    @conf_path = path || '/etc/login.defs'
+  end
+
+  def method_missing(name)
+    read_params[name.to_s]
+  end
+
+  def read_params
+    return @params if defined?(@params)
+
+    # read the file
+    file = inspec.file(@conf_path)
+    if !file.file?
+      skip_resource "Can't find file \"#{@conf_path}\""
+      return @params = {}
+    end
+
+    content = file.content
+    if content.empty? && file.size > 0
+      skip_resource "Can't read file \"#{@conf_path}\""
+      return @params = {}
+    end
+
+    # parse the file
+    conf = SimpleConfig.new(
+      content,
+      assignment_re: /^\s*(\S+)\s+(\S*)\s*$/,
+      multiple_values: false,
+    )
+    @params = conf.params
+  end
+
+  def to_s
+    'login.defs'
+  end
+end

data/lib/resources/mysql.rb

@@ -0,0 +1,81 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Dominik Richter
+# author: Christoph Hartmann
+# license: All rights reserved
+
+class Mysql < Inspec.resource(1)
+  name 'mysql'
+
+  attr_reader :package, :service, :conf_dir, :conf_path, :data_dir, :log_dir, :log_path, :log_group, :log_dir_group
+  def initialize
+    # set OS-dependent filenames and paths
+    case inspec.os[:family]
+    when 'ubuntu', 'debian'
+      init_ubuntu
+    when 'redhat', 'fedora'
+      init_redhat
+    when 'arch'
+      init_arch
+    else
+      # TODO: could not detect
+      init_default
+    end
+  end
+
+  def init_ubuntu
+    @package = 'mysql-server'
+    @service = 'mysql'
+    @conf_path = '/etc/mysql/my.cnf'
+    @conf_dir = '/etc/mysql/'
+    @data_dir = '/var/lib/mysql/'
+    @log_dir = '/var/log/'
+    @log_path = '/var/log/mysql.log'
+    @log_group = 'adm'
+    case os[:release]
+    when '14.04'
+      @log_dir_group = 'syslog'
+    else
+      @log_dir_group = 'root'
+    end
+  end
+
+  def init_redhat
+    @package = 'mysql-server'
+    @service = 'mysqld'
+    @conf_path = '/etc/my.cnf'
+    @conf_dir = '/etc/'
+    @data_dir = '/var/lib/mysql/'
+    @log_dir = '/var/log/'
+    @log_path = '/var/log/mysqld.log'
+    @log_group = 'mysql'
+    @log_dir_group = 'root'
+  end
+
+  def init_arch
+    @package = 'mariadb'
+    @service = 'mysql'
+    @conf_path = '/etc/mysql/my.cnf'
+    @conf_dir = '/etc/mysql/'
+    @data_dir = '/var/lib/mysql/'
+    @log_dir = '/var/log/'
+    @log_path = '/var/log/mysql.log'
+    @log_group = 'mysql'
+    @log_dir_group = 'root'
+  end
+
+  def init_default
+    @service = 'mysqld'
+    @conf_path = '/etc/my.cnf'
+    @conf_dir = '/etc/'
+    @data_dir = '/var/lib/mysql/'
+    @log_dir = '/var/log/'
+    @log_path = '/var/log/mysqld.log'
+    @log_group = 'mysql'
+    @log_dir_group = 'root'
+  end
+
+  def to_s
+    'MySQL'
+  end
+end

data/lib/resources/mysql_conf.rb

@@ -0,0 +1,116 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Dominik Richter
+# license: All rights reserved
+
+require 'utils/simpleconfig'
+require 'utils/find_files'
+require 'utils/hash'
+require 'resources/mysql'
+
+class MysqlConfEntry
+  def initialize(path, params)
+    @params = params
+    @path = path
+  end
+
+  def method_missing(name, *_)
+    k = name.to_s
+    res = @params[k]
+    return true if res.nil? && @params.key?(k)
+    @params[k]
+  end
+
+  def to_s
+    "MySQL Config entry [#{@path.join(' ')}]"
+  end
+end
+
+class MysqlConf < Inspec.resource(1)
+  name 'mysql_conf'
+
+  include FindFiles
+
+  def initialize(conf_path = nil)
+    @conf_path = conf_path || inspec.mysql.conf_path
+    @files_contents = {}
+    @content = nil
+    @params = nil
+    read_content
+  end
+
+  def content
+    @content ||= read_content
+  end
+
+  def params(*opts)
+    @params || read_content
+    res = @params
+    opts.each do |opt|
+      res = res[opt] unless res.nil?
+    end
+    MysqlConfEntry.new(opts, res)
+  end
+
+  def method_missing(name)
+    @params || read_content
+    @params[name.to_s]
+  end
+
+  def read_content
+    @content = ''
+    @params = {}
+
+    # skip if the main configuration file doesn't exist
+    if !inspec.file(@conf_path).file?
+      return skip_resource "Can't find file \"#{@conf_path}\""
+    end
+    raw_conf = read_file(@conf_path)
+    if raw_conf.empty? && inspec.file(@conf_path).size > 0
+      return skip_resource("Can't read file \"#{@conf_path}\"")
+    end
+
+    to_read = [@conf_path]
+    until to_read.empty?
+      cur_file = to_read[0]
+      raw_conf = read_file(cur_file)
+      @content += raw_conf
+
+      params = SimpleConfig.new(raw_conf).params
+      @params = @params.deep_merge(params)
+
+      to_read = to_read.drop(1)
+      # see if there is more stuff to include
+
+      dir = File.dirname(cur_file)
+      to_read += include_files(dir, raw_conf).find_all do |fp|
+        not @files_contents.key? fp
+      end
+    end
+    #
+    @content
+  end
+
+  def include_files(reldir, conf)
+    files = conf.scan(/^!include\s+(.*)\s*/).flatten.compact.map { |x| abs_path(reldir, x) }
+    dirs = conf.scan(/^!includedir\s+(.*)\s*/).flatten.compact.map { |x| abs_path(reldir, x) }
+    dirs.map do |dir|
+      # @TODO: non local glob
+      files += find_files(dir, depth: 1, type: 'file')
+    end
+    files
+  end
+
+  def abs_path(dir, f)
+    return f if f.start_with? '/'
+    File.join(dir, f)
+  end
+
+  def read_file(path)
+    @files_contents[path] ||= inspec.file(path).content
+  end
+
+  def to_s
+    'MySQL Configuration'
+  end
+end