inspec 0.9.0

data/lib/resources/mysql_session.rb

@@ -0,0 +1,52 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Dominik Richter
+# author: Christoph Hartmann
+# license: All rights reserved
+
+class MysqlSession < Inspec.resource(1)
+  name 'mysql_session'
+
+  def initialize(user = nil, pass = nil)
+    @user = user
+    @pass = pass
+    init_fallback if user.nil? or pass.nil?
+    skip_resource("Can't run MySQL SQL checks without authentication") if @user.nil? or @pass.nil?
+  end
+
+  def query(q, db = '')
+    # TODO: simple escape, must be handled by a library
+    # that does this securely
+    escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
+
+    # run the query
+    cmd = inspec.command("mysql -u#{@user} -p#{@pass} #{db} -s -e \"#{escaped_query}\"")
+    out = cmd.stdout + "\n" + cmd.stderr
+    if out =~ /Can't connect to .* MySQL server/ or
+       out.downcase =~ /^error/
+      # skip this test if the server can't run the query
+      skip_resource("Can't connect to MySQL instance for SQL checks.")
+    end
+
+    # return the raw command output
+    cmd
+  end
+
+  def to_s
+    'MySQL Session'
+  end
+
+  private
+
+  def init_fallback
+    # support debian mysql administration login
+    debian = inspec.command('test -f /etc/mysql/debian.cnf && cat /etc/mysql/debian.cnf').stdout
+    return if debian.empty?
+
+    user = debian.match(/^\s*user\s*=\s*([^ ]*)\s*$/)
+    pass = debian.match(/^\s*password\s*=\s*([^ ]*)\s*$/)
+    return if user.nil? or pass.nil?
+    @user = user[1]
+    @pass = pass[1]
+  end
+end

data/lib/resources/npm.rb

@@ -0,0 +1,44 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# Usage:
+# describe npm('bower') do
+#   it { should be_installed }
+# end
+class NpmPackage < Inspec.resource(1)
+  name 'npm'
+
+  def initialize(package_name)
+    @package_name = package_name
+    @cache = nil
+  end
+
+  def info
+    return @info if defined?(@info)
+
+    cmd = inspec.command("npm ls -g --json #{@package_name}")
+    @info = {
+      name: @package_name,
+      type: 'npm',
+      installed: cmd.exit_status == 0,
+    }
+    return @info unless @info[:installed]
+
+    pkgs = JSON.parse(cmd.stdout)
+    @info[:version] = pkgs['dependencies'][@package_name]['version']
+    @info
+  end
+
+  def installed?
+    info[:installed] == true
+  end
+
+  def version
+    info[:version]
+  end
+
+  def to_s
+    "Npm Package #{@package_name}"
+  end
+end

data/lib/resources/ntp_conf.rb

@@ -0,0 +1,58 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Christoph Hartmann
+# author: Dominik Richter
+# license: All rights reserved
+
+require 'utils/simpleconfig'
+
+# Usage:
+#
+# describe ntp_conf do
+#   its('server') { should_not eq nil }
+#   its('restrict') { should include '-4 default kod notrap nomodify nopeer noquery'}
+# end
+
+class NtpConf < Inspec.resource(1)
+  name 'ntp_conf'
+
+  def initialize(path = nil)
+    @conf_path = path || '/etc/ntp.conf'
+  end
+
+  def method_missing(name)
+    param = read_params[name.to_s]
+    # extract first value if we have only one value in array
+    return param[0] if param.is_a?(Array) and param.length == 1
+    param
+  end
+
+  def to_s
+    'ntp.conf'
+  end
+
+  private
+
+  def read_params
+    return @params if defined?(@params)
+
+    if !inspec.file(@conf_path).file?
+      skip_resource "Can't find file \"#{@conf_path}\""
+      return @params = {}
+    end
+
+    content = inspec.file(@conf_path).content
+    if content.empty? && inspec.file(@conf_path).size > 0
+      skip_resource "Can't read file \"#{@conf_path}\""
+      return @params = {}
+    end
+
+    # parse the file
+    conf = SimpleConfig.new(
+      content,
+      assignment_re: /^\s*(\S+)\s+(.*)\s*$/,
+      multiple_values: true,
+    )
+    @params = conf.params
+  end
+end

data/lib/resources/oneget.rb

@@ -0,0 +1,63 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# This resource talks with OneGet (https://github.com/OneGet/oneget)
+# Its part of Windows Management Framework 5.0 and part of Windows 10
+#
+# Usage:
+# describe oneget('zoomit') do
+#   it { should be_installed }
+# end
+class OneGetPackage < Inspec.resource(1)
+  name 'oneget'
+
+  def initialize(package_name)
+    @package_name = package_name
+
+    # verify that this resource is only supported on Windows
+    return skip_resource 'The `oneget` resource is not supported on your OS.' if inspec.os[:family] != 'windows'
+  end
+
+  def info
+    return @info if defined?(@info)
+
+    @info = {}
+    @info[:type] = 'oneget'
+    @info[:installed] = false
+
+    cmd = inspec.command("Get-Package -Name '#{@package_name}' | ConvertTo-Json")
+    # cannot rely on exit code for now, successful command returns exit code 1
+    # return nil if cmd.exit_status != 0
+    # try to parse json
+
+    begin
+      pkgs = JSON.parse(cmd.stdout)
+      @info[:installed] = true
+
+      # sometimes we get multiple values
+      if pkgs.is_a?(Array)
+        # select the first entry
+        pkgs = pkgs.first
+      end
+    rescue JSON::ParserError => _e
+      return @info
+    end
+
+    @info[:name] = pkgs['Name'] if pkgs.key?('Name')
+    @info[:version] = pkgs['Version'] if pkgs.key?('Version')
+    @info
+  end
+
+  def installed?
+    info[:installed] == true
+  end
+
+  def version
+    info[:version]
+  end
+
+  def to_s
+    "OneGet Package #{@package_name}"
+  end
+end

data/lib/resources/os.rb

@@ -0,0 +1,22 @@
+# encoding: utf-8
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+class OS < Inspec.resource(1)
+  name 'os'
+
+  # reuse helper methods from backend
+  %w{redhat? debian? suse? bsd? solaris? linux? unix? windows?}.each do |os_family|
+    define_method((os_family).to_sym) do
+      inspec.backend.os.send(os_family)
+    end
+  end
+
+  def [](name)
+    inspec.backend.os[name]
+  end
+
+  def to_s
+    'Operating System Detection'
+  end
+end

data/lib/resources/os_env.rb

@@ -0,0 +1,34 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Christoph Hartmann
+# author: Dominik Richter
+# license: All rights reserved
+
+# Usage:
+#
+# describe os_env('PATH') do
+#   its(:split) { should_not include('') }
+#   its(:split) { should_not include('.') }
+# end
+
+class OsEnv < Inspec.resource(1)
+  name 'os_env'
+
+  attr_reader :content
+  def initialize(env)
+    @osenv = env
+    cmd = inspec.command("su - root -c 'echo $#{env}'")
+    @content = cmd.stdout.chomp
+    @content = nil if cmd.exit_status != 0
+  end
+
+  def split
+    # -1 is required to catch cases like dir1::dir2:
+    # where we have a trailing :
+    @content.nil? ? [] : @content.split(':', -1)
+  end
+
+  def to_s
+    "Environment Variable #{@osenv}"
+  end
+end

data/lib/resources/package.rb

@@ -0,0 +1,169 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# Resource to determine package information
+#
+# Usage:
+# describe package('nginx') do
+#   it { should be_installed }
+# end
+class Package < Inspec.resource(1)
+  name 'package'
+
+  def initialize(package_name = nil)
+    @package_name = package_name
+    @name = @package_name
+    @cache = nil
+
+    # select package manager
+    @pkgman = nil
+    case inspec.os[:family]
+    when 'ubuntu', 'debian'
+      @pkgman = Deb.new(inspec)
+    when 'redhat', 'fedora', 'centos', 'opensuse'
+      @pkgman = Rpm.new(inspec)
+    when 'arch'
+      @pkgman = Pacman.new(inspec)
+    when 'darwin'
+      @pkgman = Brew.new(inspec)
+    when 'windows'
+      @pkgman = WindowsPkg.new(inspec)
+    else
+      return skip_resource 'The `package` resource is not supported on your OS yet.'
+    end
+  end
+
+  # returns true if the package is installed
+  def installed?(_provider = nil, _version = nil)
+    return false if info.nil?
+    info[:installed] == true
+  end
+
+  # returns the package description
+  def info
+    return @cache if !@cache.nil?
+    return nil if @pkgman.nil?
+    @pkgman.info(@package_name)
+  end
+
+  # return the package version
+  def version
+    info = @pkgman.info(@package_name)
+    return nil if info.nil?
+    info[:version]
+  end
+
+  def to_s
+    "System Package #{@package_name}"
+  end
+end
+
+class PkgManagement
+  attr_reader :inspec
+  def initialize(inspec)
+    @inspec = inspec
+  end
+end
+
+# Debian / Ubuntu
+class Deb < PkgManagement
+  def info(package_name)
+    cmd = inspec.command("dpkg -s #{package_name}")
+    return nil if cmd.exit_status.to_i != 0
+
+    params = SimpleConfig.new(
+      cmd.stdout.chomp,
+      assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+      multiple_values: false,
+    ).params
+    {
+      name: params['Package'],
+      installed: true,
+      version: params['Version'],
+      type: 'deb',
+    }
+  end
+end
+
+# RHEL family
+class Rpm < PkgManagement
+  def info(package_name)
+    cmd = inspec.command("rpm -qia #{package_name}")
+    # CentOS does not return an error code if the package is not installed,
+    # therefore we need to check for emptyness
+    return nil if cmd.exit_status.to_i != 0 || cmd.stdout.chomp.empty?
+    params = SimpleConfig.new(
+      cmd.stdout.chomp,
+      assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+      multiple_values: false,
+    ).params
+    {
+      name: params['Name'],
+      installed: true,
+      version: params['Version'],
+      type: 'rpm',
+    }
+  end
+end
+
+# MacOS / Darwin implementation
+class Brew < PkgManagement
+  def info(package_name)
+    cmd = inspec.command("brew info --json=v1 #{package_name}")
+    return nil if cmd.exit_status.to_i != 0
+    # parse data
+    pkg = JSON.parse(cmd.stdout)[0]
+    {
+      name: "#{pkg.name}",
+      installed: true,
+      version: "#{pkg.installed.version}",
+      type: 'brew',
+    }
+  end
+end
+
+# Arch Linux
+class Pacman < PkgManagement
+  def info(package_name)
+    cmd = inspec.command("pacman -Qi #{package_name}")
+    return nil if cmd.exit_status.to_i != 0
+
+    params = SimpleConfig.new(
+      cmd.stdout.chomp,
+      assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+      multiple_values: false,
+    ).params
+
+    {
+      name: params['Name'],
+      installed: true,
+      version: params['Version'],
+      type: 'pacman',
+    }
+  end
+end
+
+# Determines the installed packages on Windows
+# Currently we use 'Get-WmiObject -Class Win32_Product' as a detection method
+# TODO: evaluate if alternative methods as proposed by Microsoft are still valid:
+# @see: http://blogs.technet.com/b/heyscriptingguy/archive/2013/11/15/use-powershell-to-find-installed-software.aspx
+class WindowsPkg < PkgManagement
+  def info(package_name)
+    # Find the package
+    cmd = inspec.command("Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -eq '#{package_name}'} | Select-Object -Property Name,Version,Vendor,PackageCode,Caption,Description | ConvertTo-Json")
+
+    begin
+      package = JSON.parse(cmd.stdout)
+    rescue JSON::ParserError => _e
+      return nil
+    end
+
+    {
+      name: package['Name'],
+      installed: true,
+      version: package['Version'],
+      type: 'windows',
+    }
+  end
+end