inspec 0.9.10 → 0.9.11

data/lib/resources/user.rb

@@ -38,7 +38,7 @@
 require 'utils/parser'
 require 'utils/convert'
 
-class User < Inspec.resource(1)
+class User < Inspec.resource(1) # rubocop:disable Metrics/ClassLength
   name 'user'
   desc 'Use the user InSpec audit resource to test user profiles, including the groups to which they belong, the frequency of required password changes, the directory paths to home and shell.'
   example "
@@ -53,63 +53,65 @@ class User < Inspec.resource(1)
 
     # select package manager
     @user_provider = nil
-    case inspec.os[:family]
-    when 'ubuntu', 'debian', 'redhat', 'fedora', 'centos', 'arch', 'opensuse', 'wrlinux'
+    os = inspec.os
+    if os.linux?
       @user_provider = LinuxUser.new(inspec)
-    when 'windows'
+    elsif os.windows?
       @user_provider = WindowsUser.new(inspec)
-    when 'darwin'
+    elsif ['darwin'].include?(os[:family])
       @user_provider = DarwinUser.new(inspec)
-    when 'freebsd'
+    elsif ['freebsd'].include?(os[:family])
       @user_provider = FreeBSDUser.new(inspec)
-    when 'aix'
+    elsif ['aix'].include?(os[:family])
       @user_provider = AixUser.new(inspec)
+    elsif os.solaris?
+      @user_provider = SolarisUser.new(inspec)
     else
       return skip_resource 'The `user` resource is not supported on your OS yet.'
     end
   end
 
   def exists?
-    !identiy.nil? && !identiy[:user].nil?
+    !identity.nil? && !identity[:user].nil?
   end
 
   def uid
-    identiy.nil? ? nil : identiy[:uid]
+    identity[:uid] unless identity.nil?
   end
 
   def gid
-    identiy.nil? ? nil : identiy[:gid]
+    identity[:gid] unless identity.nil?
   end
 
   def group
-    identiy.nil? ? nil : identiy[:group]
+    identity[:group] unless identity.nil?
   end
 
   def groups
-    identiy.nil? ? nil : identiy[:groups]
+    identity[:groups] unless identity.nil?
   end
 
   def home
-    meta_info.nil? ? nil : meta_info[:home]
+    meta_info[:home] unless meta_info.nil?
   end
 
   def shell
-    meta_info.nil? ? nil : meta_info[:shell]
+    meta_info[:shell] unless meta_info.nil?
   end
 
   # returns the minimum days between password changes
   def mindays
-    credentials.nil? ? nil : credentials[:mindays]
+    credentials[:mindays] unless credentials.nil?
   end
 
   # returns the maximum days between password changes
   def maxdays
-    credentials.nil? ? nil : credentials[:maxdays]
+    credentials[:maxdays] unless credentials.nil?
   end
 
   # returns the days for password change warning
   def warndays
-    credentials.nil? ? nil : credentials[:warndays]
+    credentials[:warndays] unless credentials.nil?
   end
 
   # implement 'mindays' method to be compatible with serverspec
@@ -154,13 +156,13 @@ class User < Inspec.resource(1)
     "User #{@user}"
   end
 
-  private
-
-  def identiy
+  def identity
     return @id_cache if defined?(@id_cache)
     @id_cache = @user_provider.identity(@user) if !@user_provider.nil?
   end
 
+  private
+
   def meta_info
     return @meta_cache if defined?(@meta_cache)
     @meta_cache = @user_provider.meta_info(@user) if !@user_provider.nil?
@@ -186,6 +188,13 @@ end
 
 # implements generic unix id handling
 class UnixUser < UserInfo
+  attr_reader :inspec, :id_cmd
+  def initialize(inspec)
+    @inspec = inspec
+    @id_cmd ||= 'id'
+    super
+  end
+
   # parse one id entry like '0(wheel)''
   def parse_value(line)
     SimpleConfig.new(
@@ -199,7 +208,7 @@ class UnixUser < UserInfo
 
   # extracts the identity
   def identity(username)
-    cmd = inspec.command("id #{username}")
+    cmd = inspec.command("#{id_cmd} #{username}")
     return nil if cmd.exit_status != 0
 
     # parse words
@@ -265,6 +274,18 @@ class LinuxUser < UnixUser
   end
 end
 
+class SolarisUser < LinuxUser
+  def initialize(inspec)
+    @inspec = inspec
+    @id_cmd ||= 'id -a'
+    super
+  end
+
+  def credentials(_username)
+    nil
+  end
+end
+
 class AixUser < UnixUser
   def identity(username)
     id = super(username)

data/lib/utils/parser.rb

@@ -92,3 +92,88 @@ module MountParser
     mount_options
   end
 end
+
+module SolarisNetstatParser
+  # takes this as a input and parses the values
+  # UDP: IPv4
+  #    Local Address        Remote Address      State
+  # -------------------- -------------------- ----------
+  #       *.*                                 Unbound
+  def parse_netstat(content) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
+    return [] if content.nil? || content.empty?
+
+    protocol = nil
+    column_widths = nil
+    ports = []
+    cache_name_line = nil
+
+    content.each_line { |line|
+      # find header, its delimiter
+      if line =~ /TCP:|UDP:|SCTP:/
+        # get protocol
+        protocol = line.split(':')[0].chomp.strip.downcase
+
+        # determine version tcp, tcp6, udp, udp6
+        proto_version = line.split(':')[1].chomp.strip
+        protocol += '6' if proto_version == 'IPv6'
+
+        # reset names cache
+        column_widths = nil
+        cache_name_line = nil
+        names = nil
+      # calulate width of a column based on the horizontal line
+      elsif line =~ /^[- ]+$/
+        column_widths = columns(line)
+      # parse header values from line
+      elsif column_widths.nil? && !line.nil?
+        # we do not know the width at this point of time, therefore we need to cache
+        cache_name_line = line
+      # content line
+      elsif !column_widths.nil? && !line.nil? && !line.chomp.empty?
+        # default row
+        port = split_columns(column_widths, line).to_a.map { |v| v.chomp.strip }
+
+        # parse the header names
+        # TODO: names should be optional
+        names = split_columns(column_widths, cache_name_line).to_a.map { |v| v.chomp.strip.downcase.tr(' ', '-').gsub(/[^\w-]/, '_') }
+        info = {
+          'protocol' => protocol.downcase,
+        }
+
+        # generate hash for each line and use the names as keys
+        names.each_index { |i|
+          info[names[i]] = port[i] if i != 0
+        }
+
+        ports.push(info)
+      end
+    }
+    ports
+  end
+
+  private
+
+  # takes a line like "-------------------- -------------------- ----------"
+  # as input and calculates the length of each column
+  def columns(line)
+    # find all columns
+    m = line.scan(/-+/)
+    # calculate the length each column
+    m.map { |x| x.length } # rubocop:disable Style/SymbolProc
+  end
+
+  # takes a line and the width of the columns to extract the values
+  def split_columns(columns, line)
+    # generate regex based on columns
+    sep = '\\s'
+    length = columns.length
+    arr = columns.map.with_index { |x, i|
+      reg = "(.{#{x}})#{sep}" # add seperator between columns
+      reg = "(.{,#{x}})#{sep}" if i == length - 2 # make the pre-last one optional
+      reg = "(.{,#{x}})" if i == length - 1 # use , to say max value
+      reg
+    }
+    # extracts the columns
+    line.match(Regexp.new(arr.join))
+  end
+end

data/test/helper.rb

@@ -40,6 +40,8 @@ class MockLoader
       ubuntu1504: { family: 'ubuntu', release: '15.04', arch: 'x86_64' },
       windows:    { family: 'windows', release: nil, arch: nil },
       wrlinux:    { family: 'wrlinux', release: '7.0(3)I2(2)', arch: 'x86_64' },
+      solaris11:  { family: "solaris", release: '11', arch: 'i386'},
+      solaris10:  { family: "solaris", release: '10', arch: 'i386'},
       undefined:  { family: nil, release: nil, arch: nil },
     }
 
@@ -202,6 +204,12 @@ class MockLoader
       # mount
       "mount | grep -- ' on /'" => cmd.call("mount"),
       "mount | grep -- ' on /mnt/iso-disk'" => cmd.call("mount-multiple"),
+      # solaris 10 package manager
+      'pkginfo -l SUNWzfsr' => cmd.call('pkginfo-l-SUNWzfsr'),
+      # solaris 11 package manager
+      'pkg info system/file-system/zfs' => cmd.call('pkg-info-system-file-system-zfs'),
+      # port netstat on solaris 10 & 11
+      'netstat -an -f inet -f inet6' => cmd.call('s11-netstat-an-finet-finet6'),
     }
 
     @backend

data/test/integration/.kitchen.chef.yml

@@ -0,0 +1,29 @@
+---
+driver:
+  name: vagrant
+
+provisioner:
+  name: chef_zero
+  require_chef_omnibus:  12.6.0
+
+verifier:
+  name: inspec
+  sudo: true
+
+platforms:
+  - name: chef/windows-server-2008r2-standard
+    transport:
+      name: winrm
+      username: administrator
+  - name: chef/windows-server-2012r2-standard
+    transport:
+      name: winrm
+      username: administrator
+  - name: chef/solaris-10.11
+  - name: chris-rock/omnios-r151014
+
+suites:
+  - name: default
+    run_list:
+      - recipe[os_prepare]
+    attributes:

data/test/integration/.kitchen.ec2.yml

@@ -1,23 +1,29 @@
 driver:
   name: ec2
   region: eu-central-1
-  instance_type: m3.large
+  instance_type: m3.medium
   associate_public_ip: true
+  security_group_ids: ["travis-ci"]
   interface: dns
 
 transport:
-  ssh_key: /path/to/aws.pem
   username: ec2-user
+  ssh_key: <%= ENV['EC2_SSH_KEY_PATH'] %>
 
 platforms:
+  - name: windows-2008
+    driver:
+      image_id: ami-58918e34
+    transport:
+      username: administrator
   - name: windows-2012
     driver:
-      image_id: ami-58f7fb45
+      image_id: ami-44918e28
     transport:
       username: administrator
   - name: windows-2012r2
     driver:
-      image_id: ami-f2f5f9ef
+      image_id: ami-8a918ee6
     transport:
       username: administrator
   - name: suse-11sp3

data/test/integration/.kitchen.shell.yml

@@ -0,0 +1,19 @@
+---
+driver:
+  name: vagrant
+
+provisioner:
+  name: shell
+
+verifier:
+  name: inspec
+  sudo: true
+
+platforms:
+  - name: chris-rock/omnios-r151014
+
+suites:
+  - name: default
+    run_list:
+      - recipe[os_prepare]
+    attributes:

data/test/integration/.kitchen/default-chef-solaris-1011.yml

@@ -0,0 +1,6 @@
+---
+hostname: 127.0.0.1
+port: '2203'
+username: vagrant
+ssh_key: "/Users/chartmann/Development/compliance/inspec/test/integration/.kitchen/kitchen-vagrant/kitchen-integration-default-chef-solaris-1011/.vagrant/machines/default/virtualbox/private_key"
+last_action: verify

data/test/integration/.kitchen/default-chef-windows-server-2008r2-standard.yml

@@ -0,0 +1,7 @@
+---
+hostname: 127.0.0.1
+port: '5985'
+username: vagrant
+password: vagrant
+rdp_port: '3389'
+last_action: setup

data/test/integration/.kitchen/default-chef-windows-server-2012r2-standard.yml

@@ -0,0 +1,7 @@
+---
+hostname: 127.0.0.1
+port: '2201'
+username: vagrant
+password: vagrant
+rdp_port: '3389'
+last_action: setup

data/test/integration/.kitchen/default-chris-rock-omnios-r151014.yml

@@ -0,0 +1,6 @@
+---
+hostname: 127.0.0.1
+port: '2200'
+username: vagrant
+ssh_key: "/Users/chartmann/Development/compliance/inspec/test/integration/.kitchen/kitchen-vagrant/kitchen-integration-default-chris-rock-omnios-r151014/.vagrant/machines/default/virtualbox/private_key"
+last_action: setup

data/test/integration/.kitchen/default-debian-81.yml

@@ -0,0 +1,6 @@
+---
+hostname: 127.0.0.1
+port: '2206'
+username: vagrant
+ssh_key: "/Users/chartmann/Development/compliance/inspec/test/integration/.kitchen/kitchen-vagrant/kitchen-integration-default-debian-81/.vagrant/machines/default/virtualbox/private_key"
+last_action: setup

data/test/integration/.kitchen/default-omniti-omnios-r151014.yml

@@ -0,0 +1 @@
+--- {}

data/test/integration/.kitchen/default-windows-2008.yml

@@ -0,0 +1,5 @@
+---
+server_id: i-0c29a8b0
+hostname: ec2-52-29-149-42.eu-central-1.compute.amazonaws.com
+password: T2GSmM)6LVn
+last_action: create

data/test/integration/.kitchen/kitchen-vagrant/kitchen-integration-default-chef-solaris-1011/.vagrant/machines/default/virtualbox/action_set_name

@@ -0,0 +1 @@
+1454069512

data/test/integration/.kitchen/kitchen-vagrant/kitchen-integration-default-chef-solaris-1011/.vagrant/machines/default/virtualbox/id

@@ -0,0 +1 @@
+8adc19dd-9fa2-4777-94de-a1df2e8471e7

data/test/integration/.kitchen/kitchen-vagrant/kitchen-integration-default-chef-solaris-1011/.vagrant/machines/default/virtualbox/index_uuid

@@ -0,0 +1 @@
+e6f37b9f28554dc4aad522187ccf089f

data/test/integration/.kitchen/kitchen-vagrant/kitchen-integration-default-chef-solaris-1011/.vagrant/machines/default/virtualbox/private_key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEApWAcKLP2eoi1xXjpwfDbzdwnlDdoX0eSR8LAfBMlk07PKNCT
+m20KFvqoJPP0AAMld1AQb4iMUdipJvvlZixc9guIAPIS7J08/0Lu+YKRcVlBBsnj
+70IBEIv3H2bUCcSwyTT1M7E/8WTMS84s214GMREFh4ncidK3GX1CxgQfWDkEG67W
+4RorboUiqtV6Cha3aXKcyyOKMdCu/GR5A+QpykzeOm3K/pkw6kifpnrMrfMOgE9h
+OE1V698/1l15879TZxR8q5S5GuA/oJzuAvqR9zeNTCtlYeFunZsvFCueqeRoMeJX
+FPIy1gXmKHFo97LEp2uvVySU58XrTgbI+zzWRQIDAQABAoIBAAyf4KZuzpMeGpo/
+l8C5bV4yv0a+UBZt9UnLITyXjZfIPWJFQe9sjIeijPF9OhRCKTsJfqe1Cdk5q/gQ
+5Ls/Cb2ytag00qMDgeOOrYWYpRe9E4y8Hs1mAYTM2omoJOm1/TTu+QUAM/xukHX9
+AEmizOA0B3MIYDCZSGcGu/E34VivqiW4L88E9Ot4ZcRw4k/xElTN4c9DynLtfZeV
+GC4YzQ58VcY3MRNo6ogbtYLpAQ3wpFvU21pMBvlWO3JDWr3On3ORiSydncQun7og
+ZTFWc5dTJE1MVZjKbKw+surEMnsWUUtSuzzkTQc7x9D8Bb4SvVRbYQYKnEciIJyF
+mskiG+UCgYEA1BOnIufVYg1eMnu3TeYSJR7n2V76SRgC5VXzNSixZRWmgZjAmNNh
+ean7YRgagZ4ndD2U7J9r7mbkv8FltqrHcQdArsflyAZirdPQ78JsYheY4xEsubVA
+oaVrd0vWU0qBUHDZRj3QZKY2VoVVCVodQfo/l9LjIOod3HbRXHUfwQMCgYEAx6BY
+EB57FJOWuyE3t/Gy5Csc+UvXtICA9LshgRiaOY/JtN7TWnWeQxh6zfO3VYDK7A5f
+Aam/NZxaMrBG3s5L/k2PgaOuaRUVpjqzxhT6NYN6QGPLm+hkjPk970cFw8Jo9S6W
+avgBn7+1aTiVqKEXDO5TXtM6h2WptV0Od+WZ1RcCgYB/AYYGkXBo2DihYxXTwQT8
+1hVjSE37mDWjwmV0YHpcXyroUeKFo5Gsmu/Apf65wU0/f+HAE3k/vL8hV2DilEP8
+nKtQAMbLk4dlMoTeEUF3PUqCMbbnQHUEWVyShQhFuUjYM7zrI/m5TREdn5vdjeoX
+qRaMhe8ftxVLAp0/EaWCoQKBgCKka8PYVkma1ySAPjgYpI+9/5gvli5Hwpk1xDmv
++EuW7U0LAiiHksBYBi+pZJ5c7FoMoGYcfAckq+5x8sqFiGCIOygnLIQl2YzwUPRF
+/am9uEBmURYsPQ7NzfaxH4n6OdaakBXeFgIP9b5dyHLsCaD/1s304ApRFSNZE8Kw
+wIJfAoGAZJxLJauryB94O3ITA3Aqb5BwQwng7jROI5XLFX3iMax5QNMIe0ZgNCro
+nNZOTJUR/1DbIQDqOYAvPtSHPhKYuN1I7TpBILhtOvNfvcbMtT0cHwFiuKgsb2lR
+Coyj34c6ZDe2QM/ShuIkN7ViDSd5DDQAE+cQV9/qaR+SkCWpFhI=
+-----END RSA PRIVATE KEY-----

data/test/integration/.kitchen/kitchen-vagrant/kitchen-integration-default-chef-solaris-1011/Vagrantfile

@@ -0,0 +1,8 @@
+Vagrant.configure("2") do |c|
+  c.berkshelf.enabled = false if Vagrant.has_plugin?("vagrant-berkshelf")
+  c.vm.box = "chef/solaris-10.11"
+  c.vm.hostname = "default-chef-solaris-1011"
+  c.vm.synced_folder ".", "/vagrant", disabled: true
+  c.vm.provider :virtualbox do |p|
+  end
+end

data/test/integration/.kitchen/kitchen-vagrant/kitchen-integration-default-chef-windows-server-2008r2-standard/.vagrant/machines/default/virtualbox/action_set_name

@@ -0,0 +1 @@
+1454020568