inspec 1.0.0 → 1.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (82) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +46 -3
  3. data/Gemfile +4 -1
  4. data/README.md +3 -0
  5. data/docs/dsl_inspec.md +3 -3
  6. data/docs/profiles.md +17 -0
  7. data/docs/resources/apache_conf.md.erb +10 -10
  8. data/docs/resources/apt.md.erb +13 -13
  9. data/docs/resources/audit_policy.md.erb +10 -10
  10. data/docs/resources/auditd_conf.md.erb +10 -10
  11. data/docs/resources/auditd_rules.md.erb +11 -11
  12. data/docs/resources/bash.md.erb +12 -12
  13. data/docs/resources/bond.md.erb +15 -15
  14. data/docs/resources/bridge.md.erb +11 -11
  15. data/docs/resources/bsd_service.md.erb +11 -11
  16. data/docs/resources/command.md.erb +21 -21
  17. data/docs/resources/csv.md.erb +10 -10
  18. data/docs/resources/directory.md.erb +8 -8
  19. data/docs/resources/etc_group.md.erb +16 -16
  20. data/docs/resources/etc_passwd.md.erb +17 -17
  21. data/docs/resources/etc_shadow.md.erb +19 -19
  22. data/docs/resources/file.md.erb +58 -58
  23. data/docs/resources/gem.md.erb +12 -12
  24. data/docs/resources/group.md.erb +12 -12
  25. data/docs/resources/grub_conf.md.erb +11 -11
  26. data/docs/resources/host.md.erb +13 -13
  27. data/docs/resources/iis_site.md.erb +16 -16
  28. data/docs/resources/inetd_conf.md.erb +10 -10
  29. data/docs/resources/ini.md.erb +9 -9
  30. data/docs/resources/interface.md.erb +11 -11
  31. data/docs/resources/iptables.md.erb +11 -11
  32. data/docs/resources/json.md.erb +10 -10
  33. data/docs/resources/kernel_module.md.erb +10 -10
  34. data/docs/resources/kernel_parameter.md.erb +12 -12
  35. data/docs/resources/launchd_service.md.erb +11 -11
  36. data/docs/resources/limits_conf.md.erb +10 -10
  37. data/docs/resources/login_def.md.erb +12 -12
  38. data/docs/resources/mount.md.erb +13 -13
  39. data/docs/resources/mysql_conf.md.erb +14 -14
  40. data/docs/resources/mysql_session.md.erb +10 -10
  41. data/docs/resources/npm.md.erb +12 -12
  42. data/docs/resources/ntp_conf.md.erb +9 -9
  43. data/docs/resources/oneget.md.erb +11 -11
  44. data/docs/resources/os.md.erb +13 -13
  45. data/docs/resources/os_env.md.erb +12 -12
  46. data/docs/resources/package.md.erb +15 -15
  47. data/docs/resources/parse_config.md.erb +13 -13
  48. data/docs/resources/parse_config_file.md.erb +22 -16
  49. data/docs/resources/pip.md.erb +12 -12
  50. data/docs/resources/port.md.erb +18 -18
  51. data/docs/resources/postgres_conf.md.erb +13 -13
  52. data/docs/resources/postgres_session.md.erb +11 -11
  53. data/docs/resources/powershell.md.erb +13 -13
  54. data/docs/resources/process.md.erb +12 -12
  55. data/docs/resources/registry_key.md.erb +17 -17
  56. data/docs/resources/runit_service.md.erb +11 -11
  57. data/docs/resources/security_policy.md.erb +10 -10
  58. data/docs/resources/service.md.erb +17 -17
  59. data/docs/resources/ssh_config.md.erb +13 -13
  60. data/docs/resources/sshd_config.md.erb +14 -14
  61. data/docs/resources/ssl.md.erb +12 -12
  62. data/docs/resources/sys_info.md.erb +10 -10
  63. data/docs/resources/systemd_service.md.erb +11 -11
  64. data/docs/resources/sysv_service.md.erb +11 -11
  65. data/docs/resources/upstart_service.md.erb +11 -11
  66. data/docs/resources/user.md.erb +20 -20
  67. data/docs/resources/users.md.erb +19 -19
  68. data/docs/resources/vbscript.md.erb +9 -9
  69. data/docs/resources/windows_feature.md.erb +10 -10
  70. data/docs/resources/wmi.md.erb +10 -10
  71. data/docs/resources/xinetd_conf.md.erb +17 -17
  72. data/docs/resources/yaml.md.erb +10 -10
  73. data/docs/resources/yum.md.erb +16 -16
  74. data/examples/meta-profile/README.md +0 -5
  75. data/lib/inspec/base_cli.rb +6 -0
  76. data/lib/inspec/cli.rb +10 -3
  77. data/lib/inspec/profile.rb +3 -3
  78. data/lib/inspec/rspec_json_formatter.rb +24 -15
  79. data/lib/inspec/version.rb +1 -1
  80. data/lib/resources/registry_key.rb +15 -5
  81. data/lib/utils/filter.rb +1 -0
  82. metadata +3 -4
@@ -6,7 +6,7 @@ title: About the users Resource
6
6
 
7
7
  Use the `users` InSpec audit resource to look up all local users available on the system, and then test specific properties of those users. This resource does not return information about users that may be located on other systems, such as LDAP or Active Directory.
8
8
 
9
- # Syntax
9
+ ## Syntax
10
10
 
11
11
  A `users` resource block declares a user name, and then one (or more) matchers:
12
12
 
@@ -33,29 +33,29 @@ or:
33
33
  it { should exist }
34
34
  end
35
35
 
36
- # Matchers
36
+ ## Matchers
37
37
 
38
38
  This InSpec audit resource has the following matchers:
39
39
 
40
- ## be
40
+ ### be
41
41
 
42
42
  <%= partial "/shared/matcher_be" %>
43
43
 
44
- ## cmp
44
+ ### cmp
45
45
 
46
46
  <%= partial "/shared/matcher_cmp" %>
47
47
 
48
- ## eq
48
+ ### eq
49
49
 
50
50
  <%= partial "/shared/matcher_eq" %>
51
51
 
52
- ## exist
52
+ ### exist
53
53
 
54
54
  The `exist` matcher tests if the named user exists:
55
55
 
56
56
  it { should exist }
57
57
 
58
- ## gid
58
+ ### gid
59
59
 
60
60
  The `gid` matcher tests the group identifier:
61
61
 
@@ -63,7 +63,7 @@ The `gid` matcher tests the group identifier:
63
63
 
64
64
  where `1234` represents the user identifier.
65
65
 
66
- ## group
66
+ ### group
67
67
 
68
68
  The `group` matcher tests the group to which the user belongs:
69
69
 
@@ -71,27 +71,27 @@ The `group` matcher tests the group to which the user belongs:
71
71
 
72
72
  where `root` represents the group.
73
73
 
74
- ## groups
74
+ ### groups
75
75
 
76
76
  The `groups` matcher tests two (or more) groups to which the user belongs:
77
77
 
78
78
  its('groups') { should eq ['root', 'other']}
79
79
 
80
- ## home
80
+ ### home
81
81
 
82
82
  The `home` matcher tests the home directory path for the user:
83
83
 
84
84
  its('home') { should eq '/root' }
85
85
 
86
- ## include
86
+ ### include
87
87
 
88
88
  <%= partial "/shared/matcher_include" %>
89
89
 
90
- ## match
90
+ ### match
91
91
 
92
92
  <%= partial "/shared/matcher_match" %>
93
93
 
94
- ## maxdays
94
+ ### maxdays
95
95
 
96
96
  The `maxdays` matcher tests the maximum number of days between password changes:
97
97
 
@@ -99,7 +99,7 @@ The `maxdays` matcher tests the maximum number of days between password changes:
99
99
 
100
100
  where `99` represents the maximum number of days.
101
101
 
102
- ## mindays
102
+ ### mindays
103
103
 
104
104
  The `mindays` matcher tests the minimum number of days between password changes:
105
105
 
@@ -107,13 +107,13 @@ The `mindays` matcher tests the minimum number of days between password changes:
107
107
 
108
108
  where `0` represents the maximum number of days.
109
109
 
110
- ## shell
110
+ ### shell
111
111
 
112
112
  The `shell` matcher tests the path to the default shell for the user:
113
113
 
114
114
  its('shell') { should eq '/bin/bash' }
115
115
 
116
- ## uid
116
+ ### uid
117
117
 
118
118
  The `uid` matcher tests the user identifier:
119
119
 
@@ -121,7 +121,7 @@ The `uid` matcher tests the user identifier:
121
121
 
122
122
  where `1234` represents the user identifier.
123
123
 
124
- ## warndays
124
+ ### warndays
125
125
 
126
126
  The `warndays` matcher tests the number of days a user is warned before a password must be changed:
127
127
 
@@ -129,11 +129,11 @@ The `warndays` matcher tests the number of days a user is warned before a passwo
129
129
 
130
130
  where `5` represents the number of days a user is warned.
131
131
 
132
- # Examples
132
+ ## Examples
133
133
 
134
134
  The following examples show how to use this InSpec audit resource.
135
135
 
136
- ## Use a regular expression to find users
136
+ ### Use a regular expression to find users
137
137
 
138
138
  describe users.where { uid =~ /S\-1\-5\-21\-\d+\-\d+\-\d+\-500/ } do
139
139
  it { should exist }
@@ -6,7 +6,7 @@ title: About the vbscript Resource
6
6
 
7
7
  Use the `vbscript` InSpec audit resource to test a VBScript on the Windows platform.
8
8
 
9
- # Syntax
9
+ ## Syntax
10
10
 
11
11
  A `vbscript` resource block tests the output of a VBScript on the Windows platform:
12
12
 
@@ -20,35 +20,35 @@ where
20
20
  * `('output')` is the expected output of the VBScript
21
21
 
22
22
 
23
- # Matchers
23
+ ## Matchers
24
24
 
25
25
  This InSpec audit resource has the following matchers:
26
26
 
27
- ## be
27
+ ### be
28
28
 
29
29
  <%= partial "/shared/matcher_be" %>
30
30
 
31
- ## cmp
31
+ ### cmp
32
32
 
33
33
  <%= partial "/shared/matcher_cmp" %>
34
34
 
35
- ## eq
35
+ ### eq
36
36
 
37
37
  <%= partial "/shared/matcher_eq" %>
38
38
 
39
- ## include
39
+ ### include
40
40
 
41
41
  <%= partial "/shared/matcher_include" %>
42
42
 
43
- ## match
43
+ ### match
44
44
 
45
45
  <%= partial "/shared/matcher_match" %>
46
46
 
47
- # Examples
47
+ ## Examples
48
48
 
49
49
  The following examples show how to use this InSpec audit resource.
50
50
 
51
- ## Test a VBScript
51
+ ### Test a VBScript
52
52
 
53
53
  A VBScript file similar to:
54
54
 
@@ -6,7 +6,7 @@ title: About the windows_feature Resource
6
6
 
7
7
  Use the `windows_feature` InSpec audit resource to test features on Windows via the `Get-WindowsFeature` cmdlet.
8
8
 
9
- # Syntax
9
+ ## Syntax
10
10
 
11
11
  A `windows_feature` resource block declares the name of the Windows feature, tests if that feature is installed, and then returns information about that feature:
12
12
 
@@ -20,41 +20,41 @@ where
20
20
  * `be_installed` is a valid matcher for this resource
21
21
 
22
22
 
23
- # Matchers
23
+ ## Matchers
24
24
 
25
25
  This InSpec audit resource has the following matchers:
26
26
 
27
- ## be
27
+ ### be
28
28
 
29
29
  <%= partial "/shared/matcher_be" %>
30
30
 
31
- ## be_installed
31
+ ### be_installed
32
32
 
33
33
  The `be_installed` matcher tests if the named Windows feature is installed:
34
34
 
35
35
  it { should be_installed }
36
36
 
37
- ## cmp
37
+ ### cmp
38
38
 
39
39
  <%= partial "/shared/matcher_cmp" %>
40
40
 
41
- ## eq
41
+ ### eq
42
42
 
43
43
  <%= partial "/shared/matcher_eq" %>
44
44
 
45
- ## include
45
+ ### include
46
46
 
47
47
  <%= partial "/shared/matcher_include" %>
48
48
 
49
- ## match
49
+ ### match
50
50
 
51
51
  <%= partial "/shared/matcher_match" %>
52
52
 
53
- # Examples
53
+ ## Examples
54
54
 
55
55
  The following examples show how to use this InSpec audit resource.
56
56
 
57
- ## Test the DHCP Server feature
57
+ ### Test the DHCP Server feature
58
58
 
59
59
  describe windows_feature('DHCP Server') do
60
60
  it{ should be_installed }
@@ -6,7 +6,7 @@ title: About the wmi Resource
6
6
 
7
7
  Use the `wmi` InSpec audit resource to test WMI settings on the Windows platform.
8
8
 
9
- # Syntax
9
+ ## Syntax
10
10
 
11
11
  A `wmi` resource block tests WMI settings on the Windows platform:
12
12
 
@@ -47,35 +47,35 @@ and the second uses a filter in the Ruby Hash to first identify WinRM, and then
47
47
  end
48
48
 
49
49
 
50
- # Matchers
50
+ ## Matchers
51
51
 
52
52
  This InSpec audit resource has the following matchers:
53
53
 
54
- ## be
54
+ ### be
55
55
 
56
56
  <%= partial "/shared/matcher_be" %>
57
57
 
58
- ## cmp
58
+ ### cmp
59
59
 
60
60
  <%= partial "/shared/matcher_cmp" %>
61
61
 
62
- ## eq
62
+ ### eq
63
63
 
64
64
  <%= partial "/shared/matcher_eq" %>
65
65
 
66
- ## include
66
+ ### include
67
67
 
68
68
  <%= partial "/shared/matcher_include" %>
69
69
 
70
- ## match
70
+ ### match
71
71
 
72
72
  <%= partial "/shared/matcher_match" %>
73
73
 
74
- # Examples
74
+ ## Examples
75
75
 
76
76
  The following examples show how to use this InSpec audit resource.
77
77
 
78
- ## Test a password expiration policy
78
+ ### Test a password expiration policy
79
79
 
80
80
  describe wmi({
81
81
  class: 'RSOP_SecuritySettingNumeric',
@@ -85,7 +85,7 @@ The following examples show how to use this InSpec audit resource.
85
85
  its('Setting') { should eq 1 }
86
86
  end
87
87
 
88
- ## Test if an anonymous user can query the Local Security Authority (LSA)
88
+ ### Test if an anonymous user can query the Local Security Authority (LSA)
89
89
 
90
90
  describe wmi({
91
91
  namespace: 'root\rsop\computer',
@@ -6,7 +6,7 @@ title: About the xinetd_conf Resource
6
6
 
7
7
  Use the `xinetd_conf` InSpec audit resource to test services under `/etc/xinet.d` on Linux and Unix platforms. xinetd---the extended Internet service daemon---listens on all ports, and then loads the appropriate program based on a request. The `xinetd.conf` file is typically located at `/etc/xinetd.conf` and contains a list of Internet services associated to the ports on which that service will listen. Only enabled services may handle a request; only services that are required by the system should be enabled.
8
8
 
9
- # Syntax
9
+ ## Syntax
10
10
 
11
11
  An `xinetd_conf` resource block declares settings found in a `xinetd.conf` file for the named service:
12
12
 
@@ -22,29 +22,29 @@ where
22
22
  * `should eq 'value'` is the value that is expected
23
23
 
24
24
 
25
- # Matchers
25
+ ## Matchers
26
26
 
27
27
  This InSpec audit resource has the following matchers:
28
28
 
29
- ## be
29
+ ### be
30
30
 
31
31
  <%= partial "/shared/matcher_be" %>
32
32
 
33
- ## be_enabed
33
+ ### be_enabed
34
34
 
35
35
  The `be_enabled` matcher tests if a service listed under `/etc/xinet.d` is enabled:
36
36
 
37
37
  it { should be_enabled }
38
38
 
39
- ## cmp
39
+ ### cmp
40
40
 
41
41
  <%= partial "/shared/matcher_cmp" %>
42
42
 
43
- ## eq
43
+ ### eq
44
44
 
45
45
  <%= partial "/shared/matcher_eq" %>
46
46
 
47
- ## ids
47
+ ### ids
48
48
 
49
49
  The `ids` matcher tests if the named service is located under `/etc/xinet.d`:
50
50
 
@@ -54,21 +54,21 @@ For example:
54
54
 
55
55
  its('ids') { should include 'chargen-stream chargen-dgram'}
56
56
 
57
- ## include
57
+ ### include
58
58
 
59
59
  <%= partial "/shared/matcher_include" %>
60
60
 
61
- ## match
61
+ ### match
62
62
 
63
63
  <%= partial "/shared/matcher_match" %>
64
64
 
65
- ## services
65
+ ### services
66
66
 
67
67
  The `services` matcher tests if the named service is listed under `/etc/xinet.d`:
68
68
 
69
69
  its('services') { should include 'service_name' }
70
70
 
71
- ## socket_types
71
+ ### socket_types
72
72
 
73
73
  The `socket_types` matcher tests if a service listed under `/etc/xinet.d` is configured to use the named socket type:
74
74
 
@@ -86,7 +86,7 @@ For a TCP-based service:
86
86
 
87
87
  its('socket_types') { should eq 'stream' }
88
88
 
89
- ## types
89
+ ### types
90
90
 
91
91
  The `types` matcher tests the service type:
92
92
 
@@ -94,7 +94,7 @@ The `types` matcher tests the service type:
94
94
 
95
95
  where `'TYPE'` is `INTERNAL` (for a service provided by xinetd), `RPC` (for a service based on remote procedure call), or `UNLISTED` (for services not under `/etc/services` or `/etc/rpc`).
96
96
 
97
- ## wait
97
+ ### wait
98
98
 
99
99
  The `wait` matcher tests how a service handles incoming connections.
100
100
 
@@ -108,11 +108,11 @@ For TCP (`stream`) socket types the `wait` matcher should test for `no`:
108
108
  its('socket_types') { should eq 'stream' }
109
109
  its('wait') { should eq 'no' }
110
110
 
111
- # Examples
111
+ ## Examples
112
112
 
113
113
  The following examples show how to use this InSpec audit resource.
114
114
 
115
- ## Test a socket_type
115
+ ### Test a socket_type
116
116
 
117
117
  The network socket type: `dgram` (a datagram-based service), `raw` (a service that requires direct access to an IP address), `stream` (a stream-based service), or `seqpacket` (a service that requires a sequenced packet).
118
118
 
@@ -120,7 +120,7 @@ The network socket type: `dgram` (a datagram-based service), `raw` (a service th
120
120
  its('socket_types') { should include 'dgram' }
121
121
  end
122
122
 
123
- ## Test a service type
123
+ ### Test a service type
124
124
 
125
125
  The type of service: `INTERNAL` (a service provided by xinetd), `RPC` (an RPC-based service), `TCPMUX` (a service that is started on a well-known TPCMUX port), or `UNLISTED` (a service that is not listed in a standard system file location).
126
126
 
@@ -128,7 +128,7 @@ The type of service: `INTERNAL` (a service provided by xinetd), `RPC` (an RPC-ba
128
128
  its('type') { should include 'RPC' }
129
129
  end
130
130
 
131
- ## Test the telnet service
131
+ ### Test the telnet service
132
132
 
133
133
  For example, a `telnet` file under `/etc/xinet.d` contains the following settings:
134
134
 
@@ -6,7 +6,7 @@ title: About the yaml Resource
6
6
 
7
7
  Use the `yaml` InSpec audit resource to test configuration data in a Yaml file.
8
8
 
9
- # Syntax
9
+ ## Syntax
10
10
 
11
11
  A `yaml` resource block declares the configuration data to be tested. Assume the following Yaml file:
12
12
 
@@ -28,41 +28,41 @@ where
28
28
  * `should eq 'foo'` tests a value of `name` as read from a Yaml file versus the value declared in the test
29
29
 
30
30
 
31
- # Matchers
31
+ ## Matchers
32
32
 
33
33
  This InSpec audit resource has the following matchers:
34
34
 
35
- ## be
35
+ ### be
36
36
 
37
37
  <%= partial "/shared/matcher_be" %>
38
38
 
39
- ## cmp
39
+ ### cmp
40
40
 
41
41
  <%= partial "/shared/matcher_cmp" %>
42
42
 
43
- ## eq
43
+ ### eq
44
44
 
45
45
  <%= partial "/shared/matcher_eq" %>
46
46
 
47
- ## include
47
+ ### include
48
48
 
49
49
  <%= partial "/shared/matcher_include" %>
50
50
 
51
- ## match
51
+ ### match
52
52
 
53
53
  <%= partial "/shared/matcher_match" %>
54
54
 
55
- ## name
55
+ ### name
56
56
 
57
57
  The `name` matcher tests the value of `name` as read from a Yaml file versus the value declared in the test:
58
58
 
59
59
  its('name') { should eq 'foo' }
60
60
 
61
- # Examples
61
+ ## Examples
62
62
 
63
63
  The following examples show how to use this InSpec audit resource.
64
64
 
65
- ## Test a kitchen.yml file driver
65
+ ### Test a kitchen.yml file driver
66
66
 
67
67
  describe yaml('.kitchen.yaml') do
68
68
  its('driver.name') { should eq('vagrant') }