inspec 1.0.0 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +46 -3
- data/Gemfile +4 -1
- data/README.md +3 -0
- data/docs/dsl_inspec.md +3 -3
- data/docs/profiles.md +17 -0
- data/docs/resources/apache_conf.md.erb +10 -10
- data/docs/resources/apt.md.erb +13 -13
- data/docs/resources/audit_policy.md.erb +10 -10
- data/docs/resources/auditd_conf.md.erb +10 -10
- data/docs/resources/auditd_rules.md.erb +11 -11
- data/docs/resources/bash.md.erb +12 -12
- data/docs/resources/bond.md.erb +15 -15
- data/docs/resources/bridge.md.erb +11 -11
- data/docs/resources/bsd_service.md.erb +11 -11
- data/docs/resources/command.md.erb +21 -21
- data/docs/resources/csv.md.erb +10 -10
- data/docs/resources/directory.md.erb +8 -8
- data/docs/resources/etc_group.md.erb +16 -16
- data/docs/resources/etc_passwd.md.erb +17 -17
- data/docs/resources/etc_shadow.md.erb +19 -19
- data/docs/resources/file.md.erb +58 -58
- data/docs/resources/gem.md.erb +12 -12
- data/docs/resources/group.md.erb +12 -12
- data/docs/resources/grub_conf.md.erb +11 -11
- data/docs/resources/host.md.erb +13 -13
- data/docs/resources/iis_site.md.erb +16 -16
- data/docs/resources/inetd_conf.md.erb +10 -10
- data/docs/resources/ini.md.erb +9 -9
- data/docs/resources/interface.md.erb +11 -11
- data/docs/resources/iptables.md.erb +11 -11
- data/docs/resources/json.md.erb +10 -10
- data/docs/resources/kernel_module.md.erb +10 -10
- data/docs/resources/kernel_parameter.md.erb +12 -12
- data/docs/resources/launchd_service.md.erb +11 -11
- data/docs/resources/limits_conf.md.erb +10 -10
- data/docs/resources/login_def.md.erb +12 -12
- data/docs/resources/mount.md.erb +13 -13
- data/docs/resources/mysql_conf.md.erb +14 -14
- data/docs/resources/mysql_session.md.erb +10 -10
- data/docs/resources/npm.md.erb +12 -12
- data/docs/resources/ntp_conf.md.erb +9 -9
- data/docs/resources/oneget.md.erb +11 -11
- data/docs/resources/os.md.erb +13 -13
- data/docs/resources/os_env.md.erb +12 -12
- data/docs/resources/package.md.erb +15 -15
- data/docs/resources/parse_config.md.erb +13 -13
- data/docs/resources/parse_config_file.md.erb +22 -16
- data/docs/resources/pip.md.erb +12 -12
- data/docs/resources/port.md.erb +18 -18
- data/docs/resources/postgres_conf.md.erb +13 -13
- data/docs/resources/postgres_session.md.erb +11 -11
- data/docs/resources/powershell.md.erb +13 -13
- data/docs/resources/process.md.erb +12 -12
- data/docs/resources/registry_key.md.erb +17 -17
- data/docs/resources/runit_service.md.erb +11 -11
- data/docs/resources/security_policy.md.erb +10 -10
- data/docs/resources/service.md.erb +17 -17
- data/docs/resources/ssh_config.md.erb +13 -13
- data/docs/resources/sshd_config.md.erb +14 -14
- data/docs/resources/ssl.md.erb +12 -12
- data/docs/resources/sys_info.md.erb +10 -10
- data/docs/resources/systemd_service.md.erb +11 -11
- data/docs/resources/sysv_service.md.erb +11 -11
- data/docs/resources/upstart_service.md.erb +11 -11
- data/docs/resources/user.md.erb +20 -20
- data/docs/resources/users.md.erb +19 -19
- data/docs/resources/vbscript.md.erb +9 -9
- data/docs/resources/windows_feature.md.erb +10 -10
- data/docs/resources/wmi.md.erb +10 -10
- data/docs/resources/xinetd_conf.md.erb +17 -17
- data/docs/resources/yaml.md.erb +10 -10
- data/docs/resources/yum.md.erb +16 -16
- data/examples/meta-profile/README.md +0 -5
- data/lib/inspec/base_cli.rb +6 -0
- data/lib/inspec/cli.rb +10 -3
- data/lib/inspec/profile.rb +3 -3
- data/lib/inspec/rspec_json_formatter.rb +24 -15
- data/lib/inspec/version.rb +1 -1
- data/lib/resources/registry_key.rb +15 -5
- data/lib/utils/filter.rb +1 -0
- metadata +3 -4
data/docs/resources/bash.md.erb
CHANGED
@@ -6,7 +6,7 @@ title: About the bash Resource
|
|
6
6
|
|
7
7
|
Use the `bash` InSpec audit resource to test an arbitrary command that is run on the system using a Bash script.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `command` resource block declares a command to be run, one (or more) expected outputs, and the location to which that output is sent:
|
12
12
|
|
@@ -30,55 +30,55 @@ For example:
|
|
30
30
|
end
|
31
31
|
|
32
32
|
|
33
|
-
|
33
|
+
## Matchers
|
34
34
|
|
35
35
|
This InSpec audit resource has the following matchers:
|
36
36
|
|
37
|
-
|
37
|
+
### be
|
38
38
|
|
39
39
|
<%= partial "/shared/matcher_be" %>
|
40
40
|
|
41
|
-
|
41
|
+
### cmp
|
42
42
|
|
43
43
|
<%= partial "/shared/matcher_cmp" %>
|
44
44
|
|
45
|
-
|
45
|
+
### eq
|
46
46
|
|
47
47
|
<%= partial "/shared/matcher_eq" %>
|
48
48
|
|
49
|
-
|
49
|
+
### exist
|
50
50
|
|
51
51
|
The `exist` matcher tests if a command may be run on the system:
|
52
52
|
|
53
53
|
it { should exist }
|
54
54
|
|
55
|
-
|
55
|
+
### exit_status
|
56
56
|
|
57
57
|
The `exit_status` matcher tests the exit status for the command:
|
58
58
|
|
59
59
|
its('exit_status') { should eq 0 }
|
60
60
|
|
61
|
-
|
61
|
+
### include
|
62
62
|
|
63
63
|
<%= partial "/shared/matcher_include" %>
|
64
64
|
|
65
|
-
|
65
|
+
### match
|
66
66
|
|
67
67
|
<%= partial "/shared/matcher_match" %>
|
68
68
|
|
69
|
-
|
69
|
+
### stderr
|
70
70
|
|
71
71
|
The `stderr` matcher tests results of the command as returned in standard error (stderr):
|
72
72
|
|
73
73
|
its('stderr') { should eq '' }
|
74
74
|
|
75
|
-
|
75
|
+
### stdout
|
76
76
|
|
77
77
|
The `stdout` matcher tests results of the command as returned in standard output (stdout).
|
78
78
|
|
79
79
|
its('stdout') { should match /bin/ }
|
80
80
|
|
81
81
|
|
82
|
-
|
82
|
+
## Examples
|
83
83
|
|
84
84
|
None.
|
data/docs/resources/bond.md.erb
CHANGED
@@ -6,7 +6,7 @@ title: About the bond Resource
|
|
6
6
|
|
7
7
|
Use the `bond` InSpec audit resource to test a logical, bonded network interface (i.e. "two or more network interfaces aggregated into a single, logical network interface"). On Linux platforms, any value in the `/proc/net/bonding` directory may be tested.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `bond` resource block declares a bonded network interface, and then specifies the properties of that bonded network interface to be tested:
|
12
12
|
|
@@ -20,72 +20,72 @@ where
|
|
20
20
|
* `{ should exist }` is a valid matcher for this resource
|
21
21
|
|
22
22
|
|
23
|
-
|
23
|
+
## Matchers
|
24
24
|
|
25
25
|
This InSpec audit resource has the following matchers:
|
26
26
|
|
27
|
-
|
27
|
+
### be
|
28
28
|
|
29
29
|
<%= partial "/shared/matcher_be" %>
|
30
30
|
|
31
|
-
|
31
|
+
### cmp
|
32
32
|
|
33
33
|
<%= partial "/shared/matcher_cmp" %>
|
34
34
|
|
35
|
-
|
35
|
+
### content
|
36
36
|
|
37
37
|
The `content` matcher tests if contents in the file that defines the bonded network interface match the value specified in the test. The values of the `content` matcher are arbitrary:
|
38
38
|
|
39
39
|
its('content') { should match('value') }
|
40
40
|
|
41
|
-
|
41
|
+
### eq
|
42
42
|
|
43
43
|
<%= partial "/shared/matcher_eq" %>
|
44
44
|
|
45
|
-
|
45
|
+
### exist
|
46
46
|
|
47
47
|
The `exist` matcher tests if the bonded network interface is available:
|
48
48
|
|
49
49
|
it { should exist }
|
50
50
|
|
51
|
-
|
51
|
+
### have_interface
|
52
52
|
|
53
53
|
The `have_interface` matcher tests if the bonded network interface has one (or more) secondary interfaces:
|
54
54
|
|
55
55
|
it { should have_interface }
|
56
56
|
|
57
|
-
|
57
|
+
### include
|
58
58
|
|
59
59
|
<%= partial "/shared/matcher_include" %>
|
60
60
|
|
61
|
-
|
61
|
+
### interfaces
|
62
62
|
|
63
63
|
The `interfaces` matcher tests if the named secondary interfaces are available:
|
64
64
|
|
65
65
|
its('interfaces') { should eq ['eth0', 'eth1', ...] }
|
66
66
|
|
67
|
-
|
67
|
+
### match
|
68
68
|
|
69
69
|
<%= partial "/shared/matcher_match" %>
|
70
70
|
|
71
|
-
|
71
|
+
### params
|
72
72
|
|
73
73
|
The `params` matcher tests arbitrary parameters for the bonded network interface:
|
74
74
|
|
75
75
|
its('params') { should eq 'value' }
|
76
76
|
|
77
|
-
|
77
|
+
## Examples
|
78
78
|
|
79
79
|
The following examples show how to use this InSpec audit resource.
|
80
80
|
|
81
|
-
|
81
|
+
### Test if eth0 is a secondary interface for bond0
|
82
82
|
|
83
83
|
describe bond('bond0') do
|
84
84
|
it { should exist }
|
85
85
|
it { should have_interface 'eth0' }
|
86
86
|
end
|
87
87
|
|
88
|
-
|
88
|
+
### Test parameters for bond0
|
89
89
|
|
90
90
|
describe bond('bond0') do
|
91
91
|
its('Bonding Mode') { should eq 'IEEE 802.3ad Dynamic link aggregation' }
|
@@ -9,7 +9,7 @@ Use the `bridge` InSpec audit resource to test basic network bridge properties,
|
|
9
9
|
* On Linux platforms, any value in the `/sys/class/net/{interface}/bridge` directory may be tested
|
10
10
|
* On the Windows platform, the `Get-NetAdapter` cmdlet is associated with the `Get-NetAdapterBinding` cmdlet and returns the `ComponentID ms_bridge` value as a JSON object
|
11
11
|
|
12
|
-
|
12
|
+
## Syntax
|
13
13
|
|
14
14
|
A `bridge` resource block declares the bridge to be tested and what interface it should be associated with:
|
15
15
|
|
@@ -18,39 +18,39 @@ A `bridge` resource block declares the bridge to be tested and what interface it
|
|
18
18
|
it { should have_interface 'eth0' }
|
19
19
|
end
|
20
20
|
|
21
|
-
|
21
|
+
## Matchers
|
22
22
|
|
23
23
|
This InSpec audit resource has the following matchers:
|
24
24
|
|
25
|
-
|
25
|
+
### be
|
26
26
|
|
27
27
|
<%= partial "/shared/matcher_be" %>
|
28
28
|
|
29
|
-
|
29
|
+
### cmp
|
30
30
|
|
31
31
|
<%= partial "/shared/matcher_cmp" %>
|
32
32
|
|
33
|
-
|
33
|
+
### eq
|
34
34
|
|
35
35
|
<%= partial "/shared/matcher_eq" %>
|
36
36
|
|
37
|
-
|
37
|
+
### exist
|
38
38
|
|
39
39
|
The `exist` matcher tests if the network bridge is available:
|
40
40
|
|
41
41
|
it { should exist }
|
42
42
|
|
43
|
-
|
43
|
+
### have_interface
|
44
44
|
|
45
45
|
The `have_interface` matcher tests if the named interface is defined for the network bridge:
|
46
46
|
|
47
47
|
it { should have_interface 'eth0' }
|
48
48
|
|
49
|
-
|
49
|
+
### include
|
50
50
|
|
51
51
|
<%= partial "/shared/matcher_include" %>
|
52
52
|
|
53
|
-
|
53
|
+
### interfaces
|
54
54
|
|
55
55
|
The `interfaces` matcher tests if the named interface is present:
|
56
56
|
|
@@ -58,10 +58,10 @@ The `interfaces` matcher tests if the named interface is present:
|
|
58
58
|
its('interfaces') { should eq 'bar' }
|
59
59
|
its('interfaces') { should include('foo') }
|
60
60
|
|
61
|
-
|
61
|
+
### match
|
62
62
|
|
63
63
|
<%= partial "/shared/matcher_match" %>
|
64
64
|
|
65
|
-
|
65
|
+
## Examples
|
66
66
|
|
67
67
|
None.
|
@@ -6,7 +6,7 @@ title: About the bsd_service Resource
|
|
6
6
|
|
7
7
|
Use the `bsd_service` InSpec audit resource to test a service using a Berkeley OS-style `init` on the FreeBSD platform.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `bsd_service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
|
12
12
|
|
@@ -29,48 +29,48 @@ The path to the service manager's control may be specified for situations where
|
|
29
29
|
it { should be_running }
|
30
30
|
end
|
31
31
|
|
32
|
-
|
32
|
+
## Matchers
|
33
33
|
|
34
34
|
This InSpec audit resource has the following matchers:
|
35
35
|
|
36
|
-
|
36
|
+
### be
|
37
37
|
|
38
38
|
<%= partial "/shared/matcher_be" %>
|
39
39
|
|
40
|
-
|
40
|
+
### be_enabled
|
41
41
|
|
42
42
|
The `be_enabled` matcher tests if the named service is enabled:
|
43
43
|
|
44
44
|
it { should be_enabled }
|
45
45
|
|
46
|
-
|
46
|
+
### be_installed
|
47
47
|
|
48
48
|
The `be_installed` matcher tests if the named service is installed:
|
49
49
|
|
50
50
|
it { should be_installed }
|
51
51
|
|
52
|
-
|
52
|
+
### be_running
|
53
53
|
|
54
54
|
The `be_running` matcher tests if the named service is running:
|
55
55
|
|
56
56
|
it { should be_running }
|
57
57
|
|
58
|
-
|
58
|
+
### cmp
|
59
59
|
|
60
60
|
<%= partial "/shared/matcher_cmp" %>
|
61
61
|
|
62
|
-
|
62
|
+
### eq
|
63
63
|
|
64
64
|
<%= partial "/shared/matcher_eq" %>
|
65
65
|
|
66
|
-
|
66
|
+
### include
|
67
67
|
|
68
68
|
<%= partial "/shared/matcher_include" %>
|
69
69
|
|
70
|
-
|
70
|
+
### match
|
71
71
|
|
72
72
|
<%= partial "/shared/matcher_match" %>
|
73
73
|
|
74
|
-
|
74
|
+
## Examples
|
75
75
|
|
76
76
|
None.
|
@@ -6,7 +6,7 @@ title: About the command Resource
|
|
6
6
|
|
7
7
|
Use the `command` InSpec audit resource to test an arbitrary command that is run on the system.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `command` resource block declares a command to be run, one (or more) expected outputs, and the location to which that output is sent:
|
12
12
|
|
@@ -22,49 +22,49 @@ where
|
|
22
22
|
* `'output'` tests the output of the command run on the system versus the output value stated in the test
|
23
23
|
|
24
24
|
|
25
|
-
|
25
|
+
## Matchers
|
26
26
|
|
27
27
|
This InSpec audit resource has the following matchers:
|
28
28
|
|
29
|
-
|
29
|
+
### be
|
30
30
|
|
31
31
|
<%= partial "/shared/matcher_be" %>
|
32
32
|
|
33
|
-
|
33
|
+
### cmp
|
34
34
|
|
35
35
|
<%= partial "/shared/matcher_cmp" %>
|
36
36
|
|
37
|
-
|
37
|
+
### eq
|
38
38
|
|
39
39
|
<%= partial "/shared/matcher_eq" %>
|
40
40
|
|
41
|
-
|
41
|
+
### exist
|
42
42
|
|
43
43
|
The `exist` matcher tests if a command may be run on the system:
|
44
44
|
|
45
45
|
it { should exist }
|
46
46
|
|
47
|
-
|
47
|
+
### exit_status
|
48
48
|
|
49
49
|
The `exit_status` matcher tests the exit status for the command:
|
50
50
|
|
51
51
|
its('exit_status') { should eq 123 }
|
52
52
|
|
53
|
-
|
53
|
+
### include
|
54
54
|
|
55
55
|
<%= partial "/shared/matcher_include" %>
|
56
56
|
|
57
|
-
|
57
|
+
### match
|
58
58
|
|
59
59
|
<%= partial "/shared/matcher_match" %>
|
60
60
|
|
61
|
-
|
61
|
+
### stderr
|
62
62
|
|
63
63
|
The `stderr` matcher tests results of the command as returned in standard error (stderr):
|
64
64
|
|
65
65
|
its('stderr') { should eq 'error' }
|
66
66
|
|
67
|
-
|
67
|
+
### stdout
|
68
68
|
|
69
69
|
The `stdout` matcher tests results of the command as returned in standard output (stdout). The following example shows matching output using a regular expression:
|
70
70
|
|
@@ -72,11 +72,11 @@ The `stdout` matcher tests results of the command as returned in standard output
|
|
72
72
|
its('stdout') { should match (/[0-9]/) }
|
73
73
|
end
|
74
74
|
|
75
|
-
|
75
|
+
## Examples
|
76
76
|
|
77
77
|
The following examples show how to use this InSpec audit resource.
|
78
78
|
|
79
|
-
|
79
|
+
### Test for PostgreSQL database running a RC, development, or beta release
|
80
80
|
|
81
81
|
describe command('psql -V') do
|
82
82
|
its('stdout') { should eq '/RC/' }
|
@@ -84,7 +84,7 @@ The following examples show how to use this InSpec audit resource.
|
|
84
84
|
its('stdout') { should_not eq '/BETA/' }
|
85
85
|
end
|
86
86
|
|
87
|
-
|
87
|
+
### Test standard output (stdout)
|
88
88
|
|
89
89
|
describe command('echo hello') do
|
90
90
|
its('stdout') { should eq 'hello\n' }
|
@@ -92,7 +92,7 @@ The following examples show how to use this InSpec audit resource.
|
|
92
92
|
its('exit_status') { should eq 0 }
|
93
93
|
end
|
94
94
|
|
95
|
-
|
95
|
+
### Test standard error (stderr)
|
96
96
|
|
97
97
|
describe command('>&2 echo error') do
|
98
98
|
its('stdout') { should eq '' }
|
@@ -100,7 +100,7 @@ The following examples show how to use this InSpec audit resource.
|
|
100
100
|
its('exit_status') { should eq 0 }
|
101
101
|
end
|
102
102
|
|
103
|
-
|
103
|
+
### Test an exit status code
|
104
104
|
|
105
105
|
describe command('exit 123') do
|
106
106
|
its('stdout') { should eq '' }
|
@@ -108,19 +108,19 @@ The following examples show how to use this InSpec audit resource.
|
|
108
108
|
its('exit_status') { should eq 123 }
|
109
109
|
end
|
110
110
|
|
111
|
-
|
111
|
+
### Test if the command shell exists
|
112
112
|
|
113
113
|
describe command('/bin/sh').exist? do
|
114
114
|
it { should eq true }
|
115
115
|
end
|
116
116
|
|
117
|
-
|
117
|
+
### Test for a command that should not exist
|
118
118
|
|
119
119
|
describe command('this is not existing').exist? do
|
120
120
|
it { should eq false }
|
121
121
|
end
|
122
122
|
|
123
|
-
|
123
|
+
### Verify NTP
|
124
124
|
|
125
125
|
The following example shows how to use the `file` audit resource to verify if the `ntp.conf` and `leap-seconds` files are present, and then the `command` resource to verify if NTP is installed and running:
|
126
126
|
|
@@ -136,7 +136,7 @@ The following example shows how to use the `file` audit resource to verify if th
|
|
136
136
|
its('exit_status') { should eq 0 }
|
137
137
|
end
|
138
138
|
|
139
|
-
|
139
|
+
### Verify WiX
|
140
140
|
|
141
141
|
Wix includes serveral tools -- such as `candle` (preprocesses and compiles source files into object files), `light` (links and binds object files to an installer database), and `heat` (harvests files from various input formats). The following example uses a whitespace array and the `file` audit resource to verify if these three tools are present:
|
142
142
|
|
@@ -145,7 +145,7 @@ Wix includes serveral tools -- such as `candle` (preprocesses and compiles sourc
|
|
145
145
|
heat.exe
|
146
146
|
light.exe
|
147
147
|
).each do |utility|
|
148
|
-
describe file("C:/wix
|
148
|
+
describe file("C:/wix/##{utility}") do
|
149
149
|
it { should be_file }
|
150
150
|
end
|
151
151
|
end
|