inspec 1.0.0 → 1.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +46 -3
- data/Gemfile +4 -1
- data/README.md +3 -0
- data/docs/dsl_inspec.md +3 -3
- data/docs/profiles.md +17 -0
- data/docs/resources/apache_conf.md.erb +10 -10
- data/docs/resources/apt.md.erb +13 -13
- data/docs/resources/audit_policy.md.erb +10 -10
- data/docs/resources/auditd_conf.md.erb +10 -10
- data/docs/resources/auditd_rules.md.erb +11 -11
- data/docs/resources/bash.md.erb +12 -12
- data/docs/resources/bond.md.erb +15 -15
- data/docs/resources/bridge.md.erb +11 -11
- data/docs/resources/bsd_service.md.erb +11 -11
- data/docs/resources/command.md.erb +21 -21
- data/docs/resources/csv.md.erb +10 -10
- data/docs/resources/directory.md.erb +8 -8
- data/docs/resources/etc_group.md.erb +16 -16
- data/docs/resources/etc_passwd.md.erb +17 -17
- data/docs/resources/etc_shadow.md.erb +19 -19
- data/docs/resources/file.md.erb +58 -58
- data/docs/resources/gem.md.erb +12 -12
- data/docs/resources/group.md.erb +12 -12
- data/docs/resources/grub_conf.md.erb +11 -11
- data/docs/resources/host.md.erb +13 -13
- data/docs/resources/iis_site.md.erb +16 -16
- data/docs/resources/inetd_conf.md.erb +10 -10
- data/docs/resources/ini.md.erb +9 -9
- data/docs/resources/interface.md.erb +11 -11
- data/docs/resources/iptables.md.erb +11 -11
- data/docs/resources/json.md.erb +10 -10
- data/docs/resources/kernel_module.md.erb +10 -10
- data/docs/resources/kernel_parameter.md.erb +12 -12
- data/docs/resources/launchd_service.md.erb +11 -11
- data/docs/resources/limits_conf.md.erb +10 -10
- data/docs/resources/login_def.md.erb +12 -12
- data/docs/resources/mount.md.erb +13 -13
- data/docs/resources/mysql_conf.md.erb +14 -14
- data/docs/resources/mysql_session.md.erb +10 -10
- data/docs/resources/npm.md.erb +12 -12
- data/docs/resources/ntp_conf.md.erb +9 -9
- data/docs/resources/oneget.md.erb +11 -11
- data/docs/resources/os.md.erb +13 -13
- data/docs/resources/os_env.md.erb +12 -12
- data/docs/resources/package.md.erb +15 -15
- data/docs/resources/parse_config.md.erb +13 -13
- data/docs/resources/parse_config_file.md.erb +22 -16
- data/docs/resources/pip.md.erb +12 -12
- data/docs/resources/port.md.erb +18 -18
- data/docs/resources/postgres_conf.md.erb +13 -13
- data/docs/resources/postgres_session.md.erb +11 -11
- data/docs/resources/powershell.md.erb +13 -13
- data/docs/resources/process.md.erb +12 -12
- data/docs/resources/registry_key.md.erb +17 -17
- data/docs/resources/runit_service.md.erb +11 -11
- data/docs/resources/security_policy.md.erb +10 -10
- data/docs/resources/service.md.erb +17 -17
- data/docs/resources/ssh_config.md.erb +13 -13
- data/docs/resources/sshd_config.md.erb +14 -14
- data/docs/resources/ssl.md.erb +12 -12
- data/docs/resources/sys_info.md.erb +10 -10
- data/docs/resources/systemd_service.md.erb +11 -11
- data/docs/resources/sysv_service.md.erb +11 -11
- data/docs/resources/upstart_service.md.erb +11 -11
- data/docs/resources/user.md.erb +20 -20
- data/docs/resources/users.md.erb +19 -19
- data/docs/resources/vbscript.md.erb +9 -9
- data/docs/resources/windows_feature.md.erb +10 -10
- data/docs/resources/wmi.md.erb +10 -10
- data/docs/resources/xinetd_conf.md.erb +17 -17
- data/docs/resources/yaml.md.erb +10 -10
- data/docs/resources/yum.md.erb +16 -16
- data/examples/meta-profile/README.md +0 -5
- data/lib/inspec/base_cli.rb +6 -0
- data/lib/inspec/cli.rb +10 -3
- data/lib/inspec/profile.rb +3 -3
- data/lib/inspec/rspec_json_formatter.rb +24 -15
- data/lib/inspec/version.rb +1 -1
- data/lib/resources/registry_key.rb +15 -5
- data/lib/utils/filter.rb +1 -0
- metadata +3 -4
data/docs/resources/os.md.erb
CHANGED
@@ -6,7 +6,7 @@ title: About the os Resource
|
|
6
6
|
|
7
7
|
Use the `os` InSpec audit resource to test the platform on which the system is running.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
An `os` resource block declares the platform to be tested. The platform may specified via matcher or control block name. For example, using a matcher:
|
12
12
|
|
@@ -22,31 +22,31 @@ or using the block name:
|
|
22
22
|
|
23
23
|
* `'platform_name'` (a string) or `:family_name` (a symbol) is one of `aix`, `bsd`, `darwin`, `debian`, `hpux`, `linux`, `redhat`, `solaris`, `suse`, `unix`, or `windows`
|
24
24
|
|
25
|
-
|
25
|
+
## Matchers
|
26
26
|
|
27
27
|
This InSpec audit resource has the following matchers:
|
28
28
|
|
29
|
-
|
29
|
+
### be
|
30
30
|
|
31
31
|
<%= partial "/shared/matcher_be" %>
|
32
32
|
|
33
|
-
|
33
|
+
### cmp
|
34
34
|
|
35
35
|
<%= partial "/shared/matcher_cmp" %>
|
36
36
|
|
37
|
-
|
37
|
+
### eq
|
38
38
|
|
39
39
|
<%= partial "/shared/matcher_eq" %>
|
40
40
|
|
41
|
-
|
41
|
+
### include
|
42
42
|
|
43
43
|
<%= partial "/shared/matcher_include" %>
|
44
44
|
|
45
|
-
|
45
|
+
### match
|
46
46
|
|
47
47
|
<%= partial "/shared/matcher_match" %>
|
48
48
|
|
49
|
-
|
49
|
+
## os.family? Helpers
|
50
50
|
|
51
51
|
The `os` audit resource includes a collection of helpers that enable more granular testing of platforms, platform names, architectures, and releases. Use any of the following platform-specific helpers to test for specific platforms:
|
52
52
|
|
@@ -94,7 +94,7 @@ Use the following helpers to test for operating system names, releases, and arch
|
|
94
94
|
it { should eq 'foo' }
|
95
95
|
end
|
96
96
|
|
97
|
-
|
97
|
+
## os[:family] Symbols
|
98
98
|
|
99
99
|
Use `os[:family]` to enable more granular testing of platforms, platform names, architectures, and releases. Use any of the following platform-specific symbols to test for specific platforms:
|
100
100
|
|
@@ -131,23 +131,23 @@ For example, both of the following tests should have the same result:
|
|
131
131
|
end
|
132
132
|
end
|
133
133
|
|
134
|
-
|
134
|
+
## Examples
|
135
135
|
|
136
136
|
The following examples show how to use this InSpec audit resource.
|
137
137
|
|
138
|
-
|
138
|
+
### Test for RedHat
|
139
139
|
|
140
140
|
describe os[:family] do
|
141
141
|
it { should eq 'redhat' }
|
142
142
|
end
|
143
143
|
|
144
|
-
|
144
|
+
### Test for Ubuntu
|
145
145
|
|
146
146
|
describe os[:family] do
|
147
147
|
it { should eq 'debian' }
|
148
148
|
end
|
149
149
|
|
150
|
-
|
150
|
+
### Test for Microsoft Windows
|
151
151
|
|
152
152
|
describe os[:family] do
|
153
153
|
it { should eq 'windows' }
|
@@ -6,7 +6,7 @@ title: About the os_env Resource
|
|
6
6
|
|
7
7
|
Use the `os_env` InSpec audit resource to test the environment variables for the platform on which the system is running.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `os_env` resource block declares an environment variable, and then declares its value:
|
12
12
|
|
@@ -20,37 +20,37 @@ where
|
|
20
20
|
* `matcher` is a valid matcher for this resource
|
21
21
|
|
22
22
|
|
23
|
-
|
23
|
+
## Matchers
|
24
24
|
|
25
25
|
This InSpec audit resource has the following matchers:
|
26
26
|
|
27
|
-
|
27
|
+
### be
|
28
28
|
|
29
29
|
<%= partial "/shared/matcher_be" %>
|
30
30
|
|
31
|
-
|
31
|
+
### cmp
|
32
32
|
|
33
33
|
<%= partial "/shared/matcher_cmp" %>
|
34
34
|
|
35
|
-
|
35
|
+
### content
|
36
36
|
|
37
37
|
The `content` matcher return the value of the environment variable:
|
38
38
|
|
39
39
|
its('content') { should eq '/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin' }
|
40
40
|
|
41
|
-
|
41
|
+
### eq
|
42
42
|
|
43
43
|
<%= partial "/shared/matcher_eq" %>
|
44
44
|
|
45
|
-
|
45
|
+
### include
|
46
46
|
|
47
47
|
<%= partial "/shared/matcher_include" %>
|
48
48
|
|
49
|
-
|
49
|
+
### match
|
50
50
|
|
51
51
|
<%= partial "/shared/matcher_match" %>
|
52
52
|
|
53
|
-
|
53
|
+
### split
|
54
54
|
|
55
55
|
The `split` splits the content with the `:` deliminator:
|
56
56
|
|
@@ -64,18 +64,18 @@ Use `-1` to test for cases where there is a trailing colon (`:`), such as `dir1:
|
|
64
64
|
|
65
65
|
its('split') { should include ('-1') }
|
66
66
|
|
67
|
-
|
67
|
+
## Examples
|
68
68
|
|
69
69
|
The following examples show how to use this InSpec audit resource.
|
70
70
|
|
71
|
-
|
71
|
+
### Test the PATH environment variable
|
72
72
|
|
73
73
|
describe os_env('PATH') do
|
74
74
|
its('split') { should_not include('') }
|
75
75
|
its('split') { should_not include('.') }
|
76
76
|
end
|
77
77
|
|
78
|
-
|
78
|
+
### Test Habitat environment variables
|
79
79
|
|
80
80
|
Habitat uses the `os_env` resource to test environment variables. The environment variables are first defined in a whitespace array, after which each environment variable is tested:
|
81
81
|
|
@@ -7,7 +7,7 @@ title: About the package Resource
|
|
7
7
|
Use the `package` InSpec audit resource to test if the named package and/or package version is installed on the system.
|
8
8
|
|
9
9
|
|
10
|
-
|
10
|
+
## Syntax
|
11
11
|
|
12
12
|
A `package` resource block declares a package and (optionally) a package version:
|
13
13
|
|
@@ -20,60 +20,60 @@ where
|
|
20
20
|
* `('name')` must specify the name of a package, such as `'nginx'`
|
21
21
|
* `be_installed` is a valid matcher for this resource
|
22
22
|
|
23
|
-
|
23
|
+
## Matchers
|
24
24
|
|
25
25
|
This InSpec audit resource has the following matchers:
|
26
26
|
|
27
|
-
|
27
|
+
### be
|
28
28
|
|
29
29
|
<%= partial "/shared/matcher_be" %>
|
30
30
|
|
31
|
-
|
31
|
+
### be_installed
|
32
32
|
|
33
33
|
The `be_installed` matcher tests if the named package is installed on the system:
|
34
34
|
|
35
35
|
it { should be_installed }
|
36
36
|
|
37
|
-
|
37
|
+
### cmp
|
38
38
|
|
39
39
|
<%= partial "/shared/matcher_cmp" %>
|
40
40
|
|
41
|
-
|
41
|
+
### eq
|
42
42
|
|
43
43
|
<%= partial "/shared/matcher_eq" %>
|
44
44
|
|
45
|
-
|
45
|
+
### include
|
46
46
|
|
47
47
|
<%= partial "/shared/matcher_include" %>
|
48
48
|
|
49
|
-
|
49
|
+
### match
|
50
50
|
|
51
51
|
<%= partial "/shared/matcher_match" %>
|
52
52
|
|
53
|
-
|
53
|
+
### version
|
54
54
|
|
55
55
|
The `version` matcher tests if the named package version is on the system:
|
56
56
|
|
57
57
|
its('version') { should eq '1.2.3' }
|
58
58
|
|
59
|
-
|
59
|
+
## Examples
|
60
60
|
|
61
61
|
The following examples show how to use this InSpec audit resource.
|
62
62
|
|
63
|
-
|
63
|
+
### Test if nginx version 1.9.5 is installed
|
64
64
|
|
65
65
|
describe package('nginx') do
|
66
66
|
it { should be_installed }
|
67
67
|
its('version') { should eq 1.9.5 }
|
68
68
|
end
|
69
69
|
|
70
|
-
|
70
|
+
### Test that a package is not installed
|
71
71
|
|
72
72
|
describe package('some_package') do
|
73
73
|
it { should_not be_installed }
|
74
74
|
end
|
75
75
|
|
76
|
-
|
76
|
+
### Test if telnet is installed
|
77
77
|
|
78
78
|
describe package('telnetd') do
|
79
79
|
it { should_not be_installed }
|
@@ -83,7 +83,7 @@ The following examples show how to use this InSpec audit resource.
|
|
83
83
|
its('telnet') { should eq nil }
|
84
84
|
end
|
85
85
|
|
86
|
-
|
86
|
+
### Test if ClamAV (an antivirus engine) is installed and running
|
87
87
|
|
88
88
|
describe package('clamav') do
|
89
89
|
it { should be_installed }
|
@@ -96,7 +96,7 @@ The following examples show how to use this InSpec audit resource.
|
|
96
96
|
it { should_not be_running }
|
97
97
|
end
|
98
98
|
|
99
|
-
|
99
|
+
### Verify if Memcached is installed, enabled, and running
|
100
100
|
|
101
101
|
Memcached is an in-memory key-value store that helps improve the performance of database-driven websites and can be installed, maintained, and tested using the `memcached` cookbook (maintained by Chef). The following example is from the `memcached` cookbook and shows how to use a combination of the `package`, `service`, and `port` InSpec audit resources to test if Memcached is installed, enabled, and running:
|
102
102
|
|
@@ -6,7 +6,7 @@ title: About the parse_config Resource
|
|
6
6
|
|
7
7
|
Use the `parse_config` InSpec audit resource to test arbitrary configuration files.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `parse_config` resource block declares the location of the configuration setting to be tested, and then what value is to be tested. Because this resource relies on arbitrary configuration files, the test itself is often arbitrary and relies on custom Ruby code:
|
12
12
|
|
@@ -35,11 +35,11 @@ where each test
|
|
35
35
|
* May run a command to `stdout`, and then run the test against that output
|
36
36
|
* May use options to define how configuration data is to be parsed
|
37
37
|
|
38
|
-
|
38
|
+
## Matchers
|
39
39
|
|
40
40
|
This InSpec audit resource has the following matchers:
|
41
41
|
|
42
|
-
|
42
|
+
### assignment_re
|
43
43
|
|
44
44
|
Use `assignment_re` to test a key value using a regular expression:
|
45
45
|
|
@@ -49,29 +49,29 @@ may be tested using the following regular expression, which determines assignmen
|
|
49
49
|
|
50
50
|
assignment_re: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/
|
51
51
|
|
52
|
-
|
52
|
+
### be
|
53
53
|
|
54
54
|
<%= partial "/shared/matcher_be" %>
|
55
55
|
|
56
|
-
|
56
|
+
### cmp
|
57
57
|
|
58
58
|
<%= partial "/shared/matcher_cmp" %>
|
59
59
|
|
60
|
-
|
60
|
+
### comment_char
|
61
61
|
|
62
62
|
Use `comment_char` to test for comments in a configuration file:
|
63
63
|
|
64
64
|
comment_char: '#'
|
65
65
|
|
66
|
-
|
66
|
+
### eq
|
67
67
|
|
68
68
|
<%= partial "/shared/matcher_eq" %>
|
69
69
|
|
70
|
-
|
70
|
+
### include
|
71
71
|
|
72
72
|
<%= partial "/shared/matcher_include" %>
|
73
73
|
|
74
|
-
|
74
|
+
### key_vals
|
75
75
|
|
76
76
|
Use `key_vals` to test how many values a key contains:
|
77
77
|
|
@@ -81,11 +81,11 @@ contains three values. To test that value to ensure it only contains one, use:
|
|
81
81
|
|
82
82
|
key_vals: 1
|
83
83
|
|
84
|
-
|
84
|
+
### match
|
85
85
|
|
86
86
|
<%= partial "/shared/matcher_match" %>
|
87
87
|
|
88
|
-
|
88
|
+
### multiple_values
|
89
89
|
|
90
90
|
Use `multiple_values` if the source file uses the same key multiple times. All values will be aggregated in an array:
|
91
91
|
|
@@ -105,7 +105,7 @@ To use plain key value mapping, use `multiple_values: false`:
|
|
105
105
|
params['key'] = 'b'
|
106
106
|
params['key2'] = 'c'
|
107
107
|
|
108
|
-
|
108
|
+
### standalone_comments
|
109
109
|
|
110
110
|
Use `standalone_comments` to parse comments as a line, otherwise inline comments are allowed:
|
111
111
|
|
@@ -117,6 +117,6 @@ Use `standalone_comments: false`, to parse the following:
|
|
117
117
|
'key = value # comment'
|
118
118
|
params['key'] = 'value'
|
119
119
|
|
120
|
-
|
120
|
+
## Examples
|
121
121
|
|
122
122
|
None.
|
@@ -6,7 +6,7 @@ title: About the parse_config_file Resource
|
|
6
6
|
|
7
7
|
Use the `parse_config_file` InSpec audit resource to test arbitrary configuration files. It works in the same way as `parse_config`. Instead of using a command output, this resource works with files.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `parse_config_file` InSpec audit resource block declares the location of the configuration file to be tested, and then which settings in that file are to be tested.
|
12
12
|
|
@@ -32,7 +32,7 @@ where each test
|
|
32
32
|
* May run a command to `stdout`, and then run the test against that output
|
33
33
|
* May use options to define how configuration data is to be parsed
|
34
34
|
|
35
|
-
|
35
|
+
## Options
|
36
36
|
|
37
37
|
This resource supports the following options for parsing configuration data. Use them in an `options` block stated outside of (and immediately before) the actual test:
|
38
38
|
|
@@ -44,11 +44,11 @@ This resource supports the following options for parsing configuration data. Use
|
|
44
44
|
its('setting') { should eq 1 }
|
45
45
|
end
|
46
46
|
|
47
|
-
|
47
|
+
## Matchers
|
48
48
|
|
49
49
|
This InSpec audit resource has the following matchers:
|
50
50
|
|
51
|
-
|
51
|
+
### assignment_re
|
52
52
|
|
53
53
|
Use `assignment_re` to test a key value using a regular expression:
|
54
54
|
|
@@ -58,29 +58,29 @@ may be tested using the following regular expression, which determines assignmen
|
|
58
58
|
|
59
59
|
assignment_re: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/
|
60
60
|
|
61
|
-
|
61
|
+
### be
|
62
62
|
|
63
63
|
<%= partial "/shared/matcher_be" %>
|
64
64
|
|
65
|
-
|
65
|
+
### cmp
|
66
66
|
|
67
67
|
<%= partial "/shared/matcher_cmp" %>
|
68
68
|
|
69
|
-
|
69
|
+
### comment_char
|
70
70
|
|
71
71
|
Use `comment_char` to test for comments in a configuration file:
|
72
72
|
|
73
73
|
comment_char: '#'
|
74
74
|
|
75
|
-
|
75
|
+
### eq
|
76
76
|
|
77
77
|
<%= partial "/shared/matcher_eq" %>
|
78
78
|
|
79
|
-
|
79
|
+
### include
|
80
80
|
|
81
81
|
<%= partial "/shared/matcher_include" %>
|
82
82
|
|
83
|
-
|
83
|
+
### key_vals
|
84
84
|
|
85
85
|
Use `key_vals` to test how many values a key contains:
|
86
86
|
|
@@ -90,11 +90,11 @@ contains three values. To test that value to ensure it only contains one, use:
|
|
90
90
|
|
91
91
|
key_vals: 1
|
92
92
|
|
93
|
-
|
93
|
+
### match
|
94
94
|
|
95
95
|
<%= partial "/shared/matcher_match" %>
|
96
96
|
|
97
|
-
|
97
|
+
### multiple_values
|
98
98
|
|
99
99
|
Use `multiple_values` if the source file uses the same key multiple times. All values will be aggregated in an array:
|
100
100
|
|
@@ -114,7 +114,7 @@ To use plain key value mapping, use `multiple_values: false`:
|
|
114
114
|
params['key'] = 'b'
|
115
115
|
params['key2'] = 'c'
|
116
116
|
|
117
|
-
|
117
|
+
### standalone_comments
|
118
118
|
|
119
119
|
Use `standalone_comments` to parse comments as a line, otherwise inline comments are allowed:
|
120
120
|
|
@@ -126,18 +126,24 @@ Use `standalone_comments: false`, to parse the following:
|
|
126
126
|
'key = value # comment'
|
127
127
|
params['key'] = 'value'
|
128
128
|
|
129
|
-
|
129
|
+
## Examples
|
130
130
|
|
131
131
|
The following examples show how to use this InSpec audit resource.
|
132
132
|
|
133
|
-
|
133
|
+
### Test a configuration setting
|
134
134
|
|
135
135
|
describe parse_config_file('/path/to/file.conf') do
|
136
136
|
its('PARAM_X') { should eq 'Y' }
|
137
137
|
end
|
138
138
|
|
139
|
-
|
139
|
+
### Use options, and then test a configuration setting
|
140
140
|
|
141
141
|
describe parse_config_file('/path/to/file.conf', { multiple_values: true }) do
|
142
142
|
its('PARAM_X') { should include 'Y' }
|
143
143
|
end
|
144
|
+
|
145
|
+
## Test a file with an ini-like structure (such as a yum.conf)
|
146
|
+
|
147
|
+
describe parse_config_file('/path/to/yum.conf') do
|
148
|
+
its('main') { should include('gpgcheck' => '1') }
|
149
|
+
end
|