inspec 1.0.0 → 1.35.1

data/lib/resources/security_policy.rb

@@ -117,7 +117,7 @@ module Inspec::Resources
       return skip_resource "Can't read security policy" if cmd.exit_status.to_i != 0
       @content = cmd.stdout
 
-      if @content.empty? && file.size > 0
+      if @content.empty? && !file.empty?
         return skip_resource "Can't read security policy"
       end
       @content
@@ -132,7 +132,7 @@ module Inspec::Resources
 
       conf = SimpleConfig.new(
         @content,
-        assignment_re: /^\s*(.*)=\s*(\S*)\s*$/,
+        assignment_regex: /^\s*(.*)=\s*(\S*)\s*$/,
       )
       @params = convert_hash(conf.params)
     end

data/lib/resources/service.rb

@@ -2,7 +2,7 @@
 # author: Christoph Hartmann
 # author: Dominik Richter
 # author: Stephan Renatus
-# license: All rights reserved
+
 require 'hashie'
 
 module Inspec::Resources
@@ -120,6 +120,13 @@ module Inspec::Resources
         else
           Systemd.new(inspec, service_ctl)
         end
+      elsif %w{linuxmint}.include?(platform)
+        version = os[:release].to_f
+        if version < 18
+          Upstart.new(inspec, service_ctl)
+        else
+          Systemd.new(inspec, service_ctl)
+        end
       elsif %w{debian}.include?(platform)
         version = os[:release].to_i
         if version > 7
@@ -127,9 +134,9 @@ module Inspec::Resources
         else
           SysV.new(inspec, service_ctl || '/usr/sbin/service')
         end
-      elsif %w{redhat fedora centos}.include?(platform)
+      elsif %w{redhat fedora centos oracle}.include?(platform)
         version = os[:release].to_i
-        if (%w{ redhat centos }.include?(platform) && version >= 7) || (platform == 'fedora' && version >= 15)
+        if (%w{ redhat centos oracle }.include?(platform) && version >= 7) || (platform == 'fedora' && version >= 15)
           Systemd.new(inspec, service_ctl)
         else
           SysV.new(inspec, service_ctl || '/sbin/service')
@@ -144,6 +151,8 @@ module Inspec::Resources
         BSDInit.new(inspec, service_ctl)
       elsif %w{arch}.include?(platform)
         Systemd.new(inspec, service_ctl)
+      elsif %w{coreos}.include?(platform)
+        Systemd.new(inspec, service_ctl)
       elsif %w{suse opensuse}.include?(platform)
         if os[:release].to_i >= 12
           Systemd.new(inspec, service_ctl)
@@ -255,7 +264,7 @@ module Inspec::Resources
       # parse data
       params = SimpleConfig.new(
         cmd.stdout.chomp,
-        assignment_re: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/,
         multiple_values: false,
       ).params
 
@@ -329,7 +338,7 @@ module Inspec::Resources
       status = inspec.command("#{service_ctl} status #{service_name}")
 
       # fallback for systemv services, those are not handled via `initctl`
-      return SysV.new(inspec).info(service_name) if status.exit_status.to_i != 0
+      return SysV.new(inspec).info(service_name) if status.exit_status.to_i != 0 || status.stdout == ''
 
       # @see: http://upstart.ubuntu.com/cookbook/#job-states
       # grep for running to indicate the service is there
@@ -606,7 +615,8 @@ module Inspec::Resources
     def service_enabled?(service)
       !service['WMI'].nil? &&
         !service['WMI']['StartMode'].nil? &&
-        service['WMI']['StartMode'] == 'Auto'
+        (service['WMI']['StartMode'] == 'Auto' ||
+        service['WMI']['StartMode'] == 'Manual')
     end
 
     # detect if service is running
@@ -629,7 +639,7 @@ module Inspec::Resources
 
       params = SimpleConfig.new(
         cmd.stdout.chomp,
-        assignment_re: /^(\w+)\s*(.*)$/,
+        assignment_regex: /^(\w+)\s*(.*)$/,
         multiple_values: false,
       ).params
 

data/lib/resources/ssh_conf.rb

@@ -2,17 +2,18 @@
 # copyright: 2015, Vulcano Security GmbH
 # author: Dominik Richter
 # author: Christoph Hartmann
-# license: All rights reserved
 
 require 'utils/simpleconfig'
 
 module Inspec::Resources
   class SshConf < Inspec.resource(1)
     name 'ssh_config'
-    desc 'Use the sshd_config InSpec audit resource to test configuration data for the Open SSH daemon located at /etc/ssh/sshd_config on Linux and UNIX platforms. sshd---the Open SSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command executation, and data exchanges.'
+    desc 'Use the `ssh_config` InSpec audit resource to test OpenSSH client configuration data located at `/etc/ssh/ssh_config` on Linux and Unix platforms.'
     example "
-      describe sshd_config do
-        its('Protocol') { should eq '2' }
+      describe ssh_config do
+        its('cipher') { should contain '3des' }
+        its('port') { should eq '22' }
+        its('hostname') { should include('example.com') }
       end
     "
 
@@ -62,7 +63,7 @@ module Inspec::Resources
       end
 
       @content = file.content
-      if @content.empty? && file.size > 0
+      if @content.empty? && !file.empty?
         return skip_resource "Can't read file \"#{@conf_path}\""
       end
 
@@ -74,7 +75,7 @@ module Inspec::Resources
       return @params = {} if read_content.nil?
       conf = SimpleConfig.new(
         read_content,
-        assignment_re: /^\s*(\S+?)\s+(.*?)\s*$/,
+        assignment_regex: /^\s*(\S+?)\s+(.*?)\s*$/,
         multiple_values: true,
       )
       @params = convert_hash(conf.params)
@@ -83,9 +84,19 @@ module Inspec::Resources
 
   class SshdConf < SshConf
     name 'sshd_config'
+    desc 'Use the sshd_config InSpec audit resource to test configuration data for the Open SSH daemon located at /etc/ssh/sshd_config on Linux and UNIX platforms. sshd---the Open SSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command execution, and data exchanges.'
+    example "
+      describe sshd_config do
+        its('Protocol') { should eq '2' }
+      end
+    "
 
     def initialize(path = nil)
       super(path || '/etc/ssh/sshd_config')
     end
+
+    def to_s
+      'SSHD Configuration'
+    end
   end
 end

data/lib/resources/ssl.rb

@@ -1,6 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Chef Software Inc.
-# license: All rights reserved
 # author: Dominik Richter
 # author: Christoph Hartmann
 
@@ -41,7 +40,7 @@ class SSL < Inspec.resource(1)
     'tls1.2',
   ].freeze
 
-  attr_reader :host, :port
+  attr_reader :host, :port, :timeout, :retries
 
   def initialize(opts = {})
     @host = opts[:host]
@@ -52,7 +51,7 @@ class SSL < Inspec.resource(1)
       elsif inspec.backend.class.to_s == 'Train::Transports::Local::Connection'
         @host = 'localhost'
       else
-        fail 'Cannot determine host for SSL test. Please specify it or use a different target.'
+        raise 'Cannot determine host for SSL test. Please specify it or use a different target.'
       end
     end
     @port = opts[:port] || 443
@@ -71,7 +70,7 @@ class SSL < Inspec.resource(1)
           res = Parallel.map(groups, in_threads: 8) do |proto, e|
             [proto, SSLShake.hello(x.resource.host, port: x.resource.port,
               protocol: proto, ciphers: e.map(&:cipher),
-              timeout: @timeout, retries: @retries)]
+              timeout: x.resource.timeout, retries: x.resource.retries, servername: x.resource.host)]
           end
           Hash[res]
         }

data/lib/resources/sys_info.rb

@@ -14,7 +14,7 @@ module Inspec::Resources
     # returns the hostname of the local system
     def hostname
       os = inspec.os
-      if os.linux?
+      if os.linux? || os.darwin?
         inspec.command('hostname').stdout.chomp
       elsif os.windows?
         inspec.powershell('$env:computername').stdout.chomp

data/lib/resources/toml.rb

@@ -0,0 +1,26 @@
+# encoding: utf-8
+# author: Nolan Davidson
+
+require 'toml'
+
+module Inspec::Resources
+  class TomlConfig < JsonConfig
+    name 'toml'
+    desc 'Use the toml InSpec resource to test configuration data in a TOML file'
+    example "
+      describe toml('default.toml') do
+        its('key') { should eq('value') }
+        its (['arr', 1]) { should eq 2 }
+        its (['mytable', 'key1']) { should eq 'value1' }
+      end
+    "
+
+    def parse(content)
+      TOML::Parser.new(content).parsed
+    end
+
+    def to_s
+      "TOML #{@path}"
+    end
+  end
+end

data/lib/resources/users.rb

@@ -57,7 +57,7 @@ module Inspec::Resources
     name 'users'
     desc 'Use the users InSpec audit resource to test local user profiles. Users can be filtered by groups to which they belong, the frequency of required password changes, the directory paths to home and shell.'
     example "
-      describe users.where(uid: 0).entries do
+      describe users.where { uid == 0 }.entries do
         it { should eq ['root'] }
         its('uids') { should eq [1234] }
         its('gids') { should eq [1234] }
@@ -242,7 +242,7 @@ module Inspec::Resources
 
     def has_authorized_key?(_compare_key)
       deprecated('has_authorized_key?')
-      fail NotImplementedError
+      raise NotImplementedError
     end
 
     def deprecated(name, alternative = nil)
@@ -292,7 +292,7 @@ module Inspec::Resources
     #   groups: '',
     # }
     def identity(_username)
-      fail 'user provider must implement the `identity` method'
+      raise 'user provider must implement the `identity` method'
     end
 
     # returns optional information about a user, eg shell
@@ -313,7 +313,7 @@ module Inspec::Resources
 
     # returns an array with users
     def list_users
-      fail 'user provider must implement the `list_users` method'
+      raise 'user provider must implement the `list_users` method'
     end
 
     # retuns all aspects of the user as one hash
@@ -358,7 +358,7 @@ module Inspec::Resources
       SimpleConfig.new(
         line,
         line_separator: ',',
-        assignment_re: /^\s*([^\(]*?)\s*\(\s*(.*?)\)*$/,
+        assignment_regex: /^\s*([^\(]*?)\s*\(\s*(.*?)\)*$/,
         group_re: nil,
         multiple_values: false,
       ).params
@@ -372,7 +372,7 @@ module Inspec::Resources
       # parse words
       params = SimpleConfig.new(
         parse_id_entries(cmd.stdout.chomp),
-        assignment_re: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/,
         group_re: nil,
         multiple_values: false,
       ).params
@@ -419,7 +419,7 @@ module Inspec::Resources
 
       params = SimpleConfig.new(
         cmd.stdout.chomp,
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         group_re: nil,
         multiple_values: false,
       ).params
@@ -512,7 +512,7 @@ module Inspec::Resources
 
       params = SimpleConfig.new(
         cmd.stdout.chomp,
-        assignment_re: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
         group_re: nil,
         multiple_values: false,
       ).params
@@ -556,7 +556,7 @@ module Inspec::Resources
     def parse_windows_account(username)
       account = username.split('\\')
       name = account.pop
-      domain = account.pop if account.size > 0
+      domain = account.pop if !account.empty?
       [name, domain]
     end
 
@@ -565,7 +565,7 @@ module Inspec::Resources
       name, _domain = parse_windows_account(username)
       return if collect_user_details.nil?
       res = collect_user_details.select { |user| user[:username] == name }
-      res[0] if res.length > 0
+      res[0] if !res.empty?
     end
 
     def list_users
@@ -576,42 +576,42 @@ module Inspec::Resources
     def collect_user_details # rubocop:disable Metrics/MethodLength
       return @users_cache if defined?(@users_cache)
       script = <<-EOH
-Function  ConvertTo-SID { Param([byte[]]$BinarySID)
-  (New-Object  System.Security.Principal.SecurityIdentifier($BinarySID,0)).Value
+Function ConvertTo-SID { Param([byte[]]$BinarySID)
+  (New-Object System.Security.Principal.SecurityIdentifier($BinarySID,0)).Value
 }
 
-Function  Convert-UserFlag { Param  ($UserFlag)
-  $List  = @()
-  Switch  ($UserFlag) {
-    ($UserFlag  -BOR 0x0001)  { $List += 'SCRIPT' }
-    ($UserFlag  -BOR 0x0002)  { $List += 'ACCOUNTDISABLE' }
-    ($UserFlag  -BOR 0x0008)  { $List += 'HOMEDIR_REQUIRED' }
-    ($UserFlag  -BOR 0x0010)  { $List += 'LOCKOUT' }
-    ($UserFlag  -BOR 0x0020)  { $List += 'PASSWD_NOTREQD' }
-    ($UserFlag  -BOR 0x0040)  { $List += 'PASSWD_CANT_CHANGE' }
-    ($UserFlag  -BOR 0x0080)  { $List += 'ENCRYPTED_TEXT_PWD_ALLOWED' }
-    ($UserFlag  -BOR 0x0100)  { $List += 'TEMP_DUPLICATE_ACCOUNT' }
-    ($UserFlag  -BOR 0x0200)  { $List += 'NORMAL_ACCOUNT' }
-    ($UserFlag  -BOR 0x0800)  { $List += 'INTERDOMAIN_TRUST_ACCOUNT' }
-    ($UserFlag  -BOR 0x1000)  { $List += 'WORKSTATION_TRUST_ACCOUNT' }
-    ($UserFlag  -BOR 0x2000)  { $List += 'SERVER_TRUST_ACCOUNT' }
-    ($UserFlag  -BOR 0x10000)  { $List += 'DONT_EXPIRE_PASSWORD' }
-    ($UserFlag  -BOR 0x20000)  { $List += 'MNS_LOGON_ACCOUNT' }
-    ($UserFlag  -BOR 0x40000)  { $List += 'SMARTCARD_REQUIRED' }
-    ($UserFlag  -BOR 0x80000)  { $List += 'TRUSTED_FOR_DELEGATION' }
-    ($UserFlag  -BOR 0x100000)  { $List += 'NOT_DELEGATED' }
-    ($UserFlag  -BOR 0x200000)  { $List += 'USE_DES_KEY_ONLY' }
-    ($UserFlag  -BOR 0x400000)  { $List += 'DONT_REQ_PREAUTH' }
-    ($UserFlag  -BOR 0x800000)  { $List += 'PASSWORD_EXPIRED' }
-    ($UserFlag  -BOR 0x1000000)  { $List += 'TRUSTED_TO_AUTH_FOR_DELEGATION' }
-    ($UserFlag  -BOR 0x04000000)  { $List += 'PARTIAL_SECRETS_ACCOUNT' }
+Function Convert-UserFlag { Param  ($UserFlag)
+  $List = @()
+  Switch ($UserFlag) {
+    ($UserFlag -BOR 0x0001) { $List += 'SCRIPT' }
+    ($UserFlag -BOR 0x0002) { $List += 'ACCOUNTDISABLE' }
+    ($UserFlag -BOR 0x0008) { $List += 'HOMEDIR_REQUIRED' }
+    ($UserFlag -BOR 0x0010) { $List += 'LOCKOUT' }
+    ($UserFlag -BOR 0x0020) { $List += 'PASSWD_NOTREQD' }
+    ($UserFlag -BOR 0x0040) { $List += 'PASSWD_CANT_CHANGE' }
+    ($UserFlag -BOR 0x0080) { $List += 'ENCRYPTED_TEXT_PWD_ALLOWED' }
+    ($UserFlag -BOR 0x0100) { $List += 'TEMP_DUPLICATE_ACCOUNT' }
+    ($UserFlag -BOR 0x0200) { $List += 'NORMAL_ACCOUNT' }
+    ($UserFlag -BOR 0x0800) { $List += 'INTERDOMAIN_TRUST_ACCOUNT' }
+    ($UserFlag -BOR 0x1000) { $List += 'WORKSTATION_TRUST_ACCOUNT' }
+    ($UserFlag -BOR 0x2000) { $List += 'SERVER_TRUST_ACCOUNT' }
+    ($UserFlag -BOR 0x10000) { $List += 'DONT_EXPIRE_PASSWORD' }
+    ($UserFlag -BOR 0x20000) { $List += 'MNS_LOGON_ACCOUNT' }
+    ($UserFlag -BOR 0x40000) { $List += 'SMARTCARD_REQUIRED' }
+    ($UserFlag -BOR 0x80000) { $List += 'TRUSTED_FOR_DELEGATION' }
+    ($UserFlag -BOR 0x100000) { $List += 'NOT_DELEGATED' }
+    ($UserFlag -BOR 0x200000) { $List += 'USE_DES_KEY_ONLY' }
+    ($UserFlag -BOR 0x400000) { $List += 'DONT_REQ_PREAUTH' }
+    ($UserFlag -BOR 0x800000) { $List += 'PASSWORD_EXPIRED' }
+    ($UserFlag -BOR 0x1000000) { $List += 'TRUSTED_TO_AUTH_FOR_DELEGATION' }
+    ($UserFlag -BOR 0x04000000) { $List += 'PARTIAL_SECRETS_ACCOUNT' }
   }
   $List
 }
 
-$Computername =  $Env:Computername
-$adsi  = [ADSI]"WinNT://$Computername"
-$adsi.Children | where {$_.SchemaClassName -eq  'user'} |  ForEach {
+$Computername = $Env:Computername
+$adsi = [ADSI]"WinNT://$Computername"
+$adsi.Children | where {$_.SchemaClassName -eq 'user'} | ForEach {
   New-Object PSObject -property @{
     uid = ConvertTo-SID -BinarySID $_.ObjectSID[0]
     username = $_.Name[0]
@@ -627,7 +627,7 @@ $adsi.Children | where {$_.SchemaClassName -eq  'user'} |  ForEach {
     maxbadpasswords = $_.MaxBadPasswordsAllowed[0]
     gid = $null
     group = $null
-    groups = $null
+    groups = @($_.Groups() | Foreach-Object { $_.GetType().InvokeMember('Name', 'GetProperty', $null, $_, $null) })
     home = $_.HomeDirectory[0]
     shell = $null
     domain = $Computername

data/lib/resources/virtualization.rb

@@ -0,0 +1,252 @@
+# encoding: utf-8
+# author: Takaaki Furukawa
+
+require 'hashie/mash'
+
+module Inspec::Resources
+  class Virtualization < Inspec.resource(1) # rubocop:disable Metrics/ClassLength
+    name 'virtualization'
+    desc 'Use the virtualization InSpec audit resource to test the virtualization platform on which the system is running'
+    example "
+      describe virtualization do
+        its('system') { should eq 'docker' }
+      end
+
+      describe virtualization do
+        its('role') { should eq 'guest' }
+      end
+
+      control 'test' do
+        describe file('/var/tmp/foo') do
+          it { should be_file }
+        end
+        only_if { virtualization.system == 'docker' }
+      end
+    "
+
+    def initialize
+      unless inspec.os.linux?
+        skip_resource 'The `virtualization` resource is not supported on your OS yet.'
+      else
+        collect_data_linux
+      end
+    end
+
+    # add helper methods for easy access of properties
+    # allows users to use virtualization.role, virtualization.system
+    %w{role system}.each do |property|
+      define_method(property.to_sym) do
+        @virtualization_data[property.to_sym]
+      end
+    end
+
+    def params
+      collect_data_linux
+    end
+
+    def to_s
+      'Virtualization Detection'
+    end
+
+    private
+
+    def lxc_version_exists?
+      inspec.command('lxc-version').exist?
+    end
+
+    def docker_exists?
+      inspec.command('docker').exist?
+    end
+
+    def nova_exists?
+      inspec.command('nova').exist?
+    end
+
+    # Detect Xen
+    # /proc/xen is an empty dir for EL6 + Linode Guests + Paravirt EC2 instances
+    # Notes:
+    # - cpuid of guests, if we could get it, would also be a clue
+    # - may be able to determine if under paravirt from /dev/xen/evtchn (See OHAI-253)
+    # - Additional edge cases likely should not change the above assumptions
+    #   but rather be additive - btm
+    def detect_xen
+      return false unless inspec.file('/proc/xen').exist?
+      @virtualization_data[:system] = 'xen'
+      @virtualization_data[:role] = 'guest'
+
+      # This file should exist on most Xen systems, normally empty for guests
+      if inspec.file('/proc/xen/capabilities').exist? &&
+          inspec.file('/proc/xen/capabilities').content =~ /control_d/i # rubocop:disable Style/MultilineOperationIndentation
+        @virtualization_data[:role] = 'host'
+      end
+      true
+    end
+
+    # Detect Virtualbox from kernel module
+    def detect_virtualbox
+      return false unless inspec.file('/proc/modules').exist?
+      modules = inspec.file('/proc/modules').content
+      if modules =~ /^vboxdrv/
+        Inspec::Log.debug('Plugin Virtualization: /proc/modules contains vboxdrv. Detecting as vbox host')
+        @virtualization_data[:system] = 'vbox'
+        @virtualization_data[:role] = 'host'
+      elsif modules =~ /^vboxguest/
+        Inspec::Log.debug('Plugin Virtualization: /proc/modules contains vboxguest. Detecting as vbox guest')
+        @virtualization_data[:system] = 'vbox'
+        @virtualization_data[:role] = 'guest'
+      else
+        return false
+      end
+      true
+    end
+
+    # if nova binary is present we're on an openstack host
+    def detect_openstack
+      return false unless nova_exists?
+      @virtualization_data[:system] = 'openstack'
+      @virtualization_data[:role] = 'host'
+      true
+    end
+
+    # Detect paravirt KVM/QEMU from cpuinfo, report as KVM
+    def detect_kvm_from_cpuinfo
+      return false unless inspec.file('/proc/cpuinfo').content =~ /QEMU Virtual CPU|Common KVM processor|Common 32-bit KVM processor/
+      @virtualization_data[:system] = 'kvm'
+      @virtualization_data[:role] = 'guest'
+      true
+    end
+
+    # Detect KVM systems via /sys
+    # guests will have the hypervisor cpu feature that hosts don't have
+    def detect_kvm_from_sys
+      return false unless inspec.file('/sys/devices/virtual/misc/kvm').exist?
+      if inspec.file('/proc/cpuinfo').content =~ /hypervisor/
+        @virtualization_data[:system] = 'kvm'
+        @virtualization_data[:role] = 'guest'
+      else
+        @virtualization_data[:system] = 'kvm'
+        @virtualization_data[:role] = 'host'
+      end
+      true
+    end
+
+    # Detect OpenVZ / Virtuozzo.
+    # http://wiki.openvz.org/BC_proc_entries
+    def detect_openvz
+      if inspec.file('/proc/bc/0').exist?
+        @virtualization_data[:system] = 'openvz'
+        @virtualization_data[:role] = 'host'
+      elsif inspec.file('/proc/vz').exist?
+        @virtualization_data[:system] = 'openvz'
+        @virtualization_data[:role] = 'guest'
+      else
+        return false
+      end
+      true
+    end
+
+    # Detect Parallels virtual machine from pci devices
+    def detect_parallels
+      return false unless inspec.file('/proc/bus/pci/devices').content =~ /1ab84000/
+      @virtualization_data[:system] = 'parallels'
+      @virtualization_data[:role] = 'guest'
+      true
+    end
+
+    # Detect Linux-VServer
+    def detect_linux_vserver
+      return false unless inspec.file('/proc/self/status').exist?
+      proc_self_status = inspec.file('/proc/self/status').content
+      vxid = proc_self_status.match(/^(s_context|VxID):\s*(\d+)$/)
+      return false unless vxid && vxid[2]
+      @virtualization_data[:system] = 'linux-vserver'
+      if vxid[2] == '0'
+        @virtualization_data[:role] = 'host'
+      else
+        @virtualization_data[:role] = 'guest'
+      end
+      true
+    end
+
+    # Detect LXC/Docker
+    #
+    # /proc/self/cgroup will look like this inside a docker container:
+    # <index #>:<subsystem>:/lxc/<hexadecimal container id>
+    #
+    # /proc/self/cgroup could have a name including alpha/digit/dashes
+    # <index #>:<subsystem>:/lxc/<named container id>
+    #
+    # /proc/self/cgroup could have a non-lxc cgroup name indicating other uses
+    # of cgroups.  This is probably not LXC/Docker.
+    # <index #>:<subsystem>:/Charlie
+    #
+    # A host which supports cgroups, and has capacity to host lxc containers,
+    # will show the subsystems and root (/) namespace.
+    # <index #>:<subsystem>:/
+    #
+    # Full notes, https://tickets.opscode.com/browse/OHAI-551
+    # Kernel docs, https://www.kernel.org/doc/Documentation/cgroups
+    def detect_lxc_docker
+      return false unless inspec.file('/proc/self/cgroup').exist?
+      cgroup_content = inspec.file('/proc/self/cgroup').content
+      if cgroup_content =~ %r{^\d+:[^:]+:/(lxc|docker)/.+$} ||
+          cgroup_content =~ %r{^\d+:[^:]+:/[^/]+/(lxc|docker)-.+$} # rubocop:disable Style/MultilineOperationIndentation
+        @virtualization_data[:system] = $1 # rubocop:disable Style/PerlBackrefs
+        @virtualization_data[:role] = 'guest'
+      elsif lxc_version_exists? && cgroup_content =~ %r{\d:[^:]+:/$}
+        # lxc-version shouldn't be installed by default
+        # Even so, it is likely we are on an LXC capable host that is not being used as such
+        # So we're cautious here to not overwrite other existing values (OHAI-573)
+        unless @virtualization_data[:system] && @virtualization_data[:role]
+          @virtualization_data[:system] = 'lxc'
+          @virtualization_data[:role] = 'host'
+        end
+      else
+        return false
+      end
+      true
+    end
+
+    def detect_docker
+      return false unless inspec.file('/.dockerenv').exist? || inspec.file('/.dockerinit').exist?
+      @virtualization_data[:system] = 'docker'
+      @virtualization_data[:role] = 'guest'
+      true
+    end
+
+    # Detect LXD
+    # See https://github.com/lxc/lxd/blob/master/doc/dev-lxd.md
+    def detect_lxd
+      if inspec.file('/dev/lxd/sock').exist?
+        @virtualization_data[:system] = 'lxd'
+        @virtualization_data[:role] = 'guest'
+      elsif inspec.file('/var/lib/lxd/devlxd').exist?
+        @virtualization_data[:system] = 'lxd'
+        @virtualization_data[:role] = 'host'
+      else
+        return false
+      end
+      true
+    end
+
+    def collect_data_linux # rubocop:disable Metrics/PerceivedComplexity, Metrics/CyclomaticComplexity
+      # cache data in an instance var to avoid doing multiple detections for a single test
+      @virtualization_data ||= Hashie::Mash.new
+      return unless @virtualization_data.empty?
+
+      # each detect method will return true if it matched and was successfully
+      # able to populate @virtualization_data with stuff.
+      return if detect_xen
+      return if detect_virtualbox
+      return if detect_openstack
+      return if detect_kvm_from_cpuinfo
+      return if detect_kvm_from_sys
+      return if detect_openvz
+      return if detect_parallels
+      return if detect_linux_vserver
+      return if detect_lxc_docker
+      return if detect_docker
+      return if detect_lxd
+    end
+  end
+end