inspec 1.0.0 → 1.35.1

data/docs/resources/aide_conf.md.erb

@@ -0,0 +1,81 @@
+---
+title: About the aide_conf Resource
+---
+
+# aide_conf
+
+Use the `aide_conf` InSpec audit resource to test the rules established for the file integrity tool AIDE. Controlled by the aide.conf file typically at /etc/aide.conf.
+
+## Syntax
+
+An `aide_conf` resource block can be used to determine if the selection lines contain one (or more) directories whose files should be added to the aide database:
+
+    describe aide_conf('path') do
+      its('selection_lines') { should include '/sbin' }
+    end
+
+where
+
+* `'selection_lines'` refers to all selection lines found in the aide.conf file
+* `('path')` is the non-default path to the `aide.conf` file (optional)
+* `should include 'value'` is the value that is expected
+
+Use the where clause to match a selection_line to one rule or a particular set of rules found in the aide.conf file:
+
+    describe aide_conf.where { selection_line == '/bin' } do
+      its('rules.flatten') { should include 'r' }
+    end
+
+    describe aide_conf.where { selection_line == '/sbin' } do
+      its('rules') { should include ['p', 'i', 'l', 'n', 'u', 'g', 'sha512'] }
+    end
+
+## Matchers
+
+This InSpec audit resource has the following matchers:
+
+### be
+
+<%= partial "/shared/matcher_be" %>
+
+### cmp
+
+<%= partial "/shared/matcher_cmp" %>
+
+### eq
+
+<%= partial "/shared/matcher_eq" %>
+
+### include
+
+<%= partial "/shared/matcher_include" %>
+
+### all_have_rule
+
+The usage of all_have_rule will return whether or not all selection lines in audit.conf contain a particular rule:
+
+    describe aide_conf.all_have_rule('sha512') do
+      it { should eq true }
+    end
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test if all selection lines contain the xattr rule
+
+    describe aide_conf.all_have_rule('xattr') do
+      it { should eq true }
+    end
+
+### Test whether selection line for /bin contains a particular rule
+
+    describe aide_conf.where { selection_line == '/bin' } do
+      its('rules.flatten') { should include 'r' }
+    end
+
+### Test whether selection line for /sbin consists of a particular set of rules
+
+    describe aide_conf.where { selection_line == '/sbin' } do
+      its('rules') { should include ['r', 'sha512'] }
+    end

data/docs/resources/apache_conf.md.erb

@@ -6,7 +6,7 @@ title: About the apache_conf Resource
 
 Use the `apache_conf` InSpec audit resource to test the configuration settings for Apache. This file is typically located under `/etc/apache2` on the Debian and Ubuntu platforms and under `/etc/httpd` on the Fedora, CentOS, RedHat Enterprise Linux, and ArchLinux platforms. The configuration settings may vary significantly from platform to platform.
 
-# Syntax
+## Syntax
 
 An `apache_conf` InSpec audit resource block declares configuration settings that should be tested:
 
@@ -20,7 +20,7 @@ where
 * `('path')` is the non-default path to the Apache configuration file
 * `{ should eq 'value' }` is the value that is expected
 
-# Matchers
+## Matchers
 
 This InSpec audit resource matches any service that is listed in the Apache configuration file:
 
@@ -38,37 +38,37 @@ For example:
     end
 
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test for blocking .htaccess files on CentOS
+### Test for blocking .htaccess files on CentOS
 
     describe apache_conf do
       its('AllowOverride') { should eq 'None' }
     end
 
-## Test ports for SSL
+### Test ports for SSL
 
     describe apache_conf do
       its('Listen') { should eq '443'}

data/docs/resources/apt.md.erb

@@ -6,7 +6,7 @@ title: About the apt Resource
 
 Use the `apt` InSpec audit resource to verify Apt repositories on the Debian and Ubuntu platforms, and also PPA repositories on the Ubuntu platform.
 
-# Syntax
+## Syntax
 
 An `apt` resource block tests the contents of Apt and PPA repositories:
 
@@ -22,61 +22,61 @@ where
 * `exist` and `be_enabled` are a valid matchers for this resource
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_enabled
+### be_enabled
 
 The `be_enabled` matcher tests if a package exists in the repository:
 
     it { should be_enabled }
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## exist
+### exist
 
 The `exist` matcher tests if a package exists on the system:
 
     it { should exist }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test if apt repository exists and is enabled
+### Test if apt repository exists and is enabled
 
     describe apt('http://ppa.launchpad.net/juju/stable/ubuntu') do
       it { should exist }
       it { should be_enabled }
     end
 
-## Verify that a PPA repository exists and is enabled
+### Verify that a PPA repository exists and is enabled
 
     describe apt('ppa:nginx/stable') do
       it { should exist }
       it { should be_enabled }
     end
 
-## Verify that a repository is not present
+### Verify that a repository is not present
 
     describe apt('ubuntu-wine/ppa') do
       it { should_not exist }

data/docs/resources/audit_policy.md.erb

@@ -6,7 +6,7 @@ title: About the audit_policy Resource
 
 Use the `audit_policy` Inspec audit resource to test auditing policies on the Windows platform. An auditing policy is a category of security-related events to be audited. Auditing is disabled by default and may be enabled for categories like account management, logon events, policy changes, process tracking, privilege use, system events, or object access. For each auditing category property that is enabled, the auditing level may be set to `No Auditing`, `Not Specified`, `Success`, `Success and Failure`, or `Failure`.
 
-# Syntax
+## Syntax
 
 An `audit_policy` resource block declares a parameter that belongs to an audit policy category or subcategory:
 
@@ -20,41 +20,41 @@ where
 * `'value'` must be one of `No Auditing`, `Not Specified`, `Success`, `Success and Failure`, or `Failure`
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test that a parameter is not set to "No Auditing"
+### Test that a parameter is not set to "No Auditing"
 
     describe audit_policy do
       its('Other Account Logon Events') { should_not eq 'No Auditing' }
     end
 
-## Test that a parameter is set to "Success"
+### Test that a parameter is set to "Success"
 
     describe audit_policy do
       its('User Account Management') { should eq 'Success' }

data/docs/resources/auditd_conf.md.erb

@@ -6,7 +6,7 @@ title: About the auditd_conf Resource
 
 Use the `auditd_conf` InSpec audit resource to test the configuration settings for the audit daemon. This file is typically located under `/etc/audit/auditd.conf'` on Unix and Linux platforms.
 
-# Syntax
+## Syntax
 
 A `auditd_conf` resource block declares configuration settings that should be tested:
 
@@ -21,27 +21,27 @@ where
 * `{ should cmp 'value' }` is the value that is expected
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## keyword
+### keyword
 
 This matcher will matche any keyword that is listed in the `auditd.conf` configuration file. Option names and values are case-insensitive:
 
@@ -51,15 +51,15 @@ or:
 
     its('max_log_file') { should cmp 6 }
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test the auditd.conf file
+### Test the auditd.conf file
 
     describe auditd_conf do
       its('log_file') { should cmp '/full/path/to/file' }

data/docs/resources/auditd_rules.md.erb

@@ -7,7 +7,7 @@ title: About the auditd_rules Resource
 Use the `auditd_rules` InSpec audit resource to test the rules for logging that exist on the system. The `audit.rules` file is typically located under `/etc/audit/` and contains the list of rules that define what is captured in log files. This resource uses `auditctl` to query the run-time `auditd` rules setup, which may be different from `audit.rules`.
 
 
-# Syntax
+## Syntax
 
 An `auditd_rules` resource block declares one (or more) rules to be tested, and then what that rule should do. The syntax depends on the version of `audit`:
 
@@ -62,35 +62,35 @@ or test that individual rules are defined:
 where each test must declare one (or more) rules to be tested.
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test if a rule contains a matching element that is identified by a regular expression
+### Test if a rule contains a matching element that is identified by a regular expression
 
 For `audit` >= 2.3:
 
@@ -109,13 +109,13 @@ For `audit` < 2.3:
     end
 
 
-## Query the audit daemon status
+### Query the audit daemon status
 
     describe auditd_rules.status('backlog') do
       it { should cmp 0 }
     end
 
-## Query properties of rules targeting specific syscalls or files
+### Query properties of rules targeting specific syscalls or files
 
     describe auditd_rules.syscall('open').action do
       it { should eq(['always']) }

data/docs/resources/bash.md.erb

@@ -6,7 +6,7 @@ title: About the bash Resource
 
 Use the `bash` InSpec audit resource to test an arbitrary command that is run on the system using a Bash script.
 
-# Syntax
+## Syntax
 
 A `command` resource block declares a command to be run, one (or more) expected outputs, and the location to which that output is sent:
 
@@ -30,55 +30,55 @@ For example:
     end
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## exist
+### exist
 
 The `exist` matcher tests if a command may be run on the system:
 
     it { should exist }
 
-## exit_status
+### exit_status
 
 The `exit_status` matcher tests the exit status for the command:
 
     its('exit_status') { should eq 0 }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## stderr
+### stderr
 
 The `stderr` matcher tests results of the command as returned in standard error (stderr):
 
     its('stderr') { should eq '' }
 
-## stdout
+### stdout
 
 The `stdout` matcher tests results of the command as returned in standard output (stdout).
 
     its('stdout') { should match /bin/ }
 
 
-# Examples
+## Examples
 
 None.

data/docs/resources/bond.md.erb

@@ -6,7 +6,7 @@ title: About the bond Resource
 
 Use the `bond` InSpec audit resource to test a logical, bonded network interface (i.e. "two or more network interfaces aggregated into a single, logical network interface"). On Linux platforms, any value in the `/proc/net/bonding` directory may be tested.
 
-# Syntax
+## Syntax
 
 A `bond` resource block declares a bonded network interface, and then specifies the properties of that bonded network interface to be tested:
 
@@ -20,72 +20,72 @@ where
 * `{ should exist }` is a valid matcher for this resource
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## content
+### content
 
 The `content` matcher tests if contents in the file that defines the bonded network interface match the value specified in the test. The values of the `content` matcher are arbitrary:
 
     its('content') { should match('value') }
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## exist
+### exist
 
 The `exist` matcher tests if the bonded network interface is available:
 
     it { should exist }
 
-## have_interface
+### have_interface
 
 The `have_interface` matcher tests if the bonded network interface has one (or more) secondary interfaces:
 
     it { should have_interface }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## interfaces
+### interfaces
 
 The `interfaces` matcher tests if the named secondary interfaces are available:
 
     its('interfaces') { should eq ['eth0', 'eth1', ...] }
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## params
+### params
 
 The `params` matcher tests arbitrary parameters for the bonded network interface:
 
     its('params') { should eq 'value' }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test if eth0 is a secondary interface for bond0
+### Test if eth0 is a secondary interface for bond0
 
     describe bond('bond0') do
       it { should exist }
       it { should have_interface 'eth0' }
     end
 
-## Test parameters for bond0
+### Test parameters for bond0
 
     describe bond('bond0') do
       its('Bonding Mode') { should eq 'IEEE 802.3ad Dynamic link aggregation' }

data/docs/resources/bridge.md.erb

@@ -9,7 +9,7 @@ Use the `bridge` InSpec audit resource to test basic network bridge properties,
 * On Linux platforms, any value in the `/sys/class/net/{interface}/bridge` directory may be tested
 * On the Windows platform, the `Get-NetAdapter` cmdlet is associated with the `Get-NetAdapterBinding` cmdlet and returns the `ComponentID ms_bridge` value as a JSON object
 
-# Syntax
+## Syntax
 
 A `bridge` resource block declares the bridge to be tested and what interface it should be associated with:
 
@@ -18,39 +18,39 @@ A `bridge` resource block declares the bridge to be tested and what interface it
       it { should have_interface 'eth0' }
     end
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## exist
+### exist
 
 The `exist` matcher tests if the network bridge is available:
 
     it { should exist }
 
-## have_interface
+### have_interface
 
 The `have_interface` matcher tests if the named interface is defined for the network bridge:
 
     it { should have_interface 'eth0' }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## interfaces
+### interfaces
 
 The `interfaces` matcher tests if the named interface is present:
 
@@ -58,10 +58,10 @@ The `interfaces` matcher tests if the named interface is present:
     its('interfaces') { should eq 'bar' }
     its('interfaces') { should include('foo') }
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 None.