inspec 1.31.0 → 1.45.9

data/docs/resources/wmi.md.erb

@@ -6,6 +6,8 @@ title: About the wmi Resource
 
 Use the `wmi` InSpec audit resource to test WMI settings on the Windows platform.
 
+<br>
+
 ## Syntax
 
 A `wmi` resource block tests WMI settings on the Windows platform:
@@ -46,30 +48,7 @@ and the second uses a filter in the Ruby Hash to first identify WinRM, and then
       its('DisplayName') { should eq 'Windows Remote Management (WS-Management)'}
     end
 
-
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
+<br>
 
 ## Examples
 
@@ -93,3 +72,9 @@ The following examples show how to use this InSpec audit resource.
     }) do
       its('Setting') { should eq false }
     end
+
+<br>
+
+## Matchers
+
+For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).

data/docs/resources/x509_certificate.md.erb

@@ -12,6 +12,8 @@ or communications over a network. They may also be used for authentication.
 Examples include SSL certificates, S/MIME certificates and VPN authentication
 certificates.
 
+<br>
+
 ## Syntax
 
 An `x509_certificate` resource block declares a certificate `key file` to be tested.
@@ -20,6 +22,8 @@ An `x509_certificate` resource block declares a certificate `key file` to be tes
       its('validity_in_days') { should be > 30 }
     end
 
+<br>
+
 ## Supported Properties
 
 ### subject.XX

data/docs/resources/xinetd_conf.md.erb

@@ -6,6 +6,8 @@ title: About the xinetd_conf Resource
 
 Use the `xinetd_conf` InSpec audit resource to test services under `/etc/xinet.d` on Linux and Unix platforms. xinetd---the extended Internet service daemon---listens on all ports, and then loads the appropriate program based on a request. The `xinetd.conf` file is typically located at `/etc/xinetd.conf` and contains a list of Internet services associated to the ports on which that service will listen. Only enabled services may handle a request; only services that are required by the system should be enabled.
 
+<br>
+
 ## Syntax
 
 An `xinetd_conf` resource block declares settings found in a `xinetd.conf` file for the named service:
@@ -21,28 +23,80 @@ where
 * `('setting')` is a setting in the `xinetd.conf` file
 * `should eq 'value'` is the value that is expected
 
+<br>
 
-## Matchers
+## Examples
 
-This InSpec audit resource has the following matchers:
+The following examples show how to use this InSpec audit resource.
 
-### be
+### Test a socket_type
 
-<%= partial "/shared/matcher_be" %>
+The network socket type: `dgram` (a datagram-based service), `raw` (a service that requires direct access to an IP address), `stream` (a stream-based service), or `seqpacket` (a service that requires a sequenced packet).
 
-### be_enabed
+    describe xinetd_conf.services('service_name') do
+       its('socket_types') { should include 'dgram' }
+    end
 
-The `be_enabled` matcher tests if a service listed under `/etc/xinet.d` is enabled:
+### Test a service type
 
-    it { should be_enabled }
+The type of service: `INTERNAL` (a service provided by xinetd), `RPC` (an RPC-based service), `TCPMUX` (a service that is started on a well-known TPCMUX port), or `UNLISTED` (a service that is not listed in a standard system file location).
 
-### cmp
+    describe xinetd_conf.services('service_name') do
+       its('type') { should include 'RPC' }
+    end
 
-<%= partial "/shared/matcher_cmp" %>
+### Test the telnet service
+
+For example, a `telnet` file under `/etc/xinet.d` contains the following settings:
+
+    service telnet
+    {
+      disable         = yes
+      flags           = REUSE
+      socket_type     = stream
+      wait            = no
+      user            = root
+      server          = /usr/sbin/in.telnetd
+      log_on_failure  += USERID
+    }
 
-### eq
+Some examples of tests that can be run against that file include:
 
-<%= partial "/shared/matcher_eq" %>
+    describe xinetd_conf.services('telnet') do
+      it { should be_disabled }
+    end
+
+and
+
+    describe xinetd_conf.services('telnet') do
+      its('socket_type') { should include 'stream' }
+    end
+
+and
+
+    describe xinetd_conf.services('telnet') do
+      its('wait') { should eq 'no' }
+    end
+
+All three settings can be tested in the same block as well:
+
+    describe xinetd_conf.services('telnet') do
+      it { should be_disabled }
+      its('socket_type') { should include 'stream' }
+      its('wait') { should eq 'no' }
+    end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### be_enabed
+
+The `be_enabled` matcher tests if a service listed under `/etc/xinet.d` is enabled:
+
+    it { should be_enabled }
 
 ### ids
 
@@ -54,14 +108,6 @@ For example:
 
     its('ids') { should include 'chargen-stream chargen-dgram'}
 
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
 ### services
 
 The `services` matcher tests if the named service is listed under `/etc/xinet.d`:
@@ -107,64 +153,3 @@ For TCP (`stream`) socket types the `wait` matcher should test for `no`:
 
     its('socket_types') { should eq 'stream' }
     its('wait') { should eq 'no' }
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test a socket_type
-
-The network socket type: `dgram` (a datagram-based service), `raw` (a service that requires direct access to an IP address), `stream` (a stream-based service), or `seqpacket` (a service that requires a sequenced packet).
-
-    describe xinetd_conf.services('service_name') do
-       its('socket_types') { should include 'dgram' }
-    end
-
-### Test a service type
-
-The type of service: `INTERNAL` (a service provided by xinetd), `RPC` (an RPC-based service), `TCPMUX` (a service that is started on a well-known TPCMUX port), or `UNLISTED` (a service that is not listed in a standard system file location).
-
-    describe xinetd_conf.services('service_name') do
-       its('type') { should include 'RPC' }
-    end
-
-### Test the telnet service
-
-For example, a `telnet` file under `/etc/xinet.d` contains the following settings:
-
-    service telnet
-    {
-      disable         = yes
-      flags           = REUSE
-      socket_type     = stream
-      wait            = no
-      user            = root
-      server          = /usr/sbin/in.telnetd
-      log_on_failure  += USERID
-    }
-
-Some examples of tests that can be run against that file include:
-
-    describe xinetd_conf.services('telnet') do
-      it { should be_disabled }
-    end
-
-and
-
-    describe xinetd_conf.services('telnet') do
-      its('socket_type') { should include 'stream' }
-    end
-
-and
-
-    describe xinetd_conf.services('telnet') do
-      its('wait') { should eq 'no' }
-    end
-
-All three settings can be tested in the same block as well:
-
-    describe xinetd_conf.services('telnet') do
-      it { should be_disabled }
-      its('socket_type') { should include 'stream' }
-      its('wait') { should eq 'no' }
-    end

data/docs/resources/xml.md.erb

@@ -0,0 +1,61 @@
+---
+title: About the xml Resource
+---
+
+# xml
+
+Use the `xml` InSpec audit resource to test data in an XML file.
+
+<br>
+
+## Syntax
+
+An `xml` resource block declares the data to be tested. Assume the following XML file:
+
+    <root>
+      <name>hello</name>
+      <meta>
+        <creator>John Doe</creator>
+      </meta>
+      <array>
+        <element>one</element>
+        <element>two</element>
+      </array>
+    </root>
+
+This file can be queried using:
+
+    describe xml('/path/to/name.xml') do
+      its('root/name') { should eq ['hello'] }
+      its('root/meta/creator') { should eq ['John Doe'] }
+      its('root/array[2]/element]) { should eq ['two'] }
+    end
+
+where
+
+* `root/name` is an XPath expression
+* `should eq ['foo']` tests a value of `root/name` as read from an XML file versus the value declared in the test
+
+<br>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test an AppPool's presence in an applicationHost.config file
+
+    describe xml('applicationHost.config') do
+      its('configuration/system.applicationHost/applicationPools/add@name') { should contain('my_pool') }
+    end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### name
+
+The `name` matcher tests the value of `name` as read from a JSON file versus the value declared in the test:
+
+    its('name') { should eq 'foo' }

data/docs/resources/yaml.md.erb

@@ -6,6 +6,8 @@ title: About the yaml Resource
 
 Use the `yaml` InSpec audit resource to test configuration data in a Yaml file.
 
+<br>
+
 ## Syntax
 
 A `yaml` resource block declares the configuration data to be tested. Assume the following Yaml file:
@@ -41,43 +43,26 @@ Like the `json` resource, the `yaml` resource can read a file, run a command, or
       its('key2') { should cmp 'value2' }
     end
 
+<br>
 
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
+## Examples
 
-### eq
+The following examples show how to use this InSpec audit resource.
 
-<%= partial "/shared/matcher_eq" %>
+### Test a kitchen.yml file driver
 
-### include
+    describe yaml('.kitchen.yaml') do
+      its('driver.name') { should eq('vagrant') }
+    end
 
-<%= partial "/shared/matcher_include" %>
+<br>
 
-### match
+## Matchers
 
-<%= partial "/shared/matcher_match" %>
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
 ### name
 
 The `name` matcher tests the value of `name` as read from a Yaml file versus the value declared in the test:
 
     its('name') { should eq 'foo' }
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test a kitchen.yml file driver
-
-    describe yaml('.kitchen.yaml') do
-      its('driver.name') { should eq('vagrant') }
-    end

data/docs/resources/yum.md.erb

@@ -6,6 +6,8 @@ title: About the yum Resource
 
 Use the `yum` InSpec audit resource to test packages in the Yum repository.
 
+<br>
+
 ## Syntax
 
 A `yum` resource block declares a package repo, tests if the package repository is present, and if it that package repository is a valid package source (i.e. "is enabled"):
@@ -19,41 +21,58 @@ where
 
 * `repo('name')` is the (optional) name of a package repo, using either a full identifier (`'updates/7/x86_64'`) or a short identifier (`'updates'`)
 
-## Matchers
+<br>
 
-This InSpec audit resource has the following matchers:
+## Examples
 
-### be
+The following examples show how to use this InSpec audit resource.
 
-<%= partial "/shared/matcher_be" %>
+### Test if the yum repo exists
 
-### be_enabled
+    describe yum do
+      its('repos') { should exist }
+    end
 
-The `be_enabled` matcher tests if the package repository is a valid package source:
+### Test if the 'base/7/x86_64' repo exists and is enabled
 
-    it { should be_enabled }
+    describe yum do
+      its('repos') { should include 'base/7/x86_64' }
+      its('epel') { should exist }
+      its('epel') { should be_enabled }
+    end
 
-### cmp
+### Test if a specific yum repo exists
 
-<%= partial "/shared/matcher_cmp" %>
+    describe yum.repo('epel') do
+      it { should exist }
+      it { should be_enabled }
+    end
 
-### eq
+### Test a particular repository configuration, such as its Base URL
 
-<%= partial "/shared/matcher_eq" %>
+    describe yum.repo('mycompany-artifacts') do
+      it { should exist }
+      it { should be_enabled }
+      its('baseurl') { should include 'mycompany.biz' }
+    end
 
-### exist
+<br>
 
-The `exist` matcher tests if the package repository exists:
+## Matchers
 
-    it { should exist }
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
-### include
+### be_enabled
 
-<%= partial "/shared/matcher_include" %>
+The `be_enabled` matcher tests if the package repository is a valid package source:
 
-### match
+    it { should be_enabled }
 
-<%= partial "/shared/matcher_match" %>
+### exist
+
+The `exist` matcher tests if the package repository exists:
+
+    it { should exist }
 
 ### repo('name')
 
@@ -76,36 +95,3 @@ The `shortname` matcher names a specific package repository's group identifier.
     describe yum.repo('Directory Server') do
       its('shortname') { should eq 'directory-server' }
     end
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test if the yum repo exists
-
-    describe yum do
-      its('repos') { should exist }
-    end
-
-### Test if the 'base/7/x86_64' repo exists and is enabled
-
-    describe yum do
-      its('repos') { should include 'base/7/x86_64' }
-      its('epel') { should exist }
-      its('epel') { should be_enabled }
-    end
-
-### Test if a specific yum repo exists
-
-    describe yum.repo('epel') do
-      it { should exist }
-      it { should be_enabled }
-    end
-
-### Test a particular repository configuration, such as its Base URL
-
-    describe yum.repo('mycompany-artifacts') do
-      it { should exist }
-      it { should be_enabled }
-      its('baseurl') { should include 'mycompany.biz' }
-    end

data/docs/resources/zfs_dataset.md.erb

@@ -6,6 +6,8 @@ title: About the zfs_dataset Resource
 
 Use the `zfs_dataset` InSpec audit resource to test the ZFS datasets on FreeBSD systems.
 
+<br>
+
 ## Syntax
 
 A `zfs_dataset` resource block declares the ZFS dataset properties that should be tested:
@@ -20,32 +22,7 @@ where
 * `MATCHER` is a valid matcher for this resource
 * `'value'` is the value to be tested
 
-
-## Matchers
-
-This InSpec audit resource has the matchers listed below, in addition to dynamically exposing all ZFS dataset properties available (see: `man zfs` for the list of supported properties.)
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### be_mounted
-
-The `be_mounted` matcher tests if the dataset is accessible from the file system:
-
-    it { should be_mounted }
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
+<br>
 
 ## Examples
 
@@ -61,3 +38,15 @@ The following examples show how to use this InSpec audit resource.
       its('readonly') { should eq  'off' }
       its('setuid') { should eq  'off' }
     end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the matchers listed below, in addition to dynamically exposing all ZFS dataset properties available (see: `man zfs` for the list of supported properties). For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### be_mounted
+
+The `be_mounted` matcher tests if the dataset is accessible from the file system:
+
+    it { should be_mounted }

data/docs/resources/zfs_pool.md.erb

@@ -6,6 +6,8 @@ title: About the zfs_pool Resource
 
 Use the `zfs_pool` InSpec audit resource to test the ZFS pools on FreeBSD systems.
 
+<br>
+
 ## Syntax
 
 A `zfs_pool` resource block declares the ZFS pool properties that should be tested:
@@ -20,26 +22,7 @@ where
 * `MATCHER` is a valid matcher for this resource
 * `'value'` is the value to be tested
 
-
-## Matchers
-
-This InSpec audit resource has the matchers listed below, in addition to dynamically exposing all ZFS pool properties available (see: `man zpool` for the list of supported properties.)
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
+<br>
 
 ## Examples
 
@@ -55,3 +38,9 @@ The following examples show how to use this InSpec audit resource.
       its('listsnapshots') { should eq  'off' }
       its('readonly') { should eq  'off' }
     end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource dynamically exposes all ZFS pool properties available (see: `man zpool` for the list of supported properties). For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).

data/docs/ruby_usage.md

@@ -114,7 +114,6 @@ methods available, etc. For the above example:
 [3] pry> ls perl_out
 Inspec::Plugins::Resource#methods: inspect
 Inspec::Resources::Cmd#methods: command  exist?  exit_status  result  stderr  stdout  to_s
-Inspec::Plugins::ResourceCommon#methods: resource_skipped  skip_resource
 Inspec::Resource::Registry::Command#methods: inspec
 instance variables: @__backend_runner__  @__resource_name__  @command  @result
 [4] pry> perl_out.stdout.partition('@INC:').last.strip.split("\n")

data/examples/meta-profile/README.md

@@ -23,7 +23,7 @@ depends:
     compliance: base/linux
 ```
 
-You could use those dependencies in your `exmaple.rb`:
+You could use those dependencies in your `example.rb`:
 
 ```
 

data/examples/profile-sensitive/README.md

@@ -0,0 +1,29 @@
+# Example InSpec Profile with Sensitive failures
+
+This profile demostrates resources flagged as sensitive
+
+## Usage
+
+```
+$ inspec exec examples/profile-sensitive
+....
+
+  bob should
+   ∅  eq "billy"
+
+   expected: "billy"
+        got: "bob"
+
+   (compared using ==)
+
+  sensitivepassword should
+     ∅  eq "secret"
+     *** sensitive output suppressed ***
+  bob should
+     ✔  eq "bob"
+  sensitivepassword should
+     ✔  eq "sensitivepassword"
+
+Test Summary: 2 successful, 2 failures, 0 skipped
+
+```

data/examples/profile-sensitive/controls/sensitive-failures.rb

@@ -0,0 +1,9 @@
+# encoding: utf-8
+
+describe 'bob' do
+  it { should eq 'billy' }
+end
+
+describe 'sensitivepassword', :sensitive do
+  it { should eq 'secret' }
+end

data/examples/profile-sensitive/controls/sensitive.rb

@@ -0,0 +1,9 @@
+# encoding: utf-8
+
+describe 'bob' do
+  it { should eq 'bob' }
+end
+
+describe 'sensitivepassword', :sensitive do
+  it { should eq 'sensitivepassword' }
+end

data/examples/profile-sensitive/inspec.yml

@@ -0,0 +1,8 @@
+name: profile-sensitive
+title: InSpec Sensitive Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile
+version: 0.1.0