inspec 1.31.0 → 1.45.9

data/lib/inspec/runner.rb

@@ -124,11 +124,13 @@ module Inspec
       return options[:attributes] if secrets_targets.nil?
 
       secrets_targets.each do |target|
+        validate_attributes_file_readability!(target)
+
         secrets = Inspec::SecretsBackend.resolve(target)
         if secrets.nil?
           raise Inspec::Exceptions::SecretsBackendNotFound,
-                "Unable to find a parser for attributes file #{target}. " \
-                'Check to make sure the file exists and has the appropriate extension.'
+                "Cannot find parser for attributes file '#{target}'. " \
+                'Check to make sure file has the appropriate extension.'
         end
 
         next if secrets.attributes.nil?
@@ -229,35 +231,18 @@ module Inspec
     def get_check_example(method_name, arg, block)
       opts = block_source_info(block)
 
-      if !arg.empty? &&
-         arg[0].respond_to?(:resource_skipped) &&
-         !arg[0].resource_skipped.nil?
-        return @test_collector.example_group(*arg, opts) do
-          it arg[0].resource_skipped
-        end
-      else
-        # add the resource
-        case method_name
-        when 'describe'
-          return @test_collector.example_group(*arg, opts, &block)
-        when 'expect'
-          return block.example_group
-        when 'describe.one'
-          tests = arg.map do |x|
-            @test_collector.example_group(x[1][0], block_source_info(x[2]), &x[2])
-          end
-          return nil if tests.empty?
-          ok_tests = tests.find_all(&:run)
-          # return all tests if none succeeds; we will just report full failure
-          return tests if ok_tests.empty?
-          # otherwise return all working tests
-          return ok_tests
-        else
-          raise "A rule was registered with #{method_name.inspect}, "\
-               "which isn't understood and cannot be processed."
-        end
+      return nil if arg.empty?
+
+      if arg[0].respond_to?(:resource_skipped?) && arg[0].resource_skipped?
+        return rspec_skipped_block(arg, opts, arg[0].resource_exception_message)
+      end
+
+      if arg[0].respond_to?(:resource_failed?) && arg[0].resource_failed?
+        return rspec_failed_block(arg, opts, arg[0].resource_exception_message)
       end
-      nil
+
+      # If neither skipped nor failed then add the resource
+      add_resource(method_name, arg, opts, block)
     end
 
     def register_rule(rule)
@@ -270,5 +255,62 @@ module Inspec
 
       examples.each { |e| @test_collector.add_test(e, rule) }
     end
+
+    def validate_attributes_file_readability!(target)
+      unless File.exist?(target)
+        raise Inspec::Exceptions::AttributesFileDoesNotExist,
+              "Cannot find attributes file '#{target}'. " \
+              'Check to make sure file exists.'
+      end
+
+      unless File.readable?(target)
+        raise Inspec::Exceptions::AttributesFileNotReadable,
+              "Cannot read attributes file '#{target}'. " \
+              'Check to make sure file is readable.'
+      end
+
+      true
+    end
+
+    def rspec_skipped_block(arg, opts, message)
+      @test_collector.example_group(*arg, opts) do
+        # Send custom `it` block to RSpec
+        it message
+      end
+    end
+
+    def rspec_failed_block(arg, opts, message)
+      @test_collector.example_group(*arg, opts) do
+        # Send custom `it` block to RSpec
+        it '' do
+          # Raising here to fail the test and get proper formatting
+          raise Inspec::Exceptions::ResourceFailed, message
+        end
+      end
+    end
+
+    def add_resource(method_name, arg, opts, block)
+      case method_name
+      when 'describe'
+        @test_collector.example_group(*arg, opts, &block)
+      when 'expect'
+        block.example_group
+      when 'describe.one'
+        tests = arg.map do |x|
+          @test_collector.example_group(x[1][0], block_source_info(x[2]), &x[2])
+        end
+        return nil if tests.empty?
+
+        successful_tests = tests.find_all(&:run)
+
+        # Return all tests if none succeeds; we will just report full failure
+        return tests if successful_tests.empty?
+
+        successful_tests
+      else
+        raise "A rule was registered with #{method_name.inspect}," \
+              "which isn't understood and cannot be processed."
+      end
+    end
   end
 end

data/lib/inspec/shell.rb

@@ -26,8 +26,13 @@ module Inspec
     end
 
     def configure_pry # rubocop:disable Metrics/AbcSize
-      # Remove all hooks and checks
-      Pry.hooks.clear_all
+      # Delete any before_session, before_eval, and after_eval hooks so we can
+      # replace them with our own. Pry 0.10 used to have a single method to clear
+      # all hooks, but this was removed in Pry 0.11.
+      [:before_session, :before_eval, :after_eval].each do |event|
+        Pry.hooks.get_hooks(event).keys.map { |hook| Pry.hooks.delete_hook(event, hook) }
+      end
+
       that = self
 
       # Add the help command
@@ -37,7 +42,7 @@ module Inspec
 
       # configure pry shell prompt
       Pry.config.prompt_name = 'inspec'
-      Pry.prompt = [proc { "#{readline_ignore("\e[0;32m")}#{Pry.config.prompt_name}> #{readline_ignore("\e[0m")}" }]
+      Pry.prompt = [proc { "#{readline_ignore("\e[1m\e[32m")}#{Pry.config.prompt_name}> #{readline_ignore("\e[0m")}" }]
 
       # Add a help menu as the default intro
       Pry.hooks.add_hook(:before_session, 'inspec_intro') do
@@ -74,7 +79,7 @@ module Inspec
     end
 
     def mark(x)
-      "#{readline_ignore("\033[1m")}#{x}#{readline_ignore("\033[0m")}"
+      "\e[1m\e[39m#{x}\e[0m"
     end
 
     def print_example(example)
@@ -101,8 +106,8 @@ module Inspec
       puts <<EOF
 You are currently running on:
 
-    OS platform:  #{mark ctx.os[:name] || 'unknown'}
-    OS family:  #{mark ctx.os[:family] || 'unknown'}
+    OS platform: #{mark ctx.os[:name] || 'unknown'}
+    OS family: #{mark ctx.os[:family] || 'unknown'}
     OS release: #{mark ctx.os[:release] || 'unknown'}
 EOF
     end
@@ -134,21 +139,21 @@ EOF
       elsif topic == 'matchers'
         print_matchers_help
       elsif !Inspec::Resource.registry[topic].nil?
-        puts <<EOF
-#{mark 'Name:'} #{topic}
-
-#{mark 'Description:'}
-
-#{Inspec::Resource.registry[topic].desc}
-
-#{mark 'Example:'}
-#{print_example(Inspec::Resource.registry[topic].example)}
-
-#{mark 'Web Reference:'}
+        topic_info = Inspec::Resource.registry[topic]
+        info = "#{mark 'Name:'} #{topic}\n\n"
+        unless topic_info.desc.nil?
+          info += "#{mark 'Description:'}\n\n"
+          info += "#{topic_info.desc}\n\n"
+        end
 
-https://www.inspec.io/docs/reference/resources/#{topic}
+        unless topic_info.example.nil?
+          info += "#{mark 'Example:'}\n"
+          info += "#{print_example(topic_info.example)}\n\n"
+        end
 
-EOF
+        info += "#{mark 'Web Reference:'}\n\n"
+        info += "https://www.inspec.io/docs/reference/resources/#{topic}\n\n"
+        puts info
       else
         puts "The resource #{topic} does not exist. For a list of valid resources, type: help resources"
       end

data/lib/inspec/version.rb

@@ -4,5 +4,5 @@
 # author: Christoph Hartmann
 
 module Inspec
-  VERSION = '1.31.0'.freeze
+  VERSION = '1.45.9'
 end

data/lib/matchers/matchers.rb

@@ -222,6 +222,44 @@ RSpec::Matchers.define :contain do |rule|
   end
 end
 
+# `be_in` matcher
+# You can use it in the following cases:
+# - check if an item or array is included in a given array
+# eg:
+# describe nginx do
+#   its('user') { should be_in AUTHORIZED_USER_LIST }
+# end
+# describe nginx do
+#   its('module_list') { should be_in AUTHORIZED_MODULE_LIST }
+# end
+RSpec::Matchers.define :be_in do |list|
+  match do |item|
+    # Handle both single item and array
+    item.is_a?(Array) ? (item - list).empty? : list.include?(item)
+  end
+
+  match_when_negated do |item|
+    # Handle both single item and array
+    item.is_a?(Array) ? (item & list).empty? : !list.include?(item)
+  end
+
+  failure_message do |item|
+    if item.is_a?(Array)
+      "expected `#{item}` to be in the list: `#{list}` \nDiff:\n #{(item - list)}"
+    else
+      "expected `#{item}` to be in the list: `#{list}`"
+    end
+  end
+
+  failure_message_when_negated do |item|
+    if item.is_a?(Array)
+      "expected `#{item}` not to be in the list: `#{list}` \nComm:\n #{(item & list)}"
+    else
+      "expected `#{item}` not to be in the list: `#{list}`"
+    end
+  end
+end
+
 # This matcher implements a compare feature that cannot be covered by the default
 # `eq` matcher
 # You can use it in the following cases:
@@ -278,6 +316,8 @@ RSpec::Matchers.define :cmp do |first_expected|
       return actual.to_i.method(op).call(expected)
     elsif expected.is_a?(Float) && float?(actual)
       return actual.to_f.method(op).call(expected)
+    elsif actual.is_a?(Symbol) && expected.is_a?(String)
+      return actual.to_s.method(op).call(expected)
     elsif octal?(expected) && actual.is_a?(Integer)
       return actual.method(op).call(expected.to_i(8))
     end

data/lib/resources/aide_conf.rb

@@ -0,0 +1,162 @@
+# encoding: utf-8
+# author: Jen Burns, burnsjennifere@gmail.com
+
+require 'utils/filter'
+require 'utils/parser'
+
+# rubocop:disable Metrics/ClassLength
+module Inspec::Resources
+  class AideConf < Inspec.resource(1)
+    name 'aide_conf'
+    desc 'Use the aide_conf InSpec audit resource to test the rules established for
+      the file integrity tool AIDE. Controlled by the aide.conf file typically at /etc/aide.conf.'
+    example "
+      describe aide_conf do
+        its('selection_lines') { should include '/sbin' }
+      end
+
+      describe aide_conf.where { selection_line == '/bin' } do
+        its('rules.flatten') { should include 'r' }
+      end
+
+      describe aide_conf.all_have_rule('sha512') do
+        it { should eq true }
+      end
+    "
+
+    attr_reader :params
+
+    include CommentParser
+
+    def initialize(aide_conf_path = nil)
+      return skip_resource 'The `aide_conf` resource is not supported on your OS.' unless inspec.os.linux?
+      @conf_path = aide_conf_path || '/etc/aide.conf'
+      @content = nil
+      @rules = nil
+      read_content
+    end
+
+    def all_have_rule(rule)
+      # Case when file didn't exist or perms didn't allow an open
+      return false if @content.nil?
+
+      lines = @params.reject { |line| line['rules'].include? rule }
+      lines.empty?
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:selection_lines, field: 'selection_line')
+          .add(:rules,           field: 'rules')
+
+    filter.connect(self, :params)
+
+    private
+
+    def read_content
+      return @content unless @content.nil?
+      @rules = {}
+
+      file = inspec.file(@conf_path)
+      if !file.file?
+        return skip_resource "Can't find file \"#{@conf_path}\""
+      end
+      raw_conf = file.content
+      if raw_conf.nil?
+        return skip_resource "File can't be opened or is empty \"#{@conf_path}\""
+      end
+      if raw_conf.empty? && !file.empty?
+        return skip_resource "Can't read file \"#{@conf_path}\""
+      end
+
+      # If there is a file and it contains content, continue
+      @content = filter_comments(inspec.file(@conf_path).content.lines)
+      @params = parse_conf(@content)
+    end
+
+    def filter_comments(data)
+      content = []
+      data.each do |line|
+        content_line, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
+        content.push(content_line)
+      end
+      content
+    end
+
+    def parse_conf(content)
+      params = []
+      content.each do |line|
+        param = parse_line(line)
+        if !param['selection_line'].nil?
+          params.push(param)
+        end
+      end
+      params
+    end
+
+    def parse_line(line)
+      line_and_rules = {}
+      # Case when line is a rule line
+      if line.include?(' = ')
+        parse_rule_line(line)
+      # Case when line is a selection line
+      elsif line.start_with?('/', '!', '=')
+        line_and_rules = parse_selection_line(line)
+      end
+      line_and_rules
+    end
+
+    def parse_rule_line(line)
+      line.gsub!(/\s+/, '')
+      rule_line_arr = line.split('=')
+      rules_list = rule_line_arr.last.split('+')
+      rule_name = rule_line_arr.first
+      rules_list.each_index do |i|
+        # Cases where rule respresents one or more other rules
+        if @rules.key?(rules_list[i])
+          rules_list[i] = @rules[rules_list[i]]
+        end
+        rules_list[i] = handle_multi_rule(rules_list, i)
+      end
+      @rules[rule_name] = rules_list.flatten
+    end
+
+    def parse_selection_line(line)
+      selec_line_arr = line.split(' ')
+      selection_line = selec_line_arr.first
+      selection_line.chop! if selection_line.end_with?('/')
+      rule_list = selec_line_arr.last.split('+')
+      rule_list.each_index do |i|
+        hash_list = @rules[rule_list[i]]
+        # Cases where rule respresents one or more other rules
+        if !hash_list.nil?
+          rule_list[i] = hash_list
+        end
+        rule_list[i] = handle_multi_rule(rule_list, i)
+      end
+      rule_list.flatten!
+      {
+        'selection_line' => selection_line,
+        'rules' => rule_list,
+      }
+    end
+
+    def handle_multi_rule(rule_list, i)
+      # Rules that represent multiple rules (R,L,>)
+      r_rules = %w{p i l n u g s m c md5}
+      l_rules = %w{p i l n u g}
+      grow_log_rules = %w{p l u g i n S}
+
+      case rule_list[i]
+      when 'R'
+        return r_rules
+      when 'L'
+        return l_rules
+      when '>'
+        return grow_log_rules
+      end
+      rule_list[i]
+    end
+  end
+end

data/lib/resources/auditd.rb

@@ -0,0 +1,231 @@
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+# author: Jen Burns
+
+require 'forwardable'
+require 'utils/filter_array'
+require 'utils/filter'
+require 'utils/parser'
+
+module Inspec::Resources
+  # rubocop:disable Metrics/ClassLength
+  class AuditDaemon < Inspec.resource(1)
+    extend Forwardable
+    attr_accessor :lines
+    attr_reader :params
+
+    name 'auditd'
+    desc 'Use the auditd InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files. These rules are output using the auditcl -l command.'
+    example "
+      describe auditd.syscall('chown').where {arch == 'b32'} do
+        its('action') { should eq ['always'] }
+        its('list') { should eq ['exit'] }
+      end
+
+      describe auditd.where {key == 'privileged'} do
+        its('permissions') { should include ['x'] }
+      end
+
+      describe auditd do
+        its('lines') { should include %r(-w /etc/ssh/sshd_config) }
+      end
+    "
+
+    def initialize
+      @content = inspec.command('/sbin/auditctl -l').stdout.chomp
+      @params = []
+
+      if @content =~ /^LIST_RULES:/
+        return skip_resource 'The version of audit is outdated. The `auditd` resource supports versions of audit >= 2.3.'
+      end
+      parse_content
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:file,         field: 'file')
+          .add(:list,         field: 'list')
+          .add(:action,       field: 'action')
+          .add(:fields,       field: 'fields')
+          .add(:fields_nokey, field: 'fields_nokey')
+          .add(:syscall,      field: 'syscall')
+          .add(:key,          field: 'key')
+          .add(:arch,         field: 'arch')
+          .add(:path,         field: 'path')
+          .add(:permissions,  field: 'permissions')
+          .add(:exit,         field: 'exit')
+
+    filter.connect(self, :params)
+
+    def status(name = nil)
+      @status_content ||= inspec.command('/sbin/auditctl -s').stdout.chomp
+      @status_params ||= Hash[@status_content.scan(/^([^ ]+) (.*)$/)]
+
+      return @status_params[name] if name
+      @status_params
+    end
+
+    def parse_content
+      @lines = @content.lines.map(&:chomp)
+
+      lines.each do |line|
+        if is_file_syscall_syntax?(line)
+          file_syscall_syntax_rules_for(line)
+        end
+
+        if is_syscall?(line)
+          syscall_rules_for(line)
+
+        elsif is_file?(line)
+          file_rules_for(line)
+        end
+      end
+    end
+
+    def file_syscall_syntax_rules_for(line)
+      file = file_syscall_syntax_for(line)
+      action, list = action_list_for(line)
+      fields = rule_fields_for(line)
+      key_field, fields_nokey = remove_key_from(fields)
+      key = key_in(key_field.join(''))
+      perms = perms_in(fields)
+
+      @params.push(
+        {
+          'file' => file,
+          'list' => list,
+          'action' => action,
+          'fields' => fields,
+          'permissions' => perms,
+          'key' => key,
+          'fields_nokey' => fields_nokey,
+        },)
+    end
+
+    def syscall_rules_for(line)
+      syscalls = syscalls_for(line)
+      action, list = action_list_for(line)
+      fields = rule_fields_for(line)
+      key_field, fields_nokey = remove_key_from(fields)
+      key = key_in(key_field.join(''))
+      arch = arch_in(fields)
+      path = path_in(fields)
+      perms = perms_in(fields)
+      exit_field = exit_in(fields)
+
+      syscalls.each do |s|
+        @params.push(
+          {
+            'syscall' => s,
+            'list' => list,
+            'action' => action,
+            'fields' => fields,
+            'key' => key,
+            'arch' => arch,
+            'path' => path,
+            'permissions' => perms,
+            'exit' => exit_field,
+            'fields_nokey' => fields_nokey,
+          },)
+      end
+    end
+
+    def file_rules_for(line)
+      file = file_for(line)
+      perms = permissions_for(line)
+      key = key_for(line)
+
+      @params.push(
+        {
+          'file' => file,
+          'key' => key,
+          'permissions' => perms,
+        },)
+    end
+
+    def to_s
+      'Auditd Rules'
+    end
+
+    private
+
+    def is_syscall?(line)
+      line.match(/-S /)
+    end
+
+    def is_file?(line)
+      line.match(/-w /)
+    end
+
+    def is_file_syscall_syntax?(line)
+      line.match(/-F path=/)
+    end
+
+    def syscalls_for(line)
+      line.scan(/-S ([^ ]+)\s?/).flatten.first.split(',')
+    end
+
+    def action_list_for(line)
+      line.scan(/-a ([^,]+),([^ ]+)\s?/).flatten
+    end
+
+    def key_for(line)
+      line.match(/-k ([^ ]+)\s?/)[1] if line.include?('-k ')
+    end
+
+    def file_for(line)
+      line.match(/-w ([^ ]+)\s?/)[1]
+    end
+
+    def file_syscall_syntax_for(line)
+      line.match(/-F path=(\S+)\s?/)[1]
+    end
+
+    def permissions_for(line)
+      line.match(/-p ([^ ]+)/)[1].scan(/\w/)
+    end
+
+    def rule_fields_for(line)
+      line.gsub(/-[aS] [^ ]+ /, '').split('-F ').map { |l| l.split(' ') }.flatten
+    end
+
+    def arch_in(fields)
+      fields.each do |field|
+        return field.match(/arch=(\S+)\s?/)[1] if field.start_with?('arch=')
+      end
+      nil
+    end
+
+    def perms_in(fields)
+      fields.each do |field|
+        return field.match(/perm=(\S+)\s?/)[1].scan(/\w/) if field.start_with?('perm=')
+      end
+      nil
+    end
+
+    def path_in(fields)
+      fields.each do |field|
+        return field.match(/path=(\S+)\s?/)[1] if field.start_with?('path=')
+      end
+      nil
+    end
+
+    def exit_in(fields)
+      fields.each do |field|
+        return field.match(/exit=(\S+)\s?/)[1] if field.start_with?('exit=')
+      end
+      nil
+    end
+
+    def key_in(field)
+      _, v = field.split('=')
+      v
+    end
+
+    def remove_key_from(fields)
+      fields.partition { |x| x.start_with? 'key' }
+    end
+  end
+end

data/lib/resources/auditd_rules.rb

@@ -87,6 +87,8 @@ module Inspec::Resources
         parse_content
         @legacy = nil
       end
+
+      warn '[DEPRECATION] The `auditd_rules` resource is deprecated and will be removed in InSpec 2.0. Use the `auditd` resource instead.'
     end
 
     # non-legacy instances are not asked for `its('LIST_RULES')`
@@ -177,7 +179,7 @@ module Inspec::Resources
 
     # NB only in file lines
     def get_key(line)
-      line.match(/-k ([^ ]+)/)[1]
+      line.match(/-k ([^ ]+)/)[1] if line.include?('-k ')
     end
 
     # NOTE there are NO precautions wrt. filenames containing spaces in auditctl

data/lib/resources/command.rb

@@ -47,7 +47,7 @@ module Inspec::Resources
 
     def exist?
       # silent for mock resources
-      return false if inspec.os[:name].to_s == 'unknown'
+      return false if inspec.os.name.nil?
 
       if inspec.os.linux?
         res = inspec.backend.run_command("bash -c 'type \"#{@command}\"'")