inspec 1.31.0 → 1.45.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (194) hide show
  1. checksums.yaml +4 -4
  2. data/.rubocop.yml +3 -0
  3. data/CHANGELOG.md +2599 -1
  4. data/Gemfile +0 -1
  5. data/README.md +24 -34
  6. data/Rakefile +0 -31
  7. data/docs/dsl_inspec.md +10 -0
  8. data/docs/matchers.md +29 -0
  9. data/docs/plugin_kitchen_inspec.md +18 -24
  10. data/docs/profiles.md +101 -81
  11. data/docs/resources/aide_conf.md.erb +71 -0
  12. data/docs/resources/apache_conf.md.erb +19 -33
  13. data/docs/resources/apt.md.erb +22 -36
  14. data/docs/resources/audit_policy.md.erb +9 -24
  15. data/docs/resources/auditd.md.erb +78 -0
  16. data/docs/resources/auditd_conf.md.erb +20 -34
  17. data/docs/resources/auditd_rules.md.erb +8 -24
  18. data/docs/resources/bash.md.erb +4 -26
  19. data/docs/resources/bond.md.erb +25 -40
  20. data/docs/resources/bridge.md.erb +5 -25
  21. data/docs/resources/bsd_service.md.erb +5 -25
  22. data/docs/resources/command.md.erb +35 -50
  23. data/docs/resources/cpan.md.erb +62 -0
  24. data/docs/resources/cran.md.erb +54 -0
  25. data/docs/resources/crontab.md.erb +9 -23
  26. data/docs/resources/csv.md.erb +12 -27
  27. data/docs/resources/dh_params.md +1 -0
  28. data/docs/resources/directory.md.erb +5 -25
  29. data/docs/resources/docker.md.erb +61 -58
  30. data/docs/resources/docker_container.md.erb +23 -19
  31. data/docs/resources/docker_image.md.erb +20 -16
  32. data/docs/resources/elasticsearch.md.erb +245 -0
  33. data/docs/resources/etc_fstab.md.erb +120 -0
  34. data/docs/resources/etc_group.md.erb +29 -45
  35. data/docs/resources/etc_hosts.md.erb +68 -0
  36. data/docs/resources/etc_hosts_allow.md.erb +68 -0
  37. data/docs/resources/etc_hosts_deny.md.erb +68 -0
  38. data/docs/resources/file.md.erb +227 -216
  39. data/docs/resources/firewalld.md.erb +104 -0
  40. data/docs/resources/gem.md.erb +21 -35
  41. data/docs/resources/group.md.erb +16 -30
  42. data/docs/resources/grub_conf.md.erb +9 -24
  43. data/docs/resources/host.md.erb +32 -49
  44. data/docs/resources/http.md.erb +38 -44
  45. data/docs/resources/iis_app.md.erb +25 -35
  46. data/docs/resources/iis_site.md.erb +26 -40
  47. data/docs/resources/inetd_conf.md.erb +27 -42
  48. data/docs/resources/ini.md.erb +9 -23
  49. data/docs/resources/interface.md.erb +5 -25
  50. data/docs/resources/iptables.md.erb +15 -29
  51. data/docs/resources/json.md.erb +12 -27
  52. data/docs/resources/kernel_module.md.erb +47 -61
  53. data/docs/resources/kernel_parameter.md.erb +15 -29
  54. data/docs/resources/key_rsa.md.erb +3 -0
  55. data/docs/resources/launchd_service.md.erb +5 -25
  56. data/docs/resources/limits_conf.md.erb +15 -29
  57. data/docs/resources/login_def.md.erb +15 -30
  58. data/docs/resources/mount.md.erb +18 -33
  59. data/docs/resources/mssql_session.md.erb +9 -12
  60. data/docs/resources/mysql_conf.md.erb +28 -32
  61. data/docs/resources/mysql_session.md.erb +15 -29
  62. data/docs/resources/nginx.md.erb +78 -0
  63. data/docs/resources/nginx_conf.md.erb +127 -0
  64. data/docs/resources/npm.md.erb +19 -35
  65. data/docs/resources/ntp_conf.md.erb +20 -37
  66. data/docs/resources/oneget.md.erb +15 -30
  67. data/docs/resources/oracledb_session.md.erb +9 -11
  68. data/docs/resources/os.md.erb +29 -43
  69. data/docs/resources/os_env.md.erb +23 -44
  70. data/docs/resources/package.md.erb +34 -36
  71. data/docs/resources/parse_config.md.erb +5 -25
  72. data/docs/resources/parse_config_file.md.erb +31 -43
  73. data/docs/resources/{etc_passwd.md.erb → passwd.md.erb} +24 -39
  74. data/docs/resources/pip.md.erb +20 -35
  75. data/docs/resources/port.md.erb +43 -57
  76. data/docs/resources/postgres_conf.md.erb +17 -31
  77. data/docs/resources/postgres_hba_conf.md.erb +26 -38
  78. data/docs/resources/postgres_ident_conf.md.erb +25 -37
  79. data/docs/resources/postgres_session.md.erb +15 -29
  80. data/docs/resources/powershell.md.erb +27 -42
  81. data/docs/resources/processes.md.erb +17 -33
  82. data/docs/resources/rabbitmq_config.md.erb +9 -24
  83. data/docs/resources/registry_key.md.erb +27 -42
  84. data/docs/resources/runit_service.md.erb +5 -25
  85. data/docs/resources/security_policy.md.erb +12 -27
  86. data/docs/resources/service.md.erb +27 -42
  87. data/docs/resources/{etc_shadow.md.erb → shadow.md.erb} +41 -47
  88. data/docs/resources/ssh_config.md.erb +19 -34
  89. data/docs/resources/sshd_config.md.erb +19 -34
  90. data/docs/resources/ssl.md.erb +39 -54
  91. data/docs/resources/sys_info.md.erb +12 -26
  92. data/docs/resources/systemd_service.md.erb +5 -25
  93. data/docs/resources/sysv_service.md.erb +5 -25
  94. data/docs/resources/upstart_service.md.erb +5 -25
  95. data/docs/resources/user.md.erb +29 -44
  96. data/docs/resources/users.md.erb +12 -26
  97. data/docs/resources/vbscript.md.erb +9 -24
  98. data/docs/resources/virtualization.md.erb +8 -23
  99. data/docs/resources/windows_feature.md.erb +15 -30
  100. data/docs/resources/windows_hotfix.md.erb +50 -0
  101. data/docs/resources/windows_task.md.erb +12 -26
  102. data/docs/resources/wmi.md.erb +9 -24
  103. data/docs/resources/x509_certificate.md.erb +4 -0
  104. data/docs/resources/xinetd_conf.md.erb +65 -80
  105. data/docs/resources/xml.md.erb +61 -0
  106. data/docs/resources/yaml.md.erb +12 -27
  107. data/docs/resources/yum.md.erb +37 -51
  108. data/docs/resources/zfs_dataset.md.erb +15 -26
  109. data/docs/resources/zfs_pool.md.erb +9 -20
  110. data/docs/ruby_usage.md +0 -1
  111. data/examples/meta-profile/README.md +1 -1
  112. data/examples/profile-sensitive/README.md +29 -0
  113. data/examples/profile-sensitive/controls/sensitive-failures.rb +9 -0
  114. data/examples/profile-sensitive/controls/sensitive.rb +9 -0
  115. data/examples/profile-sensitive/inspec.yml +8 -0
  116. data/inspec.gemspec +3 -3
  117. data/lib/bundles/inspec-artifact/cli.rb +5 -5
  118. data/lib/bundles/inspec-compliance/README.md +24 -22
  119. data/lib/bundles/inspec-compliance/api/login.rb +152 -0
  120. data/lib/bundles/inspec-compliance/api.rb +46 -16
  121. data/lib/bundles/inspec-compliance/cli.rb +58 -165
  122. data/lib/bundles/inspec-compliance/target.rb +2 -3
  123. data/lib/bundles/inspec-habitat/cli.rb +7 -2
  124. data/lib/bundles/inspec-habitat/profile.rb +44 -20
  125. data/lib/bundles/inspec-init/templates/profile/README.md +1 -1
  126. data/lib/bundles/inspec-init/templates/profile/controls/example.rb +1 -1
  127. data/lib/bundles/inspec-supermarket/api.rb +1 -1
  128. data/lib/inspec/backend.rb +8 -0
  129. data/lib/inspec/cli.rb +1 -1
  130. data/lib/inspec/control_eval_context.rb +16 -6
  131. data/lib/inspec/dependencies/requirement.rb +22 -8
  132. data/lib/inspec/dependencies/resolver.rb +1 -1
  133. data/lib/inspec/exceptions.rb +4 -0
  134. data/lib/inspec/file_provider.rb +38 -9
  135. data/lib/inspec/metadata.rb +17 -3
  136. data/lib/inspec/objects/attribute.rb +16 -7
  137. data/lib/inspec/objects/control.rb +10 -2
  138. data/lib/inspec/plugins/resource.rb +34 -5
  139. data/lib/inspec/profile.rb +10 -1
  140. data/lib/inspec/profile_context.rb +3 -1
  141. data/lib/inspec/resource.rb +17 -5
  142. data/lib/inspec/rspec_json_formatter.rb +48 -14
  143. data/lib/inspec/rule.rb +4 -0
  144. data/lib/inspec/runner.rb +72 -30
  145. data/lib/inspec/shell.rb +24 -19
  146. data/lib/inspec/version.rb +1 -1
  147. data/lib/matchers/matchers.rb +40 -0
  148. data/lib/resources/aide_conf.rb +162 -0
  149. data/lib/resources/auditd.rb +231 -0
  150. data/lib/resources/auditd_rules.rb +3 -1
  151. data/lib/resources/command.rb +1 -1
  152. data/lib/resources/cpan.rb +60 -0
  153. data/lib/resources/cran.rb +66 -0
  154. data/lib/resources/docker.rb +8 -1
  155. data/lib/resources/docker_container.rb +19 -2
  156. data/lib/resources/elasticsearch.rb +172 -0
  157. data/lib/resources/etc_fstab.rb +102 -0
  158. data/lib/resources/etc_group.rb +1 -1
  159. data/lib/resources/etc_hosts.rb +81 -0
  160. data/lib/resources/etc_hosts_allow_deny.rb +122 -0
  161. data/lib/resources/file.rb +87 -10
  162. data/lib/resources/firewalld.rb +144 -0
  163. data/lib/resources/groups.rb +0 -1
  164. data/lib/resources/host.rb +30 -15
  165. data/lib/resources/http.rb +178 -22
  166. data/lib/resources/mssql_session.rb +3 -3
  167. data/lib/resources/mysql_conf.rb +10 -0
  168. data/lib/resources/mysql_session.rb +1 -1
  169. data/lib/resources/nginx.rb +97 -0
  170. data/lib/resources/nginx_conf.rb +134 -1
  171. data/lib/resources/oracledb_session.rb +9 -8
  172. data/lib/resources/os_env.rb +7 -4
  173. data/lib/resources/package.rb +14 -2
  174. data/lib/resources/packages.rb +1 -1
  175. data/lib/resources/pip.rb +28 -20
  176. data/lib/resources/port.rb +251 -3
  177. data/lib/resources/postgres.rb +1 -1
  178. data/lib/resources/postgres_session.rb +1 -1
  179. data/lib/resources/processes.rb +106 -20
  180. data/lib/resources/registry_key.rb +11 -2
  181. data/lib/resources/service.rb +5 -24
  182. data/lib/resources/ssh_conf.rb +1 -1
  183. data/lib/resources/ssl.rb +4 -3
  184. data/lib/resources/toml.rb +2 -2
  185. data/lib/resources/windows_hotfix.rb +35 -0
  186. data/lib/resources/xinetd.rb +4 -6
  187. data/lib/resources/xml.rb +27 -0
  188. data/lib/source_readers/inspec.rb +3 -3
  189. data/lib/utils/find_files.rb +2 -1
  190. data/lib/utils/nginx_parser.rb +10 -1
  191. data/lib/utils/object_traversal.rb +35 -10
  192. data/lib/utils/parser.rb +21 -3
  193. metadata +48 -18
  194. data/docs/cli.md +0 -392
data/docs/cli.md DELETED
@@ -1,392 +0,0 @@
1
- ---
2
- title: About the InSpec CLI
3
- ---
4
-
5
- # InSpec CLI
6
-
7
- Use the InSpec CLI to run tests and audits against targets using local, SSH, WinRM, or Docker connections.
8
-
9
- ## archive
10
-
11
- Archive a profile to tar.gz (default) or zip
12
-
13
- ### Syntax
14
-
15
- This subcommand has the following syntax:
16
-
17
- ```bash
18
- $ inspec archive PATH
19
- ```
20
-
21
- ### Options
22
-
23
- This subcommand has additional options:
24
-
25
- * ``--ignore-errors``, ``--no-ignore-errors``
26
- Ignore profile warnings.
27
- * ``-o``, ``--output=OUTPUT``
28
- Save the archive to a path
29
- * ``--overwrite``, ``--no-overwrite``
30
- Overwrite existing archive.
31
- * ``--profiles-path=PROFILES_PATH``
32
- Folder which contains referenced profiles.
33
- * ``--tar``, ``--no-tar``
34
- Generates a tar.gz archive.
35
- * ``--zip``, ``--no-zip``
36
- Generates a zip archive.
37
-
38
- ## artifact
39
-
40
- Sign, verify and install artifacts
41
-
42
- ### Syntax
43
-
44
- This subcommand has the following syntax:
45
-
46
- ```bash
47
- $ inspec artifact SUBCOMMAND ...
48
- ```
49
-
50
- ## check
51
-
52
- Verify all tests at the specified path
53
-
54
- ### Syntax
55
-
56
- This subcommand has the following syntax:
57
-
58
- ```bash
59
- $ inspec check PATH
60
- ```
61
-
62
- ### Options
63
-
64
- This subcommand has additional options:
65
-
66
- * ``--format=FORMAT``
67
-
68
- * ``--profiles-path=PROFILES_PATH``
69
- Folder which contains referenced profiles.
70
-
71
- ## compliance
72
-
73
- Chef compliance commands
74
-
75
- ### Syntax
76
-
77
- This subcommand has the following syntax:
78
-
79
- ```bash
80
- $ inspec compliance SUBCOMMAND ...
81
- ```
82
-
83
- ## detect
84
-
85
- Detect the target os
86
-
87
- ### Syntax
88
-
89
- This subcommand has the following syntax:
90
-
91
- ```bash
92
- $ inspec detect
93
- ```
94
-
95
- ### Options
96
-
97
- This subcommand has additional options:
98
-
99
- * ``-b``, ``--backend=BACKEND``
100
- Choose a backend: local, ssh, winrm, docker.
101
- * ``--format=FORMAT``
102
-
103
- * ``--host=HOST``
104
- Specify a remote host which is tested.
105
- * ``--json-config=JSON_CONFIG``
106
- Read configuration from JSON file (`-` reads from stdin).
107
- * ``-i``, ``--key-files=one two three``
108
- Login key or certificate file for a remote scan.
109
- * ``--password=PASSWORD``
110
- Login password for a remote scan, if required.
111
- * ``--path=PATH``
112
- Login path to use when connecting to the target (WinRM).
113
- * ``-p``, ``--port=N``
114
- Specify the login port for a remote scan.
115
- * ``--self-signed``, ``--no-self-signed``
116
- Allow remote scans with self-signed certificates (WinRM).
117
- * ``--shell``, ``--no-shell``
118
- Run scans in a subshell. Only activates on Unix.
119
- * ``--shell-command=SHELL_COMMAND``
120
- Specify a particular shell to use.
121
- * ``--shell-options=SHELL_OPTIONS``
122
- Additional shell options.
123
- * ``--ssl``, ``--no-ssl``
124
- Use SSL for transport layer encryption (WinRM).
125
- * ``--sudo``, ``--no-sudo``
126
- Run scans with sudo. Only activates on Unix and non-root user.
127
- * ``--sudo-command=SUDO_COMMAND``
128
- Alternate command for sudo.
129
- * ``--sudo-options=SUDO_OPTIONS``
130
- Additional sudo options for a remote scan.
131
- * ``--sudo-password=SUDO_PASSWORD``
132
- Specify a sudo password, if it is required.
133
- * ``-t``, ``--target=TARGET``
134
- Simple targeting option using URIs, e.g. ssh://user:pass@host:port
135
- * ``--user=USER``
136
- The login user for a remote scan.
137
-
138
- ## env
139
-
140
- Output shell-appropriate completion configuration
141
-
142
- ### Syntax
143
-
144
- This subcommand has the following syntax:
145
-
146
- ```bash
147
- $ inspec env
148
- ```
149
-
150
- ## exec
151
-
152
- Run all test files at the specified path.
153
-
154
- ### Syntax
155
-
156
- This subcommand has the following syntax:
157
-
158
- ```bash
159
- $ inspec exec PATHS
160
- ```
161
-
162
- ### Options
163
-
164
- This subcommand has additional options:
165
-
166
- * ``--attrs=one two three``
167
- Load attributes file (experimental)
168
- * ``-b``, ``--backend=BACKEND``
169
- Choose a backend: local, ssh, winrm, docker.
170
- * ``--cache=CACHE``
171
- Use the given path for caching dependencies. (default: ~/.inspec/cache)
172
- * ``--color``, ``--no-color``
173
- Use colors in output.
174
- * ``--controls=one two three``
175
- A list of controls to run. Ignore all other tests.
176
- * ``--create-lockfile``, ``--no-create-lockfile``
177
- Write out a lockfile based on this execution (unless one already exists)
178
- * ``--format=FORMAT``
179
- Which formatter to use: cli, progress, documentation, json, json-min, junit
180
- * ``--host=HOST``
181
- Specify a remote host which is tested.
182
- * ``--json-config=JSON_CONFIG``
183
- Read configuration from JSON file (`-` reads from stdin).
184
- * ``-i``, ``--key-files=one two three``
185
- Login key or certificate file for a remote scan.
186
- * ``--password=PASSWORD``
187
- Login password for a remote scan, if required.
188
- * ``--path=PATH``
189
- Login path to use when connecting to the target (WinRM).
190
- * ``-p``, ``--port=N``
191
- Specify the login port for a remote scan.
192
- * ``--profiles-path=PROFILES_PATH``
193
- Folder which contains referenced profiles.
194
- * ``--self-signed``, ``--no-self-signed``
195
- Allow remote scans with self-signed certificates (WinRM).
196
- * ``--shell``, ``--no-shell``
197
- Run scans in a subshell. Only activates on Unix.
198
- * ``--shell-command=SHELL_COMMAND``
199
- Specify a particular shell to use.
200
- * ``--shell-options=SHELL_OPTIONS``
201
- Additional shell options.
202
- * ``--ssl``, ``--no-ssl``
203
- Use SSL for transport layer encryption (WinRM).
204
- * ``--sudo``, ``--no-sudo``
205
- Run scans with sudo. Only activates on Unix and non-root user.
206
- * ``--sudo-command=SUDO_COMMAND``
207
- Alternate command for sudo.
208
- * ``--sudo-options=SUDO_OPTIONS``
209
- Additional sudo options for a remote scan.
210
- * ``--sudo-password=SUDO_PASSWORD``
211
- Specify a sudo password, if it is required.
212
- * ``-t``, ``--target=TARGET``
213
- Simple targeting option using URIs, e.g. ssh://user:pass@host:port
214
- * ``--user=USER``
215
- The login user for a remote scan.
216
-
217
- ## habitat
218
-
219
- Commands for inspec + habitat integration
220
-
221
- ### Syntax
222
-
223
- This subcommand has the following syntax:
224
-
225
- ```bash
226
- $ inspec habitat SUBCOMMAND ...
227
- ```
228
-
229
- ## help
230
-
231
- Describe available commands or one specific command
232
-
233
- ### Syntax
234
-
235
- This subcommand has the following syntax:
236
-
237
- ```bash
238
- $ inspec help [COMMAND]
239
- ```
240
-
241
- ## init
242
-
243
- Scaffolds a new project
244
-
245
- ### Syntax
246
-
247
- This subcommand has the following syntax:
248
-
249
- ```bash
250
- $ inspec init TEMPLATE ...
251
- ```
252
-
253
- ## json
254
-
255
- Read all tests in path and generate a json summary
256
-
257
- ### Syntax
258
-
259
- This subcommand has the following syntax:
260
-
261
- ```bash
262
- $ inspec json PATH
263
- ```
264
-
265
- ### Options
266
-
267
- This subcommand has additional options:
268
-
269
- * ``--controls=one two three``
270
- A list of controls to include. Ignore all other tests.
271
- * ``-o``, ``--output=OUTPUT``
272
- Save the created profile to a path
273
- * ``--profiles-path=PROFILES_PATH``
274
- Folder which contains referenced profiles.
275
-
276
- ## schema
277
-
278
- Print the json schema
279
-
280
- ### Syntax
281
-
282
- This subcommand has the following syntax:
283
-
284
- ```bash
285
- $ inspec schema NAME
286
- ```
287
-
288
- ## shell
289
-
290
- Open an interactive debugging shell
291
-
292
- ### Syntax
293
-
294
- This subcommand has the following syntax:
295
-
296
- ```bash
297
- $ inspec shell
298
- ```
299
-
300
- ### Options
301
-
302
- This subcommand has additional options:
303
-
304
- * ``-b``, ``--backend=BACKEND``
305
- Choose a backend: local, ssh, winrm, docker.
306
- * ``-c``, ``--command=COMMAND``
307
- A single command string to run instead of launching the shell
308
- * ``--host=HOST``
309
- Specify a remote host which is tested.
310
- * ``--json-config=JSON_CONFIG``
311
- Read configuration from JSON file (`-` reads from stdin).
312
- * ``-i``, ``--key-files=one two three``
313
- Login key or certificate file for a remote scan.
314
- * ``--password=PASSWORD``
315
- Login password for a remote scan, if required.
316
- * ``--path=PATH``
317
- Login path to use when connecting to the target (WinRM).
318
- * ``-p``, ``--port=N``
319
- Specify the login port for a remote scan.
320
- * ``--self-signed``, ``--no-self-signed``
321
- Allow remote scans with self-signed certificates (WinRM).
322
- * ``--shell``, ``--no-shell``
323
- Run scans in a subshell. Only activates on Unix.
324
- * ``--shell-command=SHELL_COMMAND``
325
- Specify a particular shell to use.
326
- * ``--shell-options=SHELL_OPTIONS``
327
- Additional shell options.
328
- * ``--ssl``, ``--no-ssl``
329
- Use SSL for transport layer encryption (WinRM).
330
- * ``--sudo``, ``--no-sudo``
331
- Run scans with sudo. Only activates on Unix and non-root user.
332
- * ``--sudo-command=SUDO_COMMAND``
333
- Alternate command for sudo.
334
- * ``--sudo-options=SUDO_OPTIONS``
335
- Additional sudo options for a remote scan.
336
- * ``--sudo-password=SUDO_PASSWORD``
337
- Specify a sudo password, if it is required.
338
- * ``-t``, ``--target=TARGET``
339
- Simple targeting option using URIs, e.g. ssh://user:pass@host:port
340
- * ``--user=USER``
341
- The login user for a remote scan.
342
-
343
- ## supermarket
344
-
345
- Supermarket commands
346
-
347
- ### Syntax
348
-
349
- This subcommand has the following syntax:
350
-
351
- ```bash
352
- $ inspec supermarket SUBCOMMAND ...
353
- ```
354
-
355
- ## vendor
356
-
357
- Download all dependencies and generate a lockfile in a `vendor` directory
358
-
359
- ### Syntax
360
-
361
- This subcommand has the following syntax:
362
-
363
- ```bash
364
- $ inspec vendor PATH
365
- ```
366
-
367
- ### Options
368
-
369
- This subcommand has additional options:
370
-
371
- * ``--overwrite``, ``--no-overwrite``
372
- Overwrite existing vendored dependencies and lockfile.
373
-
374
- ## version
375
-
376
- Prints the version of this tool
377
-
378
- ### Syntax
379
-
380
- This subcommand has the following syntax:
381
-
382
- ```bash
383
- $ inspec version
384
- ```
385
-
386
- ### Options
387
-
388
- This subcommand has additional options:
389
-
390
- * ``--format=FORMAT``
391
-
392
-