inspec 1.31.0 → 1.45.9

data/docs/resources/apache_conf.md.erb

@@ -6,6 +6,8 @@ title: About the apache_conf Resource
 
 Use the `apache_conf` InSpec audit resource to test the configuration settings for Apache. This file is typically located under `/etc/apache2` on the Debian and Ubuntu platforms and under `/etc/httpd` on the Fedora, CentOS, RedHat Enterprise Linux, and ArchLinux platforms. The configuration settings may vary significantly from platform to platform.
 
+<br>
+
 ## Syntax
 
 An `apache_conf` InSpec audit resource block declares configuration settings that should be tested:
@@ -20,56 +22,40 @@ where
 * `('path')` is the non-default path to the Apache configuration file
 * `{ should eq 'value' }` is the value that is expected
 
-## Matchers
+<br>
 
-This InSpec audit resource matches any service that is listed in the Apache configuration file:
+## Examples
 
-    its('PidFile') { should_not eq '/var/run/httpd.pid' }
+The following examples show how to use this InSpec audit resource.
 
-or:
+### Test for blocking .htaccess files on CentOS
 
-    its('Timeout') { should eq 300 }
+    describe apache_conf do
+      its('AllowOverride') { should eq 'None' }
+    end
 
-For example:
+### Test ports for SSL
 
     describe apache_conf do
-      its('MaxClients') { should eq 100 }
       its('Listen') { should eq '443'}
     end
 
+<br>
 
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
+## Matchers
 
-## Examples
+For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+This InSpec audit resource matches any service that is listed in the Apache configuration file:
 
-The following examples show how to use this InSpec audit resource.
+    its('PidFile') { should_not eq '/var/run/httpd.pid' }
 
-### Test for blocking .htaccess files on CentOS
+or:
 
-    describe apache_conf do
-      its('AllowOverride') { should eq 'None' }
-    end
+    its('Timeout') { should eq 300 }
 
-### Test ports for SSL
+For example:
 
     describe apache_conf do
+      its('MaxClients') { should eq 100 }
       its('Listen') { should eq '443'}
     end

data/docs/resources/apt.md.erb

@@ -6,6 +6,8 @@ title: About the apt Resource
 
 Use the `apt` InSpec audit resource to verify Apt repositories on the Debian and Ubuntu platforms, and also PPA repositories on the Ubuntu platform.
 
+<br>
+
 ## Syntax
 
 An `apt` resource block tests the contents of Apt and PPA repositories:
@@ -21,42 +23,7 @@ where
 * `('path')` may be an `http://` address, a `ppa:` address, or a short `repo-name/ppa` address
 * `exist` and `be_enabled` are a valid matchers for this resource
 
-
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### be_enabled
-
-The `be_enabled` matcher tests if a package exists in the repository:
-
-    it { should be_enabled }
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### exist
-
-The `exist` matcher tests if a package exists on the system:
-
-    it { should exist }
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
+<br>
 
 ## Examples
 
@@ -82,3 +49,22 @@ The following examples show how to use this InSpec audit resource.
       it { should_not exist }
       it { should_not be_enabled }
     end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+
+### be_enabled
+
+The `be_enabled` matcher tests if a package exists in the repository:
+
+    it { should be_enabled }
+
+### exist
+
+The `exist` matcher tests if a package exists on the system:
+
+    it { should exist }

data/docs/resources/audit_policy.md.erb

@@ -6,6 +6,8 @@ title: About the audit_policy Resource
 
 Use the `audit_policy` Inspec audit resource to test auditing policies on the Windows platform. An auditing policy is a category of security-related events to be audited. Auditing is disabled by default and may be enabled for categories like account management, logon events, policy changes, process tracking, privilege use, system events, or object access. For each auditing category property that is enabled, the auditing level may be set to `No Auditing`, `Not Specified`, `Success`, `Success and Failure`, or `Failure`.
 
+<br>
+
 ## Syntax
 
 An `audit_policy` resource block declares a parameter that belongs to an audit policy category or subcategory:
@@ -19,30 +21,7 @@ where
 * `'parameter'` must specify a parameter
 * `'value'` must be one of `No Auditing`, `Not Specified`, `Success`, `Success and Failure`, or `Failure`
 
-
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
+<br>
 
 ## Examples
 
@@ -59,3 +38,9 @@ The following examples show how to use this InSpec audit resource.
     describe audit_policy do
       its('User Account Management') { should eq 'Success' }
     end
+
+<br>
+
+## Matchers
+
+For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).

data/docs/resources/auditd.md.erb

@@ -0,0 +1,78 @@
+---
+title: About the auditd Resource
+---
+
+# auditd
+
+Use the `auditd` InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files. These rules are output using the auditcl -l command. This resource supports versions of `audit` >= 2.3.
+
+<br>
+
+## Syntax
+
+An `auditd` resource block declares one (or more) rules to be tested, and then what that rule should do:
+
+    describe auditd do
+      its('lines') { should include %r(-w /etc/ssh/sshd_config) }
+    end
+
+or test that multiple individual rules are defined:
+
+    describe auditd do
+      its('lines') { should include %r(-a always,exit -F arch=.* -S init_module,delete_module -F key=modules) }
+      its('lines') { should include %r(-a always,exit -F arch=.* -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=.+) }
+    end
+
+where each test must declare one (or more) rules to be tested.
+
+<br>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test if a rule contains a matching element that is identified by a regular expression
+
+For `audit` >= 2.3:
+
+    describe auditd do
+      its('lines') { should include %r(-a always,exit -F arch=.* -S chown.* -F auid>=1000 -F auid!=-1 -F key=perm_mod) }
+    end
+
+### Query the audit daemon status
+
+    describe auditd.status('backlog') do
+      it { should cmp 0 }
+    end
+
+### Query properties of rules targeting specific syscalls or files - uniq is used to handle multiple rules for the same syscall with redundant field values
+
+    describe auditd.syscall('open') do
+      its('action.uniq') { should eq ['always'] }
+      its('list.uniq') { should eq ['exit'] }
+    end
+
+    describe auditd.file('/etc/sudoers') do
+      its('permissions') { should include ['x'] }
+    end
+
+The where accessor can be used to filter on fields. For example:
+
+    describe auditd.syscall('chown').where { arch == "b32" } do
+      its('action') { should eq ['always'] }
+      its('list') { should eq ['exit'] }
+      its('exit') { should include ['-EACCES'] }
+      its('exit') { should include ['-EPERM'] }
+    end
+
+The key filter may be useful in evaluating rules with particular key values:
+
+  describe auditd.where { key == "privileged" } do
+    its('permissions') { should include ['x'] }
+  end
+
+<br>
+
+## Matchers
+
+For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).

data/docs/resources/auditd_conf.md.erb

@@ -6,6 +6,8 @@ title: About the auditd_conf Resource
 
 Use the `auditd_conf` InSpec audit resource to test the configuration settings for the audit daemon. This file is typically located under `/etc/audit/auditd.conf'` on Unix and Linux platforms.
 
+<br>
+
 ## Syntax
 
 A `auditd_conf` resource block declares configuration settings that should be tested:
@@ -20,40 +22,7 @@ where
 * `('path')` is the non-default path to the `auditd.conf` configuration file
 * `{ should cmp 'value' }` is the value that is expected
 
-
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### keyword
-
-This matcher will matche any keyword that is listed in the `auditd.conf` configuration file. Option names and values are case-insensitive:
-
-    its('log_format') { should cmp 'raw' }
-
-or:
-
-    its('max_log_file') { should cmp 6 }
-
-### match
-
-<%= partial "/shared/matcher_match" %>
+<br>
 
 ## Examples
 
@@ -77,3 +46,20 @@ The following examples show how to use this InSpec audit resource.
       its('disk_full_action') { should cmp 'halt' }
       its('disk_error_action') { should cmp 'halt' }
     end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+
+### keyword
+
+This matcher will matche any keyword that is listed in the `auditd.conf` configuration file. Option names and values are case-insensitive:
+
+    its('log_format') { should cmp 'raw' }
+
+or:
+
+    its('max_log_file') { should cmp 6 }

data/docs/resources/auditd_rules.md.erb

@@ -6,6 +6,7 @@ title: About the auditd_rules Resource
 
 Use the `auditd_rules` InSpec audit resource to test the rules for logging that exist on the system. The `audit.rules` file is typically located under `/etc/audit/` and contains the list of rules that define what is captured in log files. This resource uses `auditctl` to query the run-time `auditd` rules setup, which may be different from `audit.rules`.
 
+<br>
 
 ## Syntax
 
@@ -61,30 +62,7 @@ or test that individual rules are defined:
 
 where each test must declare one (or more) rules to be tested.
 
-
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
+<br>
 
 ## Examples
 
@@ -130,3 +108,9 @@ Filters may be chained. For example:
     describe auditd_rules.syscall('open').action('always').list do
       it { should eq(['exit']) }
     end
+
+<br>
+
+## Matchers
+
+For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).

data/docs/resources/bash.md.erb

@@ -6,6 +6,8 @@ title: About the bash Resource
 
 Use the `bash` InSpec audit resource to test an arbitrary command that is run on the system using a Bash script.
 
+<br>
+
 ## Syntax
 
 A `command` resource block declares a command to be run, one (or more) expected outputs, and the location to which that output is sent:
@@ -29,22 +31,11 @@ For example:
       its('exit_status') { should eq 0 }
     end
 
+<br>
 
 ## Matchers
 
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
 ### exist
 
@@ -58,14 +49,6 @@ The `exit_status` matcher tests the exit status for the command:
 
     its('exit_status') { should eq 0 }
 
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
 ### stderr
 
 The `stderr` matcher tests results of the command as returned in standard error (stderr):
@@ -77,8 +60,3 @@ The `stderr` matcher tests results of the command as returned in standard error
 The `stdout` matcher tests results of the command as returned in standard output (stdout).
 
     its('stdout') { should match /bin/ }
-
-
-## Examples
-
-None.

data/docs/resources/bond.md.erb

@@ -6,6 +6,8 @@ title: About the bond Resource
 
 Use the `bond` InSpec audit resource to test a logical, bonded network interface (i.e. "two or more network interfaces aggregated into a single, logical network interface"). On Linux platforms, any value in the `/proc/net/bonding` directory may be tested.
 
+<br>
+
 ## Syntax
 
 A `bond` resource block declares a bonded network interface, and then specifies the properties of that bonded network interface to be tested:
@@ -19,18 +21,35 @@ where
 * `'name'` is the name of the bonded network interface
 * `{ should exist }` is a valid matcher for this resource
 
+<br>
 
-## Matchers
+## Examples
 
-This InSpec audit resource has the following matchers:
+The following examples show how to use this InSpec audit resource.
 
-### be
+### Test if eth0 is a secondary interface for bond0
 
-<%= partial "/shared/matcher_be" %>
+    describe bond('bond0') do
+      it { should exist }
+      it { should have_interface 'eth0' }
+    end
 
-### cmp
+### Test parameters for bond0
 
-<%= partial "/shared/matcher_cmp" %>
+    describe bond('bond0') do
+      its('Bonding Mode') { should eq 'IEEE 802.3ad Dynamic link aggregation' }
+      its('Transmit Hash Policy') { should eq 'layer3+4 (1)' }
+      its('MII Status') { should eq 'up' }
+      its('MII Polling Interval (ms)') { should eq '100' }
+      its('Up Delay (ms)') { should eq '0' }
+      its('Down Delay (ms)') { should eq '0' }
+    end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
 ### content
 
@@ -38,10 +57,6 @@ The `content` matcher tests if contents in the file that defines the bonded netw
 
     its('content') { should match('value') }
 
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
 ### exist
 
 The `exist` matcher tests if the bonded network interface is available:
@@ -54,44 +69,14 @@ The `have_interface` matcher tests if the bonded network interface has one (or m
 
     it { should have_interface }
 
-### include
-
-<%= partial "/shared/matcher_include" %>
-
 ### interfaces
 
 The `interfaces` matcher tests if the named secondary interfaces are available:
 
     its('interfaces') { should eq ['eth0', 'eth1', ...] }
 
-### match
-
-<%= partial "/shared/matcher_match" %>
-
 ### params
 
 The `params` matcher tests arbitrary parameters for the bonded network interface:
 
     its('params') { should eq 'value' }
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test if eth0 is a secondary interface for bond0
-
-    describe bond('bond0') do
-      it { should exist }
-      it { should have_interface 'eth0' }
-    end
-
-### Test parameters for bond0
-
-    describe bond('bond0') do
-      its('Bonding Mode') { should eq 'IEEE 802.3ad Dynamic link aggregation' }
-      its('Transmit Hash Policy') { should eq 'layer3+4 (1)' }
-      its('MII Status') { should eq 'up' }
-      its('MII Polling Interval (ms)') { should eq '100' }
-      its('Up Delay (ms)') { should eq '0' }
-      its('Down Delay (ms)') { should eq '0' }
-    end

data/docs/resources/bridge.md.erb

@@ -9,6 +9,8 @@ Use the `bridge` InSpec audit resource to test basic network bridge properties,
 * On Linux platforms, any value in the `/sys/class/net/{interface}/bridge` directory may be tested
 * On the Windows platform, the `Get-NetAdapter` cmdlet is associated with the `Get-NetAdapterBinding` cmdlet and returns the `ComponentID ms_bridge` value as a JSON object
 
+<br>
+
 ## Syntax
 
 A `bridge` resource block declares the bridge to be tested and what interface it should be associated with:
@@ -18,21 +20,11 @@ A `bridge` resource block declares the bridge to be tested and what interface it
       it { should have_interface 'eth0' }
     end
 
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
+<br>
 
-### eq
+## Matchers
 
-<%= partial "/shared/matcher_eq" %>
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
 ### exist
 
@@ -46,10 +38,6 @@ The `have_interface` matcher tests if the named interface is defined for the net
 
     it { should have_interface 'eth0' }
 
-### include
-
-<%= partial "/shared/matcher_include" %>
-
 ### interfaces
 
 The `interfaces` matcher tests if the named interface is present:
@@ -57,11 +45,3 @@ The `interfaces` matcher tests if the named interface is present:
     its('interfaces') { should eq 'foo' }
     its('interfaces') { should eq 'bar' }
     its('interfaces') { should include('foo') }
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
-## Examples
-
-None.

data/docs/resources/bsd_service.md.erb

@@ -6,6 +6,8 @@ title: About the bsd_service Resource
 
 Use the `bsd_service` InSpec audit resource to test a service using a Berkeley OS-style `init` on the FreeBSD platform.
 
+<br>
+
 ## Syntax
 
 A `bsd_service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
@@ -29,13 +31,11 @@ The path to the service manager's control may be specified for situations where
       it { should be_running }
     end
 
-## Matchers
-
-This InSpec audit resource has the following matchers:
+<br>
 
-### be
+## Matchers
 
-<%= partial "/shared/matcher_be" %>
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
 ### be_enabled
 
@@ -54,23 +54,3 @@ The `be_installed` matcher tests if the named service is installed:
 The `be_running` matcher tests if the named service is running:
 
     it { should be_running }
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
-## Examples
-
-None.