inspec 1.40.0 → 1.41.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (114) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +30 -9
  3. data/docs/matchers.md +18 -0
  4. data/docs/plugin_kitchen_inspec.md +18 -24
  5. data/docs/profiles.md +39 -2
  6. data/docs/resources/aide_conf.md.erb +18 -28
  7. data/docs/resources/apache_conf.md.erb +19 -33
  8. data/docs/resources/apt.md.erb +22 -36
  9. data/docs/resources/audit_policy.md.erb +9 -24
  10. data/docs/resources/auditd.md.erb +9 -24
  11. data/docs/resources/auditd_conf.md.erb +20 -34
  12. data/docs/resources/auditd_rules.md.erb +8 -24
  13. data/docs/resources/bash.md.erb +4 -26
  14. data/docs/resources/bond.md.erb +25 -40
  15. data/docs/resources/bridge.md.erb +5 -25
  16. data/docs/resources/bsd_service.md.erb +5 -25
  17. data/docs/resources/command.md.erb +35 -50
  18. data/docs/resources/crontab.md.erb +9 -23
  19. data/docs/resources/csv.md.erb +12 -27
  20. data/docs/resources/dh_params.md +1 -0
  21. data/docs/resources/directory.md.erb +5 -25
  22. data/docs/resources/docker.md.erb +60 -57
  23. data/docs/resources/docker_container.md.erb +23 -19
  24. data/docs/resources/docker_image.md.erb +20 -16
  25. data/docs/resources/etc_fstab.md.erb +5 -2
  26. data/docs/resources/etc_group.md.erb +29 -45
  27. data/docs/resources/etc_hosts.md.erb +6 -0
  28. data/docs/resources/etc_hosts_allow.md.erb +6 -2
  29. data/docs/resources/etc_hosts_deny.md.erb +6 -2
  30. data/docs/resources/file.md.erb +198 -212
  31. data/docs/resources/firewalld.md.erb +7 -1
  32. data/docs/resources/gem.md.erb +21 -35
  33. data/docs/resources/group.md.erb +16 -30
  34. data/docs/resources/grub_conf.md.erb +9 -24
  35. data/docs/resources/host.md.erb +32 -49
  36. data/docs/resources/http.md.erb +38 -44
  37. data/docs/resources/iis_app.md.erb +25 -35
  38. data/docs/resources/iis_site.md.erb +26 -40
  39. data/docs/resources/inetd_conf.md.erb +27 -42
  40. data/docs/resources/ini.md.erb +9 -23
  41. data/docs/resources/interface.md.erb +5 -25
  42. data/docs/resources/iptables.md.erb +15 -29
  43. data/docs/resources/json.md.erb +12 -27
  44. data/docs/resources/kernel_module.md.erb +47 -61
  45. data/docs/resources/kernel_parameter.md.erb +15 -29
  46. data/docs/resources/key_rsa.md.erb +3 -0
  47. data/docs/resources/launchd_service.md.erb +5 -25
  48. data/docs/resources/limits_conf.md.erb +15 -29
  49. data/docs/resources/login_def.md.erb +15 -30
  50. data/docs/resources/mount.md.erb +18 -33
  51. data/docs/resources/mssql_session.md.erb +9 -12
  52. data/docs/resources/mysql_conf.md.erb +17 -32
  53. data/docs/resources/mysql_session.md.erb +15 -29
  54. data/docs/resources/nginx.md.erb +6 -0
  55. data/docs/resources/nginx_conf.md.erb +25 -20
  56. data/docs/resources/npm.md.erb +19 -35
  57. data/docs/resources/ntp_conf.md.erb +20 -37
  58. data/docs/resources/oneget.md.erb +15 -30
  59. data/docs/resources/oracledb_session.md.erb +9 -11
  60. data/docs/resources/os.md.erb +29 -43
  61. data/docs/resources/os_env.md.erb +29 -44
  62. data/docs/resources/package.md.erb +33 -42
  63. data/docs/resources/parse_config.md.erb +5 -25
  64. data/docs/resources/parse_config_file.md.erb +31 -43
  65. data/docs/resources/passwd.md.erb +24 -39
  66. data/docs/resources/pip.md.erb +20 -35
  67. data/docs/resources/port.md.erb +43 -57
  68. data/docs/resources/postgres_conf.md.erb +17 -31
  69. data/docs/resources/postgres_hba_conf.md.erb +26 -38
  70. data/docs/resources/postgres_ident_conf.md.erb +25 -37
  71. data/docs/resources/postgres_session.md.erb +15 -29
  72. data/docs/resources/powershell.md.erb +27 -42
  73. data/docs/resources/processes.md.erb +17 -33
  74. data/docs/resources/rabbitmq_config.md.erb +9 -24
  75. data/docs/resources/registry_key.md.erb +27 -42
  76. data/docs/resources/runit_service.md.erb +5 -25
  77. data/docs/resources/security_policy.md.erb +12 -27
  78. data/docs/resources/service.md.erb +27 -42
  79. data/docs/resources/shadow.md.erb +20 -35
  80. data/docs/resources/ssh_config.md.erb +19 -34
  81. data/docs/resources/sshd_config.md.erb +19 -34
  82. data/docs/resources/ssl.md.erb +39 -54
  83. data/docs/resources/sys_info.md.erb +12 -26
  84. data/docs/resources/systemd_service.md.erb +5 -25
  85. data/docs/resources/sysv_service.md.erb +5 -25
  86. data/docs/resources/upstart_service.md.erb +5 -25
  87. data/docs/resources/user.md.erb +29 -44
  88. data/docs/resources/users.md.erb +12 -26
  89. data/docs/resources/vbscript.md.erb +9 -24
  90. data/docs/resources/virtualization.md.erb +8 -23
  91. data/docs/resources/windows_feature.md.erb +15 -30
  92. data/docs/resources/windows_hotfix.md.erb +15 -9
  93. data/docs/resources/windows_task.md.erb +12 -26
  94. data/docs/resources/wmi.md.erb +9 -24
  95. data/docs/resources/x509_certificate.md.erb +4 -0
  96. data/docs/resources/xinetd_conf.md.erb +65 -80
  97. data/docs/resources/xml.md.erb +12 -26
  98. data/docs/resources/yaml.md.erb +12 -27
  99. data/docs/resources/yum.md.erb +37 -51
  100. data/docs/resources/zfs_dataset.md.erb +15 -26
  101. data/docs/resources/zfs_pool.md.erb +9 -20
  102. data/lib/inspec/backend.rb +8 -0
  103. data/lib/inspec/profile.rb +9 -1
  104. data/lib/inspec/shell.rb +13 -13
  105. data/lib/inspec/version.rb +1 -1
  106. data/lib/matchers/matchers.rb +2 -0
  107. data/lib/resources/etc_hosts.rb +1 -1
  108. data/lib/resources/host.rb +4 -1
  109. data/lib/resources/http.rb +173 -23
  110. data/lib/resources/processes.rb +106 -20
  111. data/lib/resources/ssh_conf.rb +1 -1
  112. data/lib/resources/ssl.rb +4 -3
  113. data/lib/utils/object_traversal.rb +35 -10
  114. metadata +2 -2
@@ -6,6 +6,8 @@ title: About the pip Resource
6
6
 
7
7
  Use the `pip` InSpec audit resource to test packages that are installed using the Python PIP installer.
8
8
 
9
+ <br>
10
+
9
11
  ## Syntax
10
12
 
11
13
  A `pip` resource block declares a package and (optionally) a package version:
@@ -19,56 +21,39 @@ where
19
21
  * `'package_name'` is the name of the package, such as `'Jinja2'`
20
22
  * `be_installed` tests to see if the package described above is installed
21
23
 
24
+ <br>
22
25
 
23
- ## Matchers
24
-
25
- This InSpec audit resource has the following matchers:
26
-
27
- ### be
28
-
29
- <%= partial "/shared/matcher_be" %>
26
+ ## Examples
30
27
 
31
- ### be_installed
28
+ The following examples show how to use this InSpec audit resource.
32
29
 
33
- The `be_installed` matcher tests if the named package is installed on the system:
30
+ ### Test if Jinja2 is installed on the system
34
31
 
35
- it { should be_installed }
32
+ describe pip('Jinja2') do
33
+ it { should be_installed }
34
+ end
36
35
 
37
- ### cmp
36
+ ### Test if Jinja2 2.8 is installed on the system
38
37
 
39
- <%= partial "/shared/matcher_cmp" %>
38
+ describe pip('Jinja2') do
39
+ it { should be_installed }
40
+ its('version') { should eq '2.8' }
41
+ end
40
42
 
41
- ### eq
43
+ <br>
42
44
 
43
- <%= partial "/shared/matcher_eq" %>
45
+ ## Matchers
44
46
 
45
- ### include
47
+ This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
46
48
 
47
- <%= partial "/shared/matcher_include" %>
49
+ ### be_installed
48
50
 
49
- ### match
51
+ The `be_installed` matcher tests if the named package is installed on the system:
50
52
 
51
- <%= partial "/shared/matcher_match" %>
53
+ it { should be_installed }
52
54
 
53
55
  ### version
54
56
 
55
57
  The `version` matcher tests if the named package version is on the system:
56
58
 
57
59
  its('version') { should eq '1.2.3' }
58
-
59
- ## Examples
60
-
61
- The following examples show how to use this InSpec audit resource.
62
-
63
- ### Test if Jinja2 is installed on the system
64
-
65
- describe pip('Jinja2') do
66
- it { should be_installed }
67
- end
68
-
69
- ### Test if Jinja2 2.8 is installed on the system
70
-
71
- describe pip('Jinja2') do
72
- it { should be_installed }
73
- its('version') { should eq '2.8' }
74
- end
@@ -6,6 +6,8 @@ title: About the port Resource
6
6
 
7
7
  Use the `port` InSpec audit resource to test basic port properties, such as port, process, if it's listening.
8
8
 
9
+ <br>
10
+
9
11
  ## Syntax
10
12
 
11
13
  A `port` resource block declares a port, and then depending on what needs to be tested, a process, protocol, process identifier, and its state (is it listening?):
@@ -35,63 +37,7 @@ For example, to test if the SSH daemon is available on a Linux machine via the d
35
37
  its('addresses') { should include '0.0.0.0' }
36
38
  end
37
39
 
38
- ## Matchers
39
-
40
- This InSpec audit resource has the following matchers:
41
-
42
- ### address
43
-
44
- The `addresses` matcher tests if the specified address is associated with a port:
45
-
46
- its('addresses') { should include '0.0.0.0' }
47
-
48
- ### be
49
-
50
- <%= partial "/shared/matcher_be" %>
51
-
52
- ### be_listening
53
-
54
- The `be_listening` matcher tests if the port is listening for traffic:
55
-
56
- it { should be_listening }
57
-
58
- ### cmp
59
-
60
- <%= partial "/shared/matcher_cmp" %>
61
-
62
- ### eq
63
-
64
- <%= partial "/shared/matcher_eq" %>
65
-
66
- ### include
67
-
68
- <%= partial "/shared/matcher_include" %>
69
-
70
- ### match
71
-
72
- <%= partial "/shared/matcher_match" %>
73
-
74
- ### pids
75
-
76
- The `pids` matcher tests the process identifiers (PIDs):
77
-
78
- its('pids') { should cmp 27808 }
79
-
80
- ### processes
81
-
82
- The `processes` matcher tests if the named process is running on the system:
83
-
84
- its('processes') { should cmp 'syslog' }
85
-
86
- ### protocols
87
-
88
- The `protocols` matcher tests the Internet protocol: ICMP (`'icmp'`), TCP (`'tcp'` or `'tcp6'`), or UDP (`'udp'` or `'udp6'`):
89
-
90
- its('protocols') { should include 'tcp' }
91
-
92
- or for the IPv6 protocol:
93
-
94
- its('protocols') { should include 'tcp6' }
40
+ <br>
95
41
 
96
42
  ## Examples
97
43
 
@@ -148,3 +94,43 @@ or:
148
94
  describe port(65432) do
149
95
  it { should_not be_listening }
150
96
  end
97
+
98
+ <br>
99
+
100
+ ## Matchers
101
+
102
+ This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
103
+
104
+ ### address
105
+
106
+ The `addresses` matcher tests if the specified address is associated with a port:
107
+
108
+ its('addresses') { should include '0.0.0.0' }
109
+
110
+ ### be_listening
111
+
112
+ The `be_listening` matcher tests if the port is listening for traffic:
113
+
114
+ it { should be_listening }
115
+
116
+ ### pids
117
+
118
+ The `pids` matcher tests the process identifiers (PIDs):
119
+
120
+ its('pids') { should cmp 27808 }
121
+
122
+ ### processes
123
+
124
+ The `processes` matcher tests if the named process is running on the system:
125
+
126
+ its('processes') { should cmp 'syslog' }
127
+
128
+ ### protocols
129
+
130
+ The `protocols` matcher tests the Internet protocol: ICMP (`'icmp'`), TCP (`'tcp'` or `'tcp6'`), or UDP (`'udp'` or `'udp6'`):
131
+
132
+ its('protocols') { should include 'tcp' }
133
+
134
+ or for the IPv6 protocol:
135
+
136
+ its('protocols') { should include 'tcp6' }
@@ -6,6 +6,8 @@ title: About the postgres_conf Resource
6
6
 
7
7
  Use the `postgres_conf` InSpec audit resource to test the contents of the configuration file for PostgreSQL, typically located at `/etc/postgresql/<version>/main/postgresql.conf` or `/var/lib/postgres/data/postgresql.conf`, depending on the platform.
8
8
 
9
+ <br>
10
+
9
11
  ## Syntax
10
12
 
11
13
  A `postgres_conf` resource block declares one (or more) settings in the `postgresql.conf` file, and then compares the setting in the configuration file to the value stated in the test:
@@ -21,37 +23,7 @@ where
21
23
  * `('path')` is the non-default path to the `postgresql.conf` file (optional)
22
24
  * `should eq 'value'` is the value that is expected
23
25
 
24
- ## Matchers
25
-
26
- This InSpec audit resource has the following matchers:
27
-
28
- ### be
29
-
30
- <%= partial "/shared/matcher_be" %>
31
-
32
- ### cmp
33
-
34
- <%= partial "/shared/matcher_cmp" %>
35
-
36
- ### eq
37
-
38
- <%= partial "/shared/matcher_eq" %>
39
-
40
- ### include
41
-
42
- <%= partial "/shared/matcher_include" %>
43
-
44
- ### match
45
-
46
- <%= partial "/shared/matcher_match" %>
47
-
48
- ### setting
49
-
50
- The `setting` matcher tests specific, named settings in the `postgresql.conf` file:
51
-
52
- its('setting') { should eq 'value' }
53
-
54
- Use a `setting` matcher for each setting to be tested.
26
+ <br>
55
27
 
56
28
  ## Examples
57
29
 
@@ -90,3 +62,17 @@ The following examples show how to use this InSpec audit resource.
90
62
  end
91
63
 
92
64
  where `unix_socket_group` is set to the PostgreSQL default setting (the group to which the server user belongs).
65
+
66
+ <br>
67
+
68
+ ## Matchers
69
+
70
+ This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
71
+
72
+ ### setting
73
+
74
+ The `setting` matcher tests specific, named settings in the `postgresql.conf` file:
75
+
76
+ its('setting') { should eq 'value' }
77
+
78
+ Use a `setting` matcher for each setting to be tested.
@@ -5,6 +5,9 @@ title: About the postgres_hba_conf Resource
5
5
  # postgres_hba_conf
6
6
 
7
7
  Use the `postgres_hba_conf` InSpec audit resource to test the client authentication data defined in the pg_hba.conf file.
8
+
9
+ <br>
10
+
8
11
  ## Syntax
9
12
 
10
13
  An `postgres_hba_conf` InSpec audit resource block declares client authentication data that should be tested:
@@ -19,48 +22,14 @@ where
19
22
  * `'filter_value'` is the value that is to be filtered for
20
23
  * `'value'` is the value that is to be matched expected
21
24
 
22
- ## Matchers
23
-
24
- This InSpec audit resource matches any service that is listed in the HBA configuration file:
25
-
26
- its('auth_method') { should_not cmp 'peer' }
27
-
28
- or:
29
-
30
- its('auth_method') { should cmp 'peer' }
31
-
32
- For example:
33
-
34
- describe postgres_hba_conf.where { type == 'type' } do
35
- its('auth_method') { should cmp 'value' }
36
- its('user') { should cmp 'value' }
37
- end
38
-
39
- ### be
40
-
41
- <%= partial "/shared/matcher_be" %>
42
-
43
- ### cmp
44
-
45
- <%= partial "/shared/matcher_cmp" %>
46
-
47
- ### eq
48
-
49
- <%= partial "/shared/matcher_eq" %>
50
-
51
- ### include
52
-
53
- <%= partial "/shared/matcher_include" %>
54
-
55
- ### match
56
-
57
- <%= partial "/shared/matcher_match" %>
58
-
25
+ <br>
59
26
 
60
27
  ## Supported Properties
61
28
 
62
29
  'address', 'auth_method', 'auth_params', 'conf_dir' , 'conf_file' , 'database', 'params' ,'type', 'user'
63
30
 
31
+ <br>
32
+
64
33
  ## Property Examples and Return Types
65
34
 
66
35
  ### address([String])
@@ -70,7 +39,7 @@ For example:
70
39
  describe postgres_hba_conf.where { type == 'local' } do
71
40
  its('address') { should cmp 'value' }
72
41
  end
73
-
42
+
74
43
  ### auth_method([String])
75
44
 
76
45
  `auth_method` returns a an array of strings that matches the where condition of the filter table
@@ -102,3 +71,22 @@ For example:
102
71
  describe postgres_hba_conf.where { database == 'acme_test_db' } do
103
72
  its('user') { should cmp 'value' }
104
73
  end
74
+
75
+ <br>
76
+
77
+ ## Matchers
78
+
79
+ This InSpec audit resource matches any service that is listed in the HBA configuration file. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
80
+
81
+ its('auth_method') { should_not cmp 'peer' }
82
+
83
+ or:
84
+
85
+ its('auth_method') { should cmp 'peer' }
86
+
87
+ For example:
88
+
89
+ describe postgres_hba_conf.where { type == 'type' } do
90
+ its('auth_method') { should cmp 'value' }
91
+ its('user') { should cmp 'value' }
92
+ end
@@ -5,6 +5,9 @@ title: About the postgres_ident_conf Resource
5
5
  # postgres_ident_conf
6
6
 
7
7
  Use the `postgres_ident_conf` InSpec audit resource to test the client authentication data defined in the pg_hba.conf file.
8
+
9
+ <br>
10
+
8
11
  ## Syntax
9
12
 
10
13
  An `postgres_ident_conf` InSpec audit resource block declares client authentication data that should be tested:
@@ -19,48 +22,14 @@ where
19
22
  * `'filter_value'` is the value that is to be filtered for
20
23
  * `'value'` is the value that is to be matched expected
21
24
 
22
- ## Matchers
23
-
24
- This InSpec audit resource matches any service that is listed in the pg ident configuration file:
25
-
26
- its('pg_username') { should_not eq ['peer'] }
27
-
28
- or:
29
-
30
- its('map_name') { should eq ['value'] }
31
-
32
- For example:
33
-
34
- describe postgres_ident_conf.where { pg_username == 'name' } do
35
- its('system_username') { should eq ['value'] }
36
- its('map_name') { should eq ['value'] }
37
- end
38
-
39
- ### be
40
-
41
- <%= partial "/shared/matcher_be" %>
42
-
43
- ### cmp
44
-
45
- <%= partial "/shared/matcher_cmp" %>
46
-
47
- ### eq
48
-
49
- <%= partial "/shared/matcher_eq" %>
50
-
51
- ### include
52
-
53
- <%= partial "/shared/matcher_include" %>
54
-
55
- ### match
56
-
57
- <%= partial "/shared/matcher_match" %>
58
-
25
+ <br>
59
26
 
60
27
  ## Supported Properties
61
28
 
62
29
  'conf_file', 'map_name', 'params', 'pg_username', 'system_username'
63
30
 
31
+ <br>
32
+
64
33
  ## Property Examples and Return Types
65
34
 
66
35
  ### map_name([String])
@@ -85,3 +54,22 @@ For example:
85
54
  describe pg_hba_conf.where { pg_username == 'name' } do
86
55
  its('system_username') { should eq ['value'] }
87
56
  end
57
+
58
+ <br>
59
+
60
+ ## Matchers
61
+
62
+ This InSpec audit resource matches any service that is listed in the pg ident configuration file. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
63
+
64
+ its('pg_username') { should_not eq ['peer'] }
65
+
66
+ or:
67
+
68
+ its('map_name') { should eq ['value'] }
69
+
70
+ For example:
71
+
72
+ describe postgres_ident_conf.where { pg_username == 'name' } do
73
+ its('system_username') { should eq ['value'] }
74
+ its('map_name') { should eq ['value'] }
75
+ end
@@ -6,6 +6,8 @@ title: About the postgres_session Resource
6
6
 
7
7
  Use the `postgres_session` InSpec audit resource to test SQL commands run against a PostgreSQL database.
8
8
 
9
+ <br>
10
+
9
11
  ## Syntax
10
12
 
11
13
  A `postgres_session` resource block declares the username and password to use for the session, and then the command to be run:
@@ -29,35 +31,7 @@ A full example is:
29
31
 
30
32
  where `its('output') { should eq '' }` compares the results of the query against the expected result in the test
31
33
 
32
- ## Matchers
33
-
34
- This InSpec audit resource has the following matchers:
35
-
36
- ### be
37
-
38
- <%= partial "/shared/matcher_be" %>
39
-
40
- ### cmp
41
-
42
- <%= partial "/shared/matcher_cmp" %>
43
-
44
- ### eq
45
-
46
- <%= partial "/shared/matcher_eq" %>
47
-
48
- ### include
49
-
50
- <%= partial "/shared/matcher_include" %>
51
-
52
- ### match
53
-
54
- <%= partial "/shared/matcher_match" %>
55
-
56
- ### output
57
-
58
- The `output` matcher tests the results of the query:
59
-
60
- its('output') { should eq(/^0/) }
34
+ <br>
61
35
 
62
36
  ## Examples
63
37
 
@@ -80,3 +54,15 @@ The following examples show how to use this InSpec audit resource.
80
54
  AND lanname!=\'c\';', ['postgres']) do
81
55
  its('output') { should eq '0' }
82
56
  end
57
+
58
+ <br>
59
+
60
+ ## Matchers
61
+
62
+ This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
63
+
64
+ ### output
65
+
66
+ The `output` matcher tests the results of the query:
67
+
68
+ its('output') { should eq(/^0/) }