inspec 1.51.6 → 1.51.15

Sign up to get free protection for your applications and to get access to all the features.
Files changed (404) hide show
  1. checksums.yaml +4 -4
  2. data/.rubocop.yml +101 -101
  3. data/CHANGELOG.md +2915 -2902
  4. data/Gemfile +53 -53
  5. data/LICENSE +14 -14
  6. data/MAINTAINERS.md +31 -31
  7. data/MAINTAINERS.toml +47 -47
  8. data/README.md +419 -419
  9. data/Rakefile +167 -167
  10. data/bin/inspec +12 -12
  11. data/docs/.gitignore +2 -2
  12. data/docs/README.md +40 -40
  13. data/docs/dsl_inspec.md +258 -258
  14. data/docs/dsl_resource.md +93 -93
  15. data/docs/glossary.md +99 -99
  16. data/docs/habitat.md +191 -191
  17. data/docs/inspec_and_friends.md +107 -107
  18. data/docs/matchers.md +165 -165
  19. data/docs/migration.md +293 -293
  20. data/docs/plugin_kitchen_inspec.md +49 -49
  21. data/docs/profiles.md +370 -370
  22. data/docs/resources/aide_conf.md.erb +78 -78
  23. data/docs/resources/apache.md.erb +66 -66
  24. data/docs/resources/apache_conf.md.erb +67 -67
  25. data/docs/resources/apt.md.erb +70 -70
  26. data/docs/resources/audit_policy.md.erb +46 -46
  27. data/docs/resources/auditd.md.erb +78 -78
  28. data/docs/resources/auditd_conf.md.erb +68 -68
  29. data/docs/resources/auditd_rules.md.erb +116 -116
  30. data/docs/resources/bash.md.erb +74 -74
  31. data/docs/resources/bond.md.erb +89 -89
  32. data/docs/resources/bridge.md.erb +54 -54
  33. data/docs/resources/bsd_service.md.erb +65 -65
  34. data/docs/resources/command.md.erb +137 -137
  35. data/docs/resources/cpan.md.erb +77 -77
  36. data/docs/resources/cran.md.erb +63 -63
  37. data/docs/resources/crontab.md.erb +87 -87
  38. data/docs/resources/csv.md.erb +53 -53
  39. data/docs/resources/dh_params.md.erb +216 -216
  40. data/docs/resources/directory.md.erb +28 -28
  41. data/docs/resources/docker.md.erb +163 -163
  42. data/docs/resources/docker_container.md.erb +99 -99
  43. data/docs/resources/docker_image.md.erb +93 -93
  44. data/docs/resources/docker_service.md.erb +113 -113
  45. data/docs/resources/elasticsearch.md.erb +230 -230
  46. data/docs/resources/etc_fstab.md.erb +124 -124
  47. data/docs/resources/etc_group.md.erb +74 -74
  48. data/docs/resources/etc_hosts.md.erb +75 -75
  49. data/docs/resources/etc_hosts_allow.md.erb +73 -73
  50. data/docs/resources/etc_hosts_deny.md.erb +73 -73
  51. data/docs/resources/file.md.erb +512 -512
  52. data/docs/resources/filesystem.md.erb +40 -40
  53. data/docs/resources/firewalld.md.erb +105 -105
  54. data/docs/resources/gem.md.erb +78 -78
  55. data/docs/resources/group.md.erb +60 -60
  56. data/docs/resources/grub_conf.md.erb +101 -100
  57. data/docs/resources/host.md.erb +77 -77
  58. data/docs/resources/http.md.erb +104 -98
  59. data/docs/resources/iis_app.md.erb +120 -116
  60. data/docs/resources/iis_site.md.erb +132 -128
  61. data/docs/resources/inetd_conf.md.erb +95 -84
  62. data/docs/resources/ini.md.erb +72 -69
  63. data/docs/resources/interface.md.erb +55 -46
  64. data/docs/resources/iptables.md.erb +63 -63
  65. data/docs/resources/json.md.erb +61 -61
  66. data/docs/resources/kernel_module.md.erb +106 -106
  67. data/docs/resources/kernel_parameter.md.erb +58 -58
  68. data/docs/resources/key_rsa.md.erb +73 -73
  69. data/docs/resources/launchd_service.md.erb +56 -56
  70. data/docs/resources/limits_conf.md.erb +66 -66
  71. data/docs/resources/login_def.md.erb +62 -62
  72. data/docs/resources/mount.md.erb +68 -68
  73. data/docs/resources/mssql_session.md.erb +59 -59
  74. data/docs/resources/mysql_conf.md.erb +98 -98
  75. data/docs/resources/mysql_session.md.erb +73 -73
  76. data/docs/resources/nginx.md.erb +78 -78
  77. data/docs/resources/nginx_conf.md.erb +127 -127
  78. data/docs/resources/npm.md.erb +59 -59
  79. data/docs/resources/ntp_conf.md.erb +59 -59
  80. data/docs/resources/oneget.md.erb +52 -52
  81. data/docs/resources/oracledb_session.md.erb +51 -51
  82. data/docs/resources/os.md.erb +140 -140
  83. data/docs/resources/os_env.md.erb +77 -77
  84. data/docs/resources/package.md.erb +119 -119
  85. data/docs/resources/packages.md.erb +66 -66
  86. data/docs/resources/parse_config.md.erb +102 -102
  87. data/docs/resources/parse_config_file.md.erb +137 -137
  88. data/docs/resources/passwd.md.erb +140 -140
  89. data/docs/resources/pip.md.erb +66 -66
  90. data/docs/resources/port.md.erb +136 -136
  91. data/docs/resources/postgres_conf.md.erb +78 -78
  92. data/docs/resources/postgres_hba_conf.md.erb +92 -92
  93. data/docs/resources/postgres_ident_conf.md.erb +75 -75
  94. data/docs/resources/postgres_session.md.erb +68 -68
  95. data/docs/resources/powershell.md.erb +101 -101
  96. data/docs/resources/processes.md.erb +107 -107
  97. data/docs/resources/rabbitmq_config.md.erb +40 -40
  98. data/docs/resources/registry_key.md.erb +157 -157
  99. data/docs/resources/runit_service.md.erb +56 -56
  100. data/docs/resources/security_policy.md.erb +46 -46
  101. data/docs/resources/service.md.erb +120 -120
  102. data/docs/resources/shadow.md.erb +143 -143
  103. data/docs/resources/ssh_config.md.erb +79 -79
  104. data/docs/resources/sshd_config.md.erb +82 -82
  105. data/docs/resources/ssl.md.erb +118 -118
  106. data/docs/resources/sys_info.md.erb +41 -41
  107. data/docs/resources/systemd_service.md.erb +56 -56
  108. data/docs/resources/sysv_service.md.erb +56 -56
  109. data/docs/resources/upstart_service.md.erb +56 -56
  110. data/docs/resources/user.md.erb +139 -139
  111. data/docs/resources/users.md.erb +126 -126
  112. data/docs/resources/vbscript.md.erb +54 -54
  113. data/docs/resources/virtualization.md.erb +56 -56
  114. data/docs/resources/windows_feature.md.erb +46 -46
  115. data/docs/resources/windows_hotfix.md.erb +52 -52
  116. data/docs/resources/windows_task.md.erb +89 -89
  117. data/docs/resources/wmi.md.erb +80 -80
  118. data/docs/resources/x509_certificate.md.erb +150 -150
  119. data/docs/resources/xinetd_conf.md.erb +155 -155
  120. data/docs/resources/xml.md.erb +84 -84
  121. data/docs/resources/yaml.md.erb +68 -68
  122. data/docs/resources/yum.md.erb +97 -97
  123. data/docs/resources/zfs_dataset.md.erb +52 -52
  124. data/docs/resources/zfs_pool.md.erb +46 -46
  125. data/docs/ruby_usage.md +203 -203
  126. data/docs/shared/matcher_be.md.erb +1 -1
  127. data/docs/shared/matcher_cmp.md.erb +43 -43
  128. data/docs/shared/matcher_eq.md.erb +3 -3
  129. data/docs/shared/matcher_include.md.erb +1 -1
  130. data/docs/shared/matcher_match.md.erb +1 -1
  131. data/docs/shell.md +172 -172
  132. data/examples/README.md +8 -8
  133. data/examples/inheritance/README.md +65 -65
  134. data/examples/inheritance/controls/example.rb +14 -14
  135. data/examples/inheritance/inspec.yml +15 -15
  136. data/examples/kitchen-ansible/.kitchen.yml +25 -25
  137. data/examples/kitchen-ansible/Gemfile +19 -19
  138. data/examples/kitchen-ansible/README.md +53 -53
  139. data/examples/kitchen-ansible/files/nginx.repo +6 -6
  140. data/examples/kitchen-ansible/tasks/main.yml +16 -16
  141. data/examples/kitchen-ansible/test/integration/default/default.yml +5 -5
  142. data/examples/kitchen-ansible/test/integration/default/web_spec.rb +28 -28
  143. data/examples/kitchen-chef/.kitchen.yml +20 -20
  144. data/examples/kitchen-chef/Berksfile +3 -3
  145. data/examples/kitchen-chef/Gemfile +19 -19
  146. data/examples/kitchen-chef/README.md +27 -27
  147. data/examples/kitchen-chef/metadata.rb +7 -7
  148. data/examples/kitchen-chef/recipes/default.rb +6 -6
  149. data/examples/kitchen-chef/recipes/nginx.rb +30 -30
  150. data/examples/kitchen-chef/test/integration/default/web_spec.rb +28 -28
  151. data/examples/kitchen-puppet/.kitchen.yml +22 -22
  152. data/examples/kitchen-puppet/Gemfile +20 -20
  153. data/examples/kitchen-puppet/Puppetfile +25 -25
  154. data/examples/kitchen-puppet/README.md +53 -53
  155. data/examples/kitchen-puppet/manifests/site.pp +33 -33
  156. data/examples/kitchen-puppet/metadata.json +11 -11
  157. data/examples/kitchen-puppet/test/integration/default/web_spec.rb +28 -28
  158. data/examples/meta-profile/README.md +37 -37
  159. data/examples/meta-profile/controls/example.rb +13 -13
  160. data/examples/meta-profile/inspec.yml +13 -13
  161. data/examples/profile-attribute.yml +2 -2
  162. data/examples/profile-attribute/README.md +14 -14
  163. data/examples/profile-attribute/controls/example.rb +11 -11
  164. data/examples/profile-attribute/inspec.yml +8 -8
  165. data/examples/profile-sensitive/README.md +29 -29
  166. data/examples/profile-sensitive/controls/sensitive-failures.rb +9 -9
  167. data/examples/profile-sensitive/controls/sensitive.rb +9 -9
  168. data/examples/profile-sensitive/inspec.yml +8 -8
  169. data/examples/profile/README.md +48 -48
  170. data/examples/profile/controls/example.rb +23 -23
  171. data/examples/profile/controls/gordon.rb +36 -36
  172. data/examples/profile/controls/meta.rb +34 -34
  173. data/examples/profile/inspec.yml +10 -10
  174. data/examples/profile/libraries/gordon_config.rb +53 -53
  175. data/inspec.gemspec +47 -47
  176. data/lib/bundles/README.md +3 -3
  177. data/lib/bundles/inspec-artifact.rb +7 -7
  178. data/lib/bundles/inspec-artifact/README.md +1 -1
  179. data/lib/bundles/inspec-artifact/cli.rb +277 -277
  180. data/lib/bundles/inspec-compliance.rb +16 -16
  181. data/lib/bundles/inspec-compliance/.kitchen.yml +20 -20
  182. data/lib/bundles/inspec-compliance/README.md +185 -185
  183. data/lib/bundles/inspec-compliance/api.rb +316 -316
  184. data/lib/bundles/inspec-compliance/api/login.rb +152 -152
  185. data/lib/bundles/inspec-compliance/bootstrap.sh +41 -41
  186. data/lib/bundles/inspec-compliance/cli.rb +277 -277
  187. data/lib/bundles/inspec-compliance/configuration.rb +103 -103
  188. data/lib/bundles/inspec-compliance/http.rb +86 -86
  189. data/lib/bundles/inspec-compliance/support.rb +36 -36
  190. data/lib/bundles/inspec-compliance/target.rb +98 -98
  191. data/lib/bundles/inspec-compliance/test/integration/default/cli.rb +93 -93
  192. data/lib/bundles/inspec-habitat.rb +12 -12
  193. data/lib/bundles/inspec-habitat/cli.rb +36 -36
  194. data/lib/bundles/inspec-habitat/log.rb +10 -10
  195. data/lib/bundles/inspec-habitat/profile.rb +390 -390
  196. data/lib/bundles/inspec-init.rb +8 -8
  197. data/lib/bundles/inspec-init/README.md +31 -31
  198. data/lib/bundles/inspec-init/cli.rb +97 -97
  199. data/lib/bundles/inspec-init/templates/profile/README.md +3 -3
  200. data/lib/bundles/inspec-init/templates/profile/controls/example.rb +19 -19
  201. data/lib/bundles/inspec-init/templates/profile/inspec.yml +8 -8
  202. data/lib/bundles/inspec-supermarket.rb +13 -13
  203. data/lib/bundles/inspec-supermarket/README.md +45 -45
  204. data/lib/bundles/inspec-supermarket/api.rb +84 -84
  205. data/lib/bundles/inspec-supermarket/cli.rb +65 -65
  206. data/lib/bundles/inspec-supermarket/target.rb +34 -34
  207. data/lib/fetchers/git.rb +163 -163
  208. data/lib/fetchers/local.rb +74 -74
  209. data/lib/fetchers/mock.rb +35 -35
  210. data/lib/fetchers/url.rb +204 -204
  211. data/lib/inspec.rb +24 -24
  212. data/lib/inspec/archive/tar.rb +29 -29
  213. data/lib/inspec/archive/zip.rb +19 -19
  214. data/lib/inspec/backend.rb +92 -92
  215. data/lib/inspec/base_cli.rb +324 -322
  216. data/lib/inspec/cached_fetcher.rb +66 -66
  217. data/lib/inspec/cli.rb +298 -298
  218. data/lib/inspec/completions/bash.sh.erb +45 -45
  219. data/lib/inspec/completions/fish.sh.erb +34 -34
  220. data/lib/inspec/completions/zsh.sh.erb +61 -61
  221. data/lib/inspec/control_eval_context.rb +179 -179
  222. data/lib/inspec/dependencies/cache.rb +72 -72
  223. data/lib/inspec/dependencies/dependency_set.rb +92 -92
  224. data/lib/inspec/dependencies/lockfile.rb +115 -115
  225. data/lib/inspec/dependencies/requirement.rb +123 -123
  226. data/lib/inspec/dependencies/resolver.rb +86 -86
  227. data/lib/inspec/describe.rb +27 -27
  228. data/lib/inspec/dsl.rb +66 -66
  229. data/lib/inspec/dsl_shared.rb +33 -33
  230. data/lib/inspec/env_printer.rb +157 -157
  231. data/lib/inspec/errors.rb +13 -13
  232. data/lib/inspec/exceptions.rb +12 -12
  233. data/lib/inspec/expect.rb +45 -45
  234. data/lib/inspec/fetcher.rb +45 -45
  235. data/lib/inspec/file_provider.rb +275 -275
  236. data/lib/inspec/formatters.rb +3 -3
  237. data/lib/inspec/formatters/base.rb +208 -208
  238. data/lib/inspec/formatters/json_rspec.rb +20 -20
  239. data/lib/inspec/formatters/show_progress.rb +12 -12
  240. data/lib/inspec/library_eval_context.rb +58 -58
  241. data/lib/inspec/log.rb +11 -11
  242. data/lib/inspec/metadata.rb +253 -253
  243. data/lib/inspec/method_source.rb +24 -24
  244. data/lib/inspec/objects.rb +14 -14
  245. data/lib/inspec/objects/attribute.rb +65 -65
  246. data/lib/inspec/objects/control.rb +61 -61
  247. data/lib/inspec/objects/describe.rb +92 -92
  248. data/lib/inspec/objects/each_loop.rb +36 -36
  249. data/lib/inspec/objects/list.rb +15 -15
  250. data/lib/inspec/objects/or_test.rb +40 -40
  251. data/lib/inspec/objects/ruby_helper.rb +15 -15
  252. data/lib/inspec/objects/tag.rb +27 -27
  253. data/lib/inspec/objects/test.rb +87 -87
  254. data/lib/inspec/objects/value.rb +27 -27
  255. data/lib/inspec/plugins.rb +60 -60
  256. data/lib/inspec/plugins/cli.rb +24 -24
  257. data/lib/inspec/plugins/fetcher.rb +86 -86
  258. data/lib/inspec/plugins/resource.rb +132 -132
  259. data/lib/inspec/plugins/secret.rb +15 -15
  260. data/lib/inspec/plugins/source_reader.rb +40 -40
  261. data/lib/inspec/polyfill.rb +12 -12
  262. data/lib/inspec/profile.rb +510 -510
  263. data/lib/inspec/profile_context.rb +207 -207
  264. data/lib/inspec/profile_vendor.rb +66 -66
  265. data/lib/inspec/reporters.rb +50 -33
  266. data/lib/inspec/reporters/base.rb +24 -23
  267. data/lib/inspec/reporters/cli.rb +395 -395
  268. data/lib/inspec/reporters/json.rb +134 -132
  269. data/lib/inspec/reporters/json_min.rb +48 -44
  270. data/lib/inspec/reporters/junit.rb +77 -77
  271. data/lib/inspec/require_loader.rb +33 -33
  272. data/lib/inspec/resource.rb +176 -176
  273. data/lib/inspec/rule.rb +266 -266
  274. data/lib/inspec/runner.rb +340 -337
  275. data/lib/inspec/runner_mock.rb +41 -41
  276. data/lib/inspec/runner_rspec.rb +163 -185
  277. data/lib/inspec/runtime_profile.rb +26 -26
  278. data/lib/inspec/schema.rb +186 -186
  279. data/lib/inspec/secrets.rb +19 -19
  280. data/lib/inspec/secrets/yaml.rb +30 -30
  281. data/lib/inspec/shell.rb +223 -223
  282. data/lib/inspec/shell_detector.rb +90 -90
  283. data/lib/inspec/source_reader.rb +29 -29
  284. data/lib/inspec/version.rb +8 -8
  285. data/lib/matchers/matchers.rb +397 -397
  286. data/lib/resources/aide_conf.rb +160 -160
  287. data/lib/resources/apache.rb +49 -49
  288. data/lib/resources/apache_conf.rb +158 -158
  289. data/lib/resources/apt.rb +150 -150
  290. data/lib/resources/audit_policy.rb +64 -64
  291. data/lib/resources/auditd.rb +233 -233
  292. data/lib/resources/auditd_conf.rb +56 -56
  293. data/lib/resources/auditd_rules.rb +205 -205
  294. data/lib/resources/bash.rb +36 -36
  295. data/lib/resources/bond.rb +69 -69
  296. data/lib/resources/bridge.rb +123 -123
  297. data/lib/resources/command.rb +69 -69
  298. data/lib/resources/cpan.rb +60 -60
  299. data/lib/resources/cran.rb +66 -66
  300. data/lib/resources/crontab.rb +169 -169
  301. data/lib/resources/csv.rb +58 -58
  302. data/lib/resources/dh_params.rb +83 -83
  303. data/lib/resources/directory.rb +25 -25
  304. data/lib/resources/docker.rb +239 -239
  305. data/lib/resources/docker_container.rb +92 -92
  306. data/lib/resources/docker_image.rb +86 -86
  307. data/lib/resources/docker_object.rb +57 -57
  308. data/lib/resources/docker_service.rb +94 -94
  309. data/lib/resources/elasticsearch.rb +168 -168
  310. data/lib/resources/etc_fstab.rb +102 -102
  311. data/lib/resources/etc_group.rb +157 -157
  312. data/lib/resources/etc_hosts.rb +81 -81
  313. data/lib/resources/etc_hosts_allow_deny.rb +122 -122
  314. data/lib/resources/file.rb +298 -298
  315. data/lib/resources/filesystem.rb +31 -31
  316. data/lib/resources/firewalld.rb +144 -144
  317. data/lib/resources/gem.rb +71 -71
  318. data/lib/resources/groups.rb +213 -213
  319. data/lib/resources/grub_conf.rb +237 -237
  320. data/lib/resources/host.rb +300 -300
  321. data/lib/resources/http.rb +252 -252
  322. data/lib/resources/iis_app.rb +103 -103
  323. data/lib/resources/iis_site.rb +147 -147
  324. data/lib/resources/inetd_conf.rb +63 -63
  325. data/lib/resources/ini.rb +29 -29
  326. data/lib/resources/interface.rb +130 -130
  327. data/lib/resources/iptables.rb +70 -70
  328. data/lib/resources/json.rb +115 -115
  329. data/lib/resources/kernel_module.rb +110 -110
  330. data/lib/resources/kernel_parameter.rb +58 -58
  331. data/lib/resources/key_rsa.rb +67 -67
  332. data/lib/resources/limits_conf.rb +56 -56
  333. data/lib/resources/login_def.rb +67 -67
  334. data/lib/resources/mount.rb +90 -90
  335. data/lib/resources/mssql_session.rb +103 -103
  336. data/lib/resources/mysql.rb +82 -82
  337. data/lib/resources/mysql_conf.rb +133 -133
  338. data/lib/resources/mysql_session.rb +72 -72
  339. data/lib/resources/nginx.rb +97 -97
  340. data/lib/resources/nginx_conf.rb +228 -228
  341. data/lib/resources/npm.rb +48 -48
  342. data/lib/resources/ntp_conf.rb +59 -59
  343. data/lib/resources/oneget.rb +72 -72
  344. data/lib/resources/oracledb_session.rb +140 -140
  345. data/lib/resources/os.rb +46 -46
  346. data/lib/resources/os_env.rb +76 -76
  347. data/lib/resources/package.rb +357 -357
  348. data/lib/resources/packages.rb +112 -112
  349. data/lib/resources/parse_config.rb +116 -116
  350. data/lib/resources/passwd.rb +96 -96
  351. data/lib/resources/pip.rb +89 -89
  352. data/lib/resources/platform.rb +112 -112
  353. data/lib/resources/port.rb +771 -771
  354. data/lib/resources/postgres.rb +132 -132
  355. data/lib/resources/postgres_conf.rb +122 -122
  356. data/lib/resources/postgres_hba_conf.rb +101 -101
  357. data/lib/resources/postgres_ident_conf.rb +79 -79
  358. data/lib/resources/postgres_session.rb +72 -72
  359. data/lib/resources/powershell.rb +58 -58
  360. data/lib/resources/processes.rb +204 -204
  361. data/lib/resources/rabbitmq_conf.rb +53 -53
  362. data/lib/resources/registry_key.rb +296 -296
  363. data/lib/resources/security_policy.rb +181 -181
  364. data/lib/resources/service.rb +784 -784
  365. data/lib/resources/shadow.rb +141 -141
  366. data/lib/resources/ssh_conf.rb +102 -102
  367. data/lib/resources/ssl.rb +99 -99
  368. data/lib/resources/sys_info.rb +26 -26
  369. data/lib/resources/toml.rb +32 -32
  370. data/lib/resources/users.rb +652 -652
  371. data/lib/resources/vbscript.rb +70 -70
  372. data/lib/resources/virtualization.rb +251 -251
  373. data/lib/resources/windows_feature.rb +85 -85
  374. data/lib/resources/windows_hotfix.rb +35 -35
  375. data/lib/resources/windows_task.rb +106 -106
  376. data/lib/resources/wmi.rb +114 -114
  377. data/lib/resources/x509_certificate.rb +143 -143
  378. data/lib/resources/xinetd.rb +112 -112
  379. data/lib/resources/xml.rb +45 -45
  380. data/lib/resources/yaml.rb +45 -45
  381. data/lib/resources/yum.rb +181 -181
  382. data/lib/resources/zfs_dataset.rb +60 -60
  383. data/lib/resources/zfs_pool.rb +49 -49
  384. data/lib/source_readers/flat.rb +39 -39
  385. data/lib/source_readers/inspec.rb +75 -75
  386. data/lib/utils/command_wrapper.rb +27 -27
  387. data/lib/utils/convert.rb +12 -12
  388. data/lib/utils/database_helpers.rb +77 -77
  389. data/lib/utils/erlang_parser.rb +192 -192
  390. data/lib/utils/filter.rb +272 -272
  391. data/lib/utils/filter_array.rb +27 -27
  392. data/lib/utils/find_files.rb +44 -44
  393. data/lib/utils/hash.rb +41 -41
  394. data/lib/utils/json_log.rb +18 -18
  395. data/lib/utils/latest_version.rb +22 -22
  396. data/lib/utils/modulator.rb +12 -12
  397. data/lib/utils/nginx_parser.rb +85 -85
  398. data/lib/utils/object_traversal.rb +49 -49
  399. data/lib/utils/parser.rb +274 -274
  400. data/lib/utils/plugin_registry.rb +93 -93
  401. data/lib/utils/simpleconfig.rb +132 -132
  402. data/lib/utils/spdx.rb +13 -13
  403. data/lib/utils/spdx.txt +343 -343
  404. metadata +2 -2
@@ -1,49 +1,49 @@
1
- ---
2
- title: About kitchen-inspec
3
- ---
4
-
5
- # kitchen-inspec
6
-
7
- Use InSpec as a Kitchen verifier with `kitchen-inspec`.
8
-
9
- Add the InSpec verifier to the `.kitchen.yml` file:
10
-
11
- verifier:
12
- name: inspec
13
-
14
- Use a compliance profile from the Chef Compliance server:
15
-
16
- suites:
17
- - name: compliance
18
- run_list:
19
- - recipe[ssh-hardening::default]
20
- verifier:
21
- inspec_tests:
22
- - compliance://base/ssh
23
-
24
- and then run the following command:
25
-
26
- $ inspec compliance login https://compliance.test --user admin --insecure --token ''
27
-
28
- where `--insecure` is required when using self-signed certificates.
29
-
30
- Use a compliance profile from the Chef Supermarket:
31
-
32
- suites:
33
- - name: supermarket
34
- run_list:
35
- - recipe[ssh-hardening::default]
36
- verifier:
37
- inspec_tests:
38
- - supermarket://dev-sec/ssh-baseline
39
-
40
- Use InSpec tests from the local file system:
41
-
42
- suites:
43
- - name: local
44
- run_list:
45
- - recipe[my_cookbook::default]
46
- verifier:
47
- inspec_tests:
48
- - test/integration/default
49
-
1
+ ---
2
+ title: About kitchen-inspec
3
+ ---
4
+
5
+ # kitchen-inspec
6
+
7
+ Use InSpec as a Kitchen verifier with `kitchen-inspec`.
8
+
9
+ Add the InSpec verifier to the `.kitchen.yml` file:
10
+
11
+ verifier:
12
+ name: inspec
13
+
14
+ Use a compliance profile from the Chef Compliance server:
15
+
16
+ suites:
17
+ - name: compliance
18
+ run_list:
19
+ - recipe[ssh-hardening::default]
20
+ verifier:
21
+ inspec_tests:
22
+ - compliance://base/ssh
23
+
24
+ and then run the following command:
25
+
26
+ $ inspec compliance login https://compliance.test --user admin --insecure --token ''
27
+
28
+ where `--insecure` is required when using self-signed certificates.
29
+
30
+ Use a compliance profile from the Chef Supermarket:
31
+
32
+ suites:
33
+ - name: supermarket
34
+ run_list:
35
+ - recipe[ssh-hardening::default]
36
+ verifier:
37
+ inspec_tests:
38
+ - supermarket://dev-sec/ssh-baseline
39
+
40
+ Use InSpec tests from the local file system:
41
+
42
+ suites:
43
+ - name: local
44
+ run_list:
45
+ - recipe[my_cookbook::default]
46
+ verifier:
47
+ inspec_tests:
48
+ - test/integration/default
49
+
@@ -1,370 +1,370 @@
1
- ---
2
- title: About InSpec Profiles
3
- ---
4
-
5
- # InSpec Profiles
6
-
7
- InSpec supports the creation of complex test and compliance profiles, which organize controls to support dependency management and code reuse. Each profile is a standalone structure with its own distribution and execution flow.
8
-
9
- # Profile Structure
10
-
11
- A profile should have the following structure::
12
-
13
- examples/profile
14
- ├── README.md
15
- ├── controls
16
- │ ├── example.rb
17
- │ └── control_etc.rb
18
- ├── libraries
19
- │ └── extension.rb
20
- |── files
21
- │ └── extras.conf
22
- └── inspec.yml
23
-
24
- where:
25
-
26
- * `inspec.yml` includes the profile description (required)
27
- * `controls` is the directory in which all tests are located (required)
28
- * `libraries` is the directory in which all InSpec resource extensions are located (optional)
29
- * `files` is the directory with additional files that a profile can access (optional)
30
- * `README.md` should be used to explain the profile, its scope, and usage
31
-
32
- See a complete example profile in the InSpec open source repository: https://github.com/chef/inspec/tree/master/examples/profile
33
-
34
- ## inspec.yml
35
-
36
- Each profile must have an `inspec.yml` file that defines the following information:
37
-
38
- * Use `name` to specify a unique name for the profile. Required.
39
- * Use `title` to specify a human-readable name for the profile.
40
- * Use `maintainer` to specify the profile maintainer.
41
- * Use `copyright` to specify the copyright holder.
42
- * Use `copyright_email` to specify support contact information for the profile, typically an email address.
43
- * Use `license` to specify the license for the profile.
44
- * Use `summary` to specify a one line summary for the profile.
45
- * Use `description` to specify a multiple line description of the profile.
46
- * Use `version` to specify the profile version.
47
- * Use `supports` to specify a list of supported platform targets.
48
- * Use `depends` to define a list of profiles on which this profile depends.
49
-
50
- `name` is required; all other profile settings are optional. For example:
51
-
52
- name: ssh
53
- title: Basic SSH
54
- maintainer: Chef Software, Inc.
55
- copyright: Chef Software, Inc.
56
- copyright_email: support@chef.io
57
- license: Proprietary, All rights reserved
58
- summary: Verify that SSH Server and SSH Client are configured securely
59
- version: 1.0.0
60
- supports:
61
- - os-family: linux
62
- depends:
63
- - name: profile
64
- path: ../path/to/profile
65
-
66
- ## Verify Profiles
67
-
68
- Use the `inspec check` command to verify the implementation of a profile:
69
-
70
- $ inspec check examples/profile
71
-
72
- # Platform Support
73
-
74
- Use the `supports` setting in the `inspec.yml` file to specify one (or more) platforms for which a profile is targeting. The list of supported platforms may contain simple names, names and versions, or detailed flags, and may be combined arbitrarily. For example, to target anything running Debian Linux:
75
-
76
- name: ssh
77
- supports:
78
- - os-name: debian
79
-
80
- and to target only Ubuntu version 14.04
81
-
82
- name: ssh
83
- supports:
84
- - os-name: ubuntu
85
- release: 14.04
86
-
87
- and to target the entire RedHat platform (including CentOS and Oracle Linux):
88
-
89
- name: ssh
90
- supports:
91
- - os-family: redhat
92
-
93
- and to target anything running on Amazon AWS:
94
-
95
- name: ssh
96
- supports:
97
- - platform: aws
98
-
99
- and to target all of these examples in a single `inspec.yml` file:
100
-
101
- name: ssh
102
- supports:
103
- - os-name: debian
104
- - os-name: ubuntu
105
- release: 14.04
106
- - os-family: redhat
107
- - platform: aws
108
-
109
-
110
- # Profile Dependencies
111
-
112
- An InSpec profile can bring in the controls and custom resources from another InSpec profile. Additionally, when inheriting the controls of another profile, a profile can skip or even modify those included controls.
113
-
114
- ## Defining the Dependencies
115
-
116
- Before a profile can use controls from another profile, the to-be-included profile needs to be specified in the including profile’s `inspec.yml` file in the `depends` section. For each profile to be included, a location for the profile from where to be fetched and a name for the profile should be included. For example:
117
-
118
- depends:
119
- - name: linux-baseline
120
- url: https://github.com/dev-sec/linux-baseline/archive/master.tar.gz
121
- - name: ssh-baseline
122
- url: https://github.com/dev-sec/ssh-baseline/archive/master.tar.gz
123
-
124
- InSpec supports a number of dependency sources.
125
-
126
- ### path
127
-
128
- The `path` setting defines a profile that is located on disk. This setting is typically used during development of profiles and when debugging profiles.
129
-
130
- depends:
131
- - name: my-profile
132
- path: /absolute/path
133
- - name: another
134
- path: ../relative/path
135
-
136
- ### url
137
-
138
- The `url` setting specifies a profile that is located at an HTTP- or HTTPS-based URL. The profile must be accessible via a HTTP GET operation and must be a valid profile archive (zip, tar, or tar.gz format).
139
-
140
- depends:
141
- - name: my-profile
142
- url: https://my.domain/path/to/profile.tgz
143
- - name: profile-via-git
144
- url: https://github.com/myusername/myprofile-repo/archive/master.tar.gz
145
-
146
- ### git
147
-
148
- A `git` setting specifies a profile that is located in a git repository, with optional settings for branch, tag, commit, and version. The source location is translated into a URL upon resolution. This type of dependency supports version constraints via semantic versioning as git tags.
149
-
150
- For example:
151
-
152
- depends:
153
- - name: git-profile
154
- git: http://url/to/repo
155
- branch: desired_branch
156
- tag: desired_version
157
- commit: pinned_commit
158
- version: semver_via_tags
159
-
160
- ### supermarket
161
-
162
- A `supermarket` setting specifies a profile that is located in a cookbook hosted on Chef Supermarket. The source location is translated into a URL upon resolution.
163
-
164
- For example:
165
-
166
- depends:
167
- - name: supermarket-profile
168
- supermarket: supermarket-username/supermarket-profile
169
-
170
- Available Supermarket profiles can be listed with `inspec supermarket profiles`.
171
-
172
- ### compliance
173
-
174
- A `compliance` setting specifies a profile that is located on the Chef Automate or Chef Compliance server.
175
-
176
- For example:
177
-
178
- depends:
179
- - name: linux
180
- compliance: base/linux
181
-
182
- ## Vendoring Dependencies
183
-
184
- When you execute a local profile, the `inspec.yml` file will be read in order to source any profile dependencies. It will then cache the dependencies locally and generate an `inspec.lock` file.
185
-
186
- If you add or update dependencies in `inspec.yml`, dependencies may be re-vendored and the lockfile updated with `inspec vendor --overwrite`
187
-
188
- ## Using Controls from an Included Profile
189
-
190
- Once defined in the `inspec.yml`, controls from the included profiles can be used! Let’s look at some examples.
191
-
192
- ### Including All Controls from a Profile
193
-
194
- With the `include_controls` command in a profile, all controls from the named profile will be executed every time the including profile is executed.
195
-
196
- ![Include Controls](/images/profile_inheritance/include_controls.png)
197
-
198
- In the example above, every time `my-app-profile` is executed, all the controls from `my-baseline` are also executed. Therefore, the following controls would be executed:
199
-
200
- * myapp-1
201
- * myapp-2
202
- * myapp-3
203
- * baseline-1
204
- * baseline-2
205
-
206
- This is a great reminder that having a good naming convention for your controls is helpful to avoid confusion when
207
- including controls from other profiles!
208
-
209
- ### Skipping a Control from a Profile
210
-
211
- What if one of the controls from the included profile does not apply to your environment? Luckily, it is not necessary to maintain a slightly-modified copy of the included profile just to delete a control. The `skip_control` command tells InSpec to not run a particular control.
212
-
213
- ![Include Controls with Skip](/images/profile_inheritance/include_controls_with_skip.png)
214
-
215
- In the above example, all controls from `my-app-profile` and `my-baseline` profile will be executed every time `my-app-profile` is executed **except** for control `baseline-2` from the `my-baseline` profile.
216
-
217
- ### Modifying a Control
218
-
219
- Let's say a particular control from an included profile should still be run, but the impact isn't appropriate? Perhaps the test should still run, but if it fails, it should be treated as low severity instead of high severity?
220
-
221
- When a control is included, it can also be modified!
222
-
223
- ![Include Controls with Modification](/images/profile_inheritance/include_controls_with_mod.png)
224
-
225
- In the above example, all controls from `my-baseline` are executed along with all the controls from the including profile, `my-app-profile`. However, should control `baseline-1` fail, it will be raised with an impact of `0.5` instead of the originally-intended impact of `1.0`.
226
-
227
- ### Selectively Including Controls from a Profile
228
-
229
- If there are only a handful of controls that should be executed from an included profile, it's not necessarily to skip all the unneeded controls, or worse, copy/paste those controls bit-for-bit into your profile. Instead, use the `require_controls` command.
230
-
231
- ![Require Controls](/images/profile_inheritance/require_controls.png)
232
-
233
- Whenever `my-app-profile` is executed, in addition to its own controls, it will run only the controls specified in the `require_controls` block. In the case, the following controls would be executed:
234
-
235
- * myapp-1
236
- * myapp-2
237
- * myapp-3
238
- * baseline-2
239
- * baseline-4
240
-
241
- Controls `baseline-1`, `baseline-3`, and `baseline-5` would not be run, just as if they were manually skipped. This method of including specific controls ensures only the controls specified are executed; if new controls are added to a later version of `my-baseline`, they would not be run.
242
-
243
- And, just the way its possible to modify controls when using `include_controls`, controls can be modified as well.
244
-
245
- ![Require Controls with Modification](/images/profile_inheritance/require_controls_with_mod.png)
246
-
247
- As with the prior example, only `baseline-2` and `baseline-4` are executed, but if `baseline-2` fails, it will report with an impact of `0.5` instead of the originally-intended `1.0` impact.
248
-
249
- ## Using Resources from an Included Profile
250
-
251
- By default, all of the custom resources from a listed dependency are available
252
- for use in your profile. If two of your dependencies provide a resource with
253
- the same name, you can use the `require_resource` DSL function to
254
- disambiguate the two:
255
-
256
- require_resource(profile: 'my_dep', resource: 'my_res',
257
- as: 'my_res2')
258
-
259
- This will allow you to reference the resource `my_res` from the
260
- profile `my_dep` using the name `my_res2`.
261
-
262
- # Profile Attributes
263
-
264
- Attributes may be used in profiles to define secrets, such as user names and passwords, that should not otherwise be stored in plain-text in a cookbook. First specify a variable in the control for each secret, then add the secret to a Yaml file located on the local machine, and then run `inspec exec` and specify the path to that Yaml file using the `--attrs` attribute.
265
-
266
- For example, a control:
267
-
268
- # define these attributes on the top-level of your file and re-use them across all tests!
269
- val_user = attribute('user', default: 'alice', description: 'An identification for the user')
270
- val_password = attribute('password', description: 'A value for the password')
271
-
272
- control 'system-users' do
273
- impact 0.8
274
- desc '
275
- This test assures that the user "Bob" has a user installed on the system, along with a
276
- specified password.
277
- '
278
-
279
- describe val_user do
280
- it { should eq 'bob' }
281
- end
282
-
283
- describe val_password do
284
- it { should eq 'secret' }
285
- end
286
- end
287
-
288
- And a Yaml file named `profile-attribute.yml`:
289
-
290
- user: bob
291
- password: secret
292
-
293
- The following command runs the tests and applies the secrets specified in `profile-attribute.yml`:
294
-
295
- $ inspec exec examples/profile-attribute --attrs examples/profile-attribute.yml
296
-
297
- See the full example in the InSpec open source repository: https://github.com/chef/inspec/tree/master/examples/profile-attribute
298
-
299
- # Profile files
300
-
301
- An InSpec profile may contain additional files that can be accessed during tests. This covers use-cases where e.g. a list of ports is provided to be tested.
302
-
303
- To access these files, they must be stored in the `files` directory at the root of a profile. They are accessed by their name relative to this folder with `inspec.profile.file(...)`.
304
-
305
- Here is an example for reading and testing a list of ports. The folder structure is:
306
-
307
- examples/profile
308
- ├── controls
309
- │ ├── example.rb
310
- |── files
311
- │ └── services.yml
312
- └── inspec.yml
313
-
314
- With `services.yml` containing:
315
-
316
- - service_name: httpd-alpha
317
- port: 80
318
- - service_name: httpd-beta
319
- port: 8080
320
-
321
- The tests in `example.rb` can now access this file:
322
-
323
- my_services = yaml(content: inspec.profile.file('services.yml')).params
324
-
325
- my_services.each do |s|
326
- describe service(s['service_name']) do
327
- it { should be_running }
328
- end
329
-
330
- describe port(s['port']) do
331
- it { should be_listening }
332
- end
333
- end
334
-
335
- # "should" vs. "expect" syntax
336
-
337
- Users familiar with the RSpec testing framework may know that there are two ways to write test statements: `should` and `expect`. The RSpec community decided that `expect` is the preferred syntax. However, InSpec recommends the `should` syntax as it tends to read more easily to those users who are not as technical.
338
-
339
- InSpec will continue to support both methods of writing tests. Consider this `file` test:
340
-
341
- describe file('/tmp/test.txt') do
342
- it { should be_file }
343
- end
344
-
345
- This can be re-written with `expect` syntax
346
-
347
- describe file('/tmp/test.txt') do
348
- it 'should be a file' do
349
- expect(subject).to(be_file)
350
- end
351
- end
352
-
353
- The output of both of the above examples looks like this:
354
-
355
- File /tmp/test.txt
356
- ✔ should be a file
357
-
358
- In addition, you can make use of the `subject` keyword to further control your output if you choose:
359
-
360
- describe 'test file' do
361
- subject { file('/tmp/test.txt') }
362
- it 'should be a file' do
363
- expect(subject).to(be_file)
364
- end
365
- end
366
-
367
- ... which will render the following output:
368
-
369
- test file
370
- ✔ should be a file
1
+ ---
2
+ title: About InSpec Profiles
3
+ ---
4
+
5
+ # InSpec Profiles
6
+
7
+ InSpec supports the creation of complex test and compliance profiles, which organize controls to support dependency management and code reuse. Each profile is a standalone structure with its own distribution and execution flow.
8
+
9
+ # Profile Structure
10
+
11
+ A profile should have the following structure::
12
+
13
+ examples/profile
14
+ ├── README.md
15
+ ├── controls
16
+ │ ├── example.rb
17
+ │ └── control_etc.rb
18
+ ├── libraries
19
+ │ └── extension.rb
20
+ |── files
21
+ │ └── extras.conf
22
+ └── inspec.yml
23
+
24
+ where:
25
+
26
+ * `inspec.yml` includes the profile description (required)
27
+ * `controls` is the directory in which all tests are located (required)
28
+ * `libraries` is the directory in which all InSpec resource extensions are located (optional)
29
+ * `files` is the directory with additional files that a profile can access (optional)
30
+ * `README.md` should be used to explain the profile, its scope, and usage
31
+
32
+ See a complete example profile in the InSpec open source repository: https://github.com/chef/inspec/tree/master/examples/profile
33
+
34
+ ## inspec.yml
35
+
36
+ Each profile must have an `inspec.yml` file that defines the following information:
37
+
38
+ * Use `name` to specify a unique name for the profile. Required.
39
+ * Use `title` to specify a human-readable name for the profile.
40
+ * Use `maintainer` to specify the profile maintainer.
41
+ * Use `copyright` to specify the copyright holder.
42
+ * Use `copyright_email` to specify support contact information for the profile, typically an email address.
43
+ * Use `license` to specify the license for the profile.
44
+ * Use `summary` to specify a one line summary for the profile.
45
+ * Use `description` to specify a multiple line description of the profile.
46
+ * Use `version` to specify the profile version.
47
+ * Use `supports` to specify a list of supported platform targets.
48
+ * Use `depends` to define a list of profiles on which this profile depends.
49
+
50
+ `name` is required; all other profile settings are optional. For example:
51
+
52
+ name: ssh
53
+ title: Basic SSH
54
+ maintainer: Chef Software, Inc.
55
+ copyright: Chef Software, Inc.
56
+ copyright_email: support@chef.io
57
+ license: Proprietary, All rights reserved
58
+ summary: Verify that SSH Server and SSH Client are configured securely
59
+ version: 1.0.0
60
+ supports:
61
+ - os-family: linux
62
+ depends:
63
+ - name: profile
64
+ path: ../path/to/profile
65
+
66
+ ## Verify Profiles
67
+
68
+ Use the `inspec check` command to verify the implementation of a profile:
69
+
70
+ $ inspec check examples/profile
71
+
72
+ # Platform Support
73
+
74
+ Use the `supports` setting in the `inspec.yml` file to specify one (or more) platforms for which a profile is targeting. The list of supported platforms may contain simple names, names and versions, or detailed flags, and may be combined arbitrarily. For example, to target anything running Debian Linux:
75
+
76
+ name: ssh
77
+ supports:
78
+ - os-name: debian
79
+
80
+ and to target only Ubuntu version 14.04
81
+
82
+ name: ssh
83
+ supports:
84
+ - os-name: ubuntu
85
+ release: 14.04
86
+
87
+ and to target the entire RedHat platform (including CentOS and Oracle Linux):
88
+
89
+ name: ssh
90
+ supports:
91
+ - os-family: redhat
92
+
93
+ and to target anything running on Amazon AWS:
94
+
95
+ name: ssh
96
+ supports:
97
+ - platform: aws
98
+
99
+ and to target all of these examples in a single `inspec.yml` file:
100
+
101
+ name: ssh
102
+ supports:
103
+ - os-name: debian
104
+ - os-name: ubuntu
105
+ release: 14.04
106
+ - os-family: redhat
107
+ - platform: aws
108
+
109
+
110
+ # Profile Dependencies
111
+
112
+ An InSpec profile can bring in the controls and custom resources from another InSpec profile. Additionally, when inheriting the controls of another profile, a profile can skip or even modify those included controls.
113
+
114
+ ## Defining the Dependencies
115
+
116
+ Before a profile can use controls from another profile, the to-be-included profile needs to be specified in the including profile’s `inspec.yml` file in the `depends` section. For each profile to be included, a location for the profile from where to be fetched and a name for the profile should be included. For example:
117
+
118
+ depends:
119
+ - name: linux-baseline
120
+ url: https://github.com/dev-sec/linux-baseline/archive/master.tar.gz
121
+ - name: ssh-baseline
122
+ url: https://github.com/dev-sec/ssh-baseline/archive/master.tar.gz
123
+
124
+ InSpec supports a number of dependency sources.
125
+
126
+ ### path
127
+
128
+ The `path` setting defines a profile that is located on disk. This setting is typically used during development of profiles and when debugging profiles.
129
+
130
+ depends:
131
+ - name: my-profile
132
+ path: /absolute/path
133
+ - name: another
134
+ path: ../relative/path
135
+
136
+ ### url
137
+
138
+ The `url` setting specifies a profile that is located at an HTTP- or HTTPS-based URL. The profile must be accessible via a HTTP GET operation and must be a valid profile archive (zip, tar, or tar.gz format).
139
+
140
+ depends:
141
+ - name: my-profile
142
+ url: https://my.domain/path/to/profile.tgz
143
+ - name: profile-via-git
144
+ url: https://github.com/myusername/myprofile-repo/archive/master.tar.gz
145
+
146
+ ### git
147
+
148
+ A `git` setting specifies a profile that is located in a git repository, with optional settings for branch, tag, commit, and version. The source location is translated into a URL upon resolution. This type of dependency supports version constraints via semantic versioning as git tags.
149
+
150
+ For example:
151
+
152
+ depends:
153
+ - name: git-profile
154
+ git: http://url/to/repo
155
+ branch: desired_branch
156
+ tag: desired_version
157
+ commit: pinned_commit
158
+ version: semver_via_tags
159
+
160
+ ### supermarket
161
+
162
+ A `supermarket` setting specifies a profile that is located in a cookbook hosted on Chef Supermarket. The source location is translated into a URL upon resolution.
163
+
164
+ For example:
165
+
166
+ depends:
167
+ - name: supermarket-profile
168
+ supermarket: supermarket-username/supermarket-profile
169
+
170
+ Available Supermarket profiles can be listed with `inspec supermarket profiles`.
171
+
172
+ ### compliance
173
+
174
+ A `compliance` setting specifies a profile that is located on the Chef Automate or Chef Compliance server.
175
+
176
+ For example:
177
+
178
+ depends:
179
+ - name: linux
180
+ compliance: base/linux
181
+
182
+ ## Vendoring Dependencies
183
+
184
+ When you execute a local profile, the `inspec.yml` file will be read in order to source any profile dependencies. It will then cache the dependencies locally and generate an `inspec.lock` file.
185
+
186
+ If you add or update dependencies in `inspec.yml`, dependencies may be re-vendored and the lockfile updated with `inspec vendor --overwrite`
187
+
188
+ ## Using Controls from an Included Profile
189
+
190
+ Once defined in the `inspec.yml`, controls from the included profiles can be used! Let’s look at some examples.
191
+
192
+ ### Including All Controls from a Profile
193
+
194
+ With the `include_controls` command in a profile, all controls from the named profile will be executed every time the including profile is executed.
195
+
196
+ ![Include Controls](/images/profile_inheritance/include_controls.png)
197
+
198
+ In the example above, every time `my-app-profile` is executed, all the controls from `my-baseline` are also executed. Therefore, the following controls would be executed:
199
+
200
+ * myapp-1
201
+ * myapp-2
202
+ * myapp-3
203
+ * baseline-1
204
+ * baseline-2
205
+
206
+ This is a great reminder that having a good naming convention for your controls is helpful to avoid confusion when
207
+ including controls from other profiles!
208
+
209
+ ### Skipping a Control from a Profile
210
+
211
+ What if one of the controls from the included profile does not apply to your environment? Luckily, it is not necessary to maintain a slightly-modified copy of the included profile just to delete a control. The `skip_control` command tells InSpec to not run a particular control.
212
+
213
+ ![Include Controls with Skip](/images/profile_inheritance/include_controls_with_skip.png)
214
+
215
+ In the above example, all controls from `my-app-profile` and `my-baseline` profile will be executed every time `my-app-profile` is executed **except** for control `baseline-2` from the `my-baseline` profile.
216
+
217
+ ### Modifying a Control
218
+
219
+ Let's say a particular control from an included profile should still be run, but the impact isn't appropriate? Perhaps the test should still run, but if it fails, it should be treated as low severity instead of high severity?
220
+
221
+ When a control is included, it can also be modified!
222
+
223
+ ![Include Controls with Modification](/images/profile_inheritance/include_controls_with_mod.png)
224
+
225
+ In the above example, all controls from `my-baseline` are executed along with all the controls from the including profile, `my-app-profile`. However, should control `baseline-1` fail, it will be raised with an impact of `0.5` instead of the originally-intended impact of `1.0`.
226
+
227
+ ### Selectively Including Controls from a Profile
228
+
229
+ If there are only a handful of controls that should be executed from an included profile, it's not necessarily to skip all the unneeded controls, or worse, copy/paste those controls bit-for-bit into your profile. Instead, use the `require_controls` command.
230
+
231
+ ![Require Controls](/images/profile_inheritance/require_controls.png)
232
+
233
+ Whenever `my-app-profile` is executed, in addition to its own controls, it will run only the controls specified in the `require_controls` block. In the case, the following controls would be executed:
234
+
235
+ * myapp-1
236
+ * myapp-2
237
+ * myapp-3
238
+ * baseline-2
239
+ * baseline-4
240
+
241
+ Controls `baseline-1`, `baseline-3`, and `baseline-5` would not be run, just as if they were manually skipped. This method of including specific controls ensures only the controls specified are executed; if new controls are added to a later version of `my-baseline`, they would not be run.
242
+
243
+ And, just the way its possible to modify controls when using `include_controls`, controls can be modified as well.
244
+
245
+ ![Require Controls with Modification](/images/profile_inheritance/require_controls_with_mod.png)
246
+
247
+ As with the prior example, only `baseline-2` and `baseline-4` are executed, but if `baseline-2` fails, it will report with an impact of `0.5` instead of the originally-intended `1.0` impact.
248
+
249
+ ## Using Resources from an Included Profile
250
+
251
+ By default, all of the custom resources from a listed dependency are available
252
+ for use in your profile. If two of your dependencies provide a resource with
253
+ the same name, you can use the `require_resource` DSL function to
254
+ disambiguate the two:
255
+
256
+ require_resource(profile: 'my_dep', resource: 'my_res',
257
+ as: 'my_res2')
258
+
259
+ This will allow you to reference the resource `my_res` from the
260
+ profile `my_dep` using the name `my_res2`.
261
+
262
+ # Profile Attributes
263
+
264
+ Attributes may be used in profiles to define secrets, such as user names and passwords, that should not otherwise be stored in plain-text in a cookbook. First specify a variable in the control for each secret, then add the secret to a Yaml file located on the local machine, and then run `inspec exec` and specify the path to that Yaml file using the `--attrs` attribute.
265
+
266
+ For example, a control:
267
+
268
+ # define these attributes on the top-level of your file and re-use them across all tests!
269
+ val_user = attribute('user', default: 'alice', description: 'An identification for the user')
270
+ val_password = attribute('password', description: 'A value for the password')
271
+
272
+ control 'system-users' do
273
+ impact 0.8
274
+ desc '
275
+ This test assures that the user "Bob" has a user installed on the system, along with a
276
+ specified password.
277
+ '
278
+
279
+ describe val_user do
280
+ it { should eq 'bob' }
281
+ end
282
+
283
+ describe val_password do
284
+ it { should eq 'secret' }
285
+ end
286
+ end
287
+
288
+ And a Yaml file named `profile-attribute.yml`:
289
+
290
+ user: bob
291
+ password: secret
292
+
293
+ The following command runs the tests and applies the secrets specified in `profile-attribute.yml`:
294
+
295
+ $ inspec exec examples/profile-attribute --attrs examples/profile-attribute.yml
296
+
297
+ See the full example in the InSpec open source repository: https://github.com/chef/inspec/tree/master/examples/profile-attribute
298
+
299
+ # Profile files
300
+
301
+ An InSpec profile may contain additional files that can be accessed during tests. This covers use-cases where e.g. a list of ports is provided to be tested.
302
+
303
+ To access these files, they must be stored in the `files` directory at the root of a profile. They are accessed by their name relative to this folder with `inspec.profile.file(...)`.
304
+
305
+ Here is an example for reading and testing a list of ports. The folder structure is:
306
+
307
+ examples/profile
308
+ ├── controls
309
+ │ ├── example.rb
310
+ |── files
311
+ │ └── services.yml
312
+ └── inspec.yml
313
+
314
+ With `services.yml` containing:
315
+
316
+ - service_name: httpd-alpha
317
+ port: 80
318
+ - service_name: httpd-beta
319
+ port: 8080
320
+
321
+ The tests in `example.rb` can now access this file:
322
+
323
+ my_services = yaml(content: inspec.profile.file('services.yml')).params
324
+
325
+ my_services.each do |s|
326
+ describe service(s['service_name']) do
327
+ it { should be_running }
328
+ end
329
+
330
+ describe port(s['port']) do
331
+ it { should be_listening }
332
+ end
333
+ end
334
+
335
+ # "should" vs. "expect" syntax
336
+
337
+ Users familiar with the RSpec testing framework may know that there are two ways to write test statements: `should` and `expect`. The RSpec community decided that `expect` is the preferred syntax. However, InSpec recommends the `should` syntax as it tends to read more easily to those users who are not as technical.
338
+
339
+ InSpec will continue to support both methods of writing tests. Consider this `file` test:
340
+
341
+ describe file('/tmp/test.txt') do
342
+ it { should be_file }
343
+ end
344
+
345
+ This can be re-written with `expect` syntax
346
+
347
+ describe file('/tmp/test.txt') do
348
+ it 'should be a file' do
349
+ expect(subject).to(be_file)
350
+ end
351
+ end
352
+
353
+ The output of both of the above examples looks like this:
354
+
355
+ File /tmp/test.txt
356
+ ✔ should be a file
357
+
358
+ In addition, you can make use of the `subject` keyword to further control your output if you choose:
359
+
360
+ describe 'test file' do
361
+ subject { file('/tmp/test.txt') }
362
+ it 'should be a file' do
363
+ expect(subject).to(be_file)
364
+ end
365
+ end
366
+
367
+ ... which will render the following output:
368
+
369
+ test file
370
+ ✔ should be a file