inspec 1.51.6 → 1.51.15

data/lib/resources/aide_conf.rb

@@ -1,160 +1,160 @@
-# encoding: utf-8
-# author: Jen Burns, burnsjennifere@gmail.com
-
-require 'utils/filter'
-require 'utils/parser'
-module Inspec::Resources
-  class AideConf < Inspec.resource(1)
-    name 'aide_conf'
-    desc 'Use the aide_conf InSpec audit resource to test the rules established for
-      the file integrity tool AIDE. Controlled by the aide.conf file typically at /etc/aide.conf.'
-    example "
-      describe aide_conf do
-        its('selection_lines') { should include '/sbin' }
-      end
-
-      describe aide_conf.where { selection_line == '/bin' } do
-        its('rules.flatten') { should include 'r' }
-      end
-
-      describe aide_conf.all_have_rule('sha512') do
-        it { should eq true }
-      end
-    "
-
-    attr_reader :params
-
-    include CommentParser
-
-    def initialize(aide_conf_path = nil)
-      return skip_resource 'The `aide_conf` resource is not supported on your OS.' unless inspec.os.linux?
-      @conf_path = aide_conf_path || '/etc/aide.conf'
-      @content = nil
-      @rules = nil
-      read_content
-    end
-
-    def all_have_rule(rule)
-      # Case when file didn't exist or perms didn't allow an open
-      return false if @content.nil?
-
-      lines = @params.reject { |line| line['rules'].include? rule }
-      lines.empty?
-    end
-
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:selection_lines, field: 'selection_line')
-          .add(:rules,           field: 'rules')
-
-    filter.connect(self, :params)
-
-    private
-
-    def read_content
-      return @content unless @content.nil?
-      @rules = {}
-
-      file = inspec.file(@conf_path)
-      if !file.file?
-        return skip_resource "Can't find file \"#{@conf_path}\""
-      end
-      raw_conf = file.content
-      if raw_conf.nil?
-        return skip_resource "File can't be opened or is empty \"#{@conf_path}\""
-      end
-      if raw_conf.empty? && !file.empty?
-        return skip_resource "Can't read file \"#{@conf_path}\""
-      end
-
-      # If there is a file and it contains content, continue
-      @content = filter_comments(inspec.file(@conf_path).content.lines)
-      @params = parse_conf(@content)
-    end
-
-    def filter_comments(data)
-      content = []
-      data.each do |line|
-        content_line, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
-        content.push(content_line)
-      end
-      content
-    end
-
-    def parse_conf(content)
-      params = []
-      content.each do |line|
-        param = parse_line(line)
-        if !param['selection_line'].nil?
-          params.push(param)
-        end
-      end
-      params
-    end
-
-    def parse_line(line)
-      line_and_rules = {}
-      # Case when line is a rule line
-      if line.include?(' = ')
-        parse_rule_line(line)
-      # Case when line is a selection line
-      elsif line.start_with?('/', '!', '=')
-        line_and_rules = parse_selection_line(line)
-      end
-      line_and_rules
-    end
-
-    def parse_rule_line(line)
-      line.gsub!(/\s+/, '')
-      rule_line_arr = line.split('=')
-      rules_list = rule_line_arr.last.split('+')
-      rule_name = rule_line_arr.first
-      rules_list.each_index do |i|
-        # Cases where rule respresents one or more other rules
-        if @rules.key?(rules_list[i])
-          rules_list[i] = @rules[rules_list[i]]
-        end
-        rules_list[i] = handle_multi_rule(rules_list, i)
-      end
-      @rules[rule_name] = rules_list.flatten
-    end
-
-    def parse_selection_line(line)
-      selec_line_arr = line.split(' ')
-      selection_line = selec_line_arr.first
-      selection_line.chop! if selection_line.end_with?('/')
-      rule_list = selec_line_arr.last.split('+')
-      rule_list.each_index do |i|
-        hash_list = @rules[rule_list[i]]
-        # Cases where rule respresents one or more other rules
-        if !hash_list.nil?
-          rule_list[i] = hash_list
-        end
-        rule_list[i] = handle_multi_rule(rule_list, i)
-      end
-      rule_list.flatten!
-      {
-        'selection_line' => selection_line,
-        'rules' => rule_list,
-      }
-    end
-
-    def handle_multi_rule(rule_list, i)
-      # Rules that represent multiple rules (R,L,>)
-      r_rules = %w{p i l n u g s m c md5}
-      l_rules = %w{p i l n u g}
-      grow_log_rules = %w{p l u g i n S}
-
-      case rule_list[i]
-      when 'R'
-        return r_rules
-      when 'L'
-        return l_rules
-      when '>'
-        return grow_log_rules
-      end
-      rule_list[i]
-    end
-  end
-end
+# encoding: utf-8
+# author: Jen Burns, burnsjennifere@gmail.com
+
+require 'utils/filter'
+require 'utils/parser'
+module Inspec::Resources
+  class AideConf < Inspec.resource(1)
+    name 'aide_conf'
+    desc 'Use the aide_conf InSpec audit resource to test the rules established for
+      the file integrity tool AIDE. Controlled by the aide.conf file typically at /etc/aide.conf.'
+    example "
+      describe aide_conf do
+        its('selection_lines') { should include '/sbin' }
+      end
+
+      describe aide_conf.where { selection_line == '/bin' } do
+        its('rules.flatten') { should include 'r' }
+      end
+
+      describe aide_conf.all_have_rule('sha512') do
+        it { should eq true }
+      end
+    "
+
+    attr_reader :params
+
+    include CommentParser
+
+    def initialize(aide_conf_path = nil)
+      return skip_resource 'The `aide_conf` resource is not supported on your OS.' unless inspec.os.linux?
+      @conf_path = aide_conf_path || '/etc/aide.conf'
+      @content = nil
+      @rules = nil
+      read_content
+    end
+
+    def all_have_rule(rule)
+      # Case when file didn't exist or perms didn't allow an open
+      return false if @content.nil?
+
+      lines = @params.reject { |line| line['rules'].include? rule }
+      lines.empty?
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:selection_lines, field: 'selection_line')
+          .add(:rules,           field: 'rules')
+
+    filter.connect(self, :params)
+
+    private
+
+    def read_content
+      return @content unless @content.nil?
+      @rules = {}
+
+      file = inspec.file(@conf_path)
+      if !file.file?
+        return skip_resource "Can't find file \"#{@conf_path}\""
+      end
+      raw_conf = file.content
+      if raw_conf.nil?
+        return skip_resource "File can't be opened or is empty \"#{@conf_path}\""
+      end
+      if raw_conf.empty? && !file.empty?
+        return skip_resource "Can't read file \"#{@conf_path}\""
+      end
+
+      # If there is a file and it contains content, continue
+      @content = filter_comments(inspec.file(@conf_path).content.lines)
+      @params = parse_conf(@content)
+    end
+
+    def filter_comments(data)
+      content = []
+      data.each do |line|
+        content_line, = parse_comment_line(line, comment_char: '#', standalone_comments: false)
+        content.push(content_line)
+      end
+      content
+    end
+
+    def parse_conf(content)
+      params = []
+      content.each do |line|
+        param = parse_line(line)
+        if !param['selection_line'].nil?
+          params.push(param)
+        end
+      end
+      params
+    end
+
+    def parse_line(line)
+      line_and_rules = {}
+      # Case when line is a rule line
+      if line.include?(' = ')
+        parse_rule_line(line)
+      # Case when line is a selection line
+      elsif line.start_with?('/', '!', '=')
+        line_and_rules = parse_selection_line(line)
+      end
+      line_and_rules
+    end
+
+    def parse_rule_line(line)
+      line.gsub!(/\s+/, '')
+      rule_line_arr = line.split('=')
+      rules_list = rule_line_arr.last.split('+')
+      rule_name = rule_line_arr.first
+      rules_list.each_index do |i|
+        # Cases where rule respresents one or more other rules
+        if @rules.key?(rules_list[i])
+          rules_list[i] = @rules[rules_list[i]]
+        end
+        rules_list[i] = handle_multi_rule(rules_list, i)
+      end
+      @rules[rule_name] = rules_list.flatten
+    end
+
+    def parse_selection_line(line)
+      selec_line_arr = line.split(' ')
+      selection_line = selec_line_arr.first
+      selection_line.chop! if selection_line.end_with?('/')
+      rule_list = selec_line_arr.last.split('+')
+      rule_list.each_index do |i|
+        hash_list = @rules[rule_list[i]]
+        # Cases where rule respresents one or more other rules
+        if !hash_list.nil?
+          rule_list[i] = hash_list
+        end
+        rule_list[i] = handle_multi_rule(rule_list, i)
+      end
+      rule_list.flatten!
+      {
+        'selection_line' => selection_line,
+        'rules' => rule_list,
+      }
+    end
+
+    def handle_multi_rule(rule_list, i)
+      # Rules that represent multiple rules (R,L,>)
+      r_rules = %w{p i l n u g s m c md5}
+      l_rules = %w{p i l n u g}
+      grow_log_rules = %w{p l u g i n S}
+
+      case rule_list[i]
+      when 'R'
+        return r_rules
+      when 'L'
+        return l_rules
+      when '>'
+        return grow_log_rules
+      end
+      rule_list[i]
+    end
+  end
+end

data/lib/resources/apache.rb

@@ -1,49 +1,49 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-# author: Christoph Hartmann
-# author: Dominik Richter
-
-module Inspec::Resources
-  class Apache < Inspec.resource(1)
-    name 'apache'
-    desc 'Use the apache InSpec audit resource to retrieve Apache environment settings.'
-    example "
-      describe apache do
-        its ('service') { should cmp 'apache2' }
-      end
-
-      describe apache do
-        its ('conf_dir') { should cmp '/etc/apache2' }
-      end
-
-      describe apache do
-        its ('conf_path') { should cmp '/etc/apache2/apache2.conf' }
-      end
-
-      describe apache do
-        its ('user') { should cmp 'www-data' }
-      end
-    "
-
-    attr_reader :service, :conf_dir, :conf_path, :user
-    def initialize
-      warn '[DEPRECATED] The `apache` resource is deprecated and will be removed in InSpec 3.0.'
-
-      if inspec.os.debian?
-        @service = 'apache2'
-        @conf_dir = '/etc/apache2/'
-        @conf_path = File.join @conf_dir, 'apache2.conf'
-        @user = 'www-data'
-      else
-        @service = 'httpd'
-        @conf_dir = '/etc/httpd/'
-        @conf_path = File.join @conf_dir, '/conf/httpd.conf'
-        @user = 'apache'
-      end
-    end
-
-    def to_s
-      'Apache Environment'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+module Inspec::Resources
+  class Apache < Inspec.resource(1)
+    name 'apache'
+    desc 'Use the apache InSpec audit resource to retrieve Apache environment settings.'
+    example "
+      describe apache do
+        its ('service') { should cmp 'apache2' }
+      end
+
+      describe apache do
+        its ('conf_dir') { should cmp '/etc/apache2' }
+      end
+
+      describe apache do
+        its ('conf_path') { should cmp '/etc/apache2/apache2.conf' }
+      end
+
+      describe apache do
+        its ('user') { should cmp 'www-data' }
+      end
+    "
+
+    attr_reader :service, :conf_dir, :conf_path, :user
+    def initialize
+      warn '[DEPRECATED] The `apache` resource is deprecated and will be removed in InSpec 3.0.'
+
+      if inspec.os.debian?
+        @service = 'apache2'
+        @conf_dir = '/etc/apache2/'
+        @conf_path = File.join @conf_dir, 'apache2.conf'
+        @user = 'www-data'
+      else
+        @service = 'httpd'
+        @conf_dir = '/etc/httpd/'
+        @conf_path = File.join @conf_dir, '/conf/httpd.conf'
+        @user = 'apache'
+      end
+    end
+
+    def to_s
+      'Apache Environment'
+    end
+  end
+end

data/lib/resources/apache_conf.rb

@@ -1,158 +1,158 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-# author: Dominik Richter
-# author: Christoph Hartmann
-
-require 'utils/simpleconfig'
-require 'utils/find_files'
-
-module Inspec::Resources
-  class ApacheConf < Inspec.resource(1)
-    name 'apache_conf'
-    supports os_family: 'linux'
-    supports os_family: 'debian'
-    desc 'Use the apache_conf InSpec audit resource to test the configuration settings for Apache. This file is typically located under /etc/apache2 on the Debian and Ubuntu platforms and under /etc/httpd on the Fedora, CentOS, Red Hat Enterprise Linux, and Arch Linux platforms. The configuration settings may vary significantly from platform to platform.'
-    example "
-      describe apache_conf do
-        its('setting_name') { should eq 'value' }
-      end
-    "
-
-    include FindFiles
-
-    attr_reader :conf_path
-
-    def initialize(conf_path = nil)
-      @conf_path = conf_path || default_conf_path
-      @files_contents = {}
-      @content = nil
-      @params = nil
-      read_content
-    end
-
-    def content
-      @content ||= read_content
-    end
-
-    def params(*opts)
-      @params || read_content
-      res = @params
-      opts.each do |opt|
-        res = res[opt] unless res.nil?
-      end
-      res
-    end
-
-    def method_missing(name)
-      # ensure params are loaded
-      @params || read_content
-
-      # extract values
-      @params[name.to_s] unless @params.nil?
-    end
-
-    def filter_comments(data)
-      content = ''
-      data.each_line do |line|
-        if !line.match(/^\s*#/)
-          content << line
-        end
-      end
-      content
-    end
-
-    def read_content
-      @content = ''
-      @params = {}
-
-      # skip if the main configuration file doesn't exist
-      file = inspec.file(conf_path)
-      if !file.file?
-        return skip_resource "Can't find file \"#{conf_path}\""
-      end
-
-      raw_conf = file.content
-      if raw_conf.empty? && !file.empty?
-        return skip_resource("Can't read file \"#{conf_path}\"")
-      end
-
-      to_read = [conf_path]
-      until to_read.empty?
-        raw_conf = read_file(to_read[0])
-        @content += raw_conf
-
-        # An explaination of the below regular expression.
-        # Creates two capture groups.
-        # The first group captures the first group of non-whitespace character
-        # surrounded whitespace characters.
-        # The second group contains a conditional with a positive lookahead
-        # (does the line end with one or more spaces?). If the lookahead succeeds
-        # a non-greedy capture takes place, if it fails then a greedy capture takes place.
-        # The regex is terminated by an expression that matches zero or more spaces.
-        params = SimpleConfig.new(
-          raw_conf,
-          assignment_regex: /^\s*(\S+)\s+((?=.*\s+$).*?|.*)\s*$/,
-          multiple_values: true,
-        ).params
-        @params.merge!(params)
-
-        to_read = to_read.drop(1)
-        to_read += include_files(params).find_all do |fp|
-          not @files_contents.key? fp
-        end
-      end
-
-      # fiter comments
-      @content = filter_comments @content
-      @content
-    end
-
-    def include_files(params)
-      # see if there is more config files to include
-      include_files = params['Include'] || []
-      include_files_optional = params['IncludeOptional'] || []
-
-      includes = []
-      (include_files + include_files_optional).each do |f|
-        id    = Pathname.new(f).absolute? ? f : File.join(conf_dir, f)
-        files = find_files(id, depth: 1, type: 'file')
-        files += find_files(id, depth: 1, type: 'link')
-
-        includes.push(files) if files
-      end
-
-      # [].flatten! == nil
-      includes.flatten! || []
-    end
-
-    def read_file(path)
-      @files_contents[path] ||= inspec.file(path).content
-    end
-
-    def conf_dir
-      if inspec.os.debian?
-        File.dirname(conf_path)
-      else
-        # On RHEL-based systems, the configuration is usually in a /conf directory
-        # that contains the primary config file. We assume the "config path" is the
-        # directory that contains the /conf directory, such as /etc/httpd, so that
-        # the conf.d directory can be properly located.
-        Pathname.new(File.dirname(conf_path)).parent.to_s
-      end
-    end
-
-    def to_s
-      "Apache Config #{conf_path}"
-    end
-
-    private
-
-    def default_conf_path
-      if inspec.os.debian?
-        '/etc/apache2/apache2.conf'
-      else
-        '/etc/httpd/conf/httpd.conf'
-      end
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Dominik Richter
+# author: Christoph Hartmann
+
+require 'utils/simpleconfig'
+require 'utils/find_files'
+
+module Inspec::Resources
+  class ApacheConf < Inspec.resource(1)
+    name 'apache_conf'
+    supports os_family: 'linux'
+    supports os_family: 'debian'
+    desc 'Use the apache_conf InSpec audit resource to test the configuration settings for Apache. This file is typically located under /etc/apache2 on the Debian and Ubuntu platforms and under /etc/httpd on the Fedora, CentOS, Red Hat Enterprise Linux, and Arch Linux platforms. The configuration settings may vary significantly from platform to platform.'
+    example "
+      describe apache_conf do
+        its('setting_name') { should eq 'value' }
+      end
+    "
+
+    include FindFiles
+
+    attr_reader :conf_path
+
+    def initialize(conf_path = nil)
+      @conf_path = conf_path || default_conf_path
+      @files_contents = {}
+      @content = nil
+      @params = nil
+      read_content
+    end
+
+    def content
+      @content ||= read_content
+    end
+
+    def params(*opts)
+      @params || read_content
+      res = @params
+      opts.each do |opt|
+        res = res[opt] unless res.nil?
+      end
+      res
+    end
+
+    def method_missing(name)
+      # ensure params are loaded
+      @params || read_content
+
+      # extract values
+      @params[name.to_s] unless @params.nil?
+    end
+
+    def filter_comments(data)
+      content = ''
+      data.each_line do |line|
+        if !line.match(/^\s*#/)
+          content << line
+        end
+      end
+      content
+    end
+
+    def read_content
+      @content = ''
+      @params = {}
+
+      # skip if the main configuration file doesn't exist
+      file = inspec.file(conf_path)
+      if !file.file?
+        return skip_resource "Can't find file \"#{conf_path}\""
+      end
+
+      raw_conf = file.content
+      if raw_conf.empty? && !file.empty?
+        return skip_resource("Can't read file \"#{conf_path}\"")
+      end
+
+      to_read = [conf_path]
+      until to_read.empty?
+        raw_conf = read_file(to_read[0])
+        @content += raw_conf
+
+        # An explaination of the below regular expression.
+        # Creates two capture groups.
+        # The first group captures the first group of non-whitespace character
+        # surrounded whitespace characters.
+        # The second group contains a conditional with a positive lookahead
+        # (does the line end with one or more spaces?). If the lookahead succeeds
+        # a non-greedy capture takes place, if it fails then a greedy capture takes place.
+        # The regex is terminated by an expression that matches zero or more spaces.
+        params = SimpleConfig.new(
+          raw_conf,
+          assignment_regex: /^\s*(\S+)\s+((?=.*\s+$).*?|.*)\s*$/,
+          multiple_values: true,
+        ).params
+        @params.merge!(params)
+
+        to_read = to_read.drop(1)
+        to_read += include_files(params).find_all do |fp|
+          not @files_contents.key? fp
+        end
+      end
+
+      # fiter comments
+      @content = filter_comments @content
+      @content
+    end
+
+    def include_files(params)
+      # see if there is more config files to include
+      include_files = params['Include'] || []
+      include_files_optional = params['IncludeOptional'] || []
+
+      includes = []
+      (include_files + include_files_optional).each do |f|
+        id    = Pathname.new(f).absolute? ? f : File.join(conf_dir, f)
+        files = find_files(id, depth: 1, type: 'file')
+        files += find_files(id, depth: 1, type: 'link')
+
+        includes.push(files) if files
+      end
+
+      # [].flatten! == nil
+      includes.flatten! || []
+    end
+
+    def read_file(path)
+      @files_contents[path] ||= inspec.file(path).content
+    end
+
+    def conf_dir
+      if inspec.os.debian?
+        File.dirname(conf_path)
+      else
+        # On RHEL-based systems, the configuration is usually in a /conf directory
+        # that contains the primary config file. We assume the "config path" is the
+        # directory that contains the /conf directory, such as /etc/httpd, so that
+        # the conf.d directory can be properly located.
+        Pathname.new(File.dirname(conf_path)).parent.to_s
+      end
+    end
+
+    def to_s
+      "Apache Config #{conf_path}"
+    end
+
+    private
+
+    def default_conf_path
+      if inspec.os.debian?
+        '/etc/apache2/apache2.conf'
+      else
+        '/etc/httpd/conf/httpd.conf'
+      end
+    end
+  end
+end