inspec 1.51.6 → 1.51.15

data/lib/resources/apt.rb

@@ -1,150 +1,150 @@
-# encoding: utf-8
-# author: Christoph Hartmann
-# author: Dominik Richter
-
-# Verifies apt and ppa repositories
-#
-# Usage:
-# describe apt('ubuntu-wine/ppa') do
-#   it { should exist }
-#   it { should be_enabled }
-# end
-#
-# it also understands a ppa url
-# describe apt('ppa:ubuntu-wine/ppa') do
-#   it { should exist }
-#   it { should be_enabled }
-# end
-#
-# The following ppa formats are supported:
-# - ubuntu-wine/ppa
-# - ppa:ubuntu-wine/ppa
-# - http://ppa.launchpad.net/juju/stable/ubuntu
-#
-# Install a ppa as following:
-# apt-get install python-software-properties
-# apt-get install software-properties-common
-# add-apt-repository ppa:ubuntu-wine/ppa
-
-require 'uri'
-
-module Inspec::Resources
-  class AptRepository < Inspec.resource(1)
-    name 'apt'
-    desc 'Use the apt InSpec audit resource to verify Apt repositories on the Debian and Ubuntu platforms, and also PPA repositories on the Ubuntu platform.'
-    example "
-      describe apt('nginx/stable') do
-        it { should exist }
-        it { should be_enabled }
-      end
-    "
-
-    def initialize(ppa_name)
-      @deb_url = nil
-      # check if the os is ubuntu or debian
-      if inspec.os.debian?
-        @deb_url = determine_ppa_url(ppa_name)
-      else
-        # this resource is only supported on ubuntu and debian
-        skip_resource 'The `apt` resource is not supported on your OS yet.'
-      end
-    end
-
-    def exists?
-      find_repo.count > 0
-    end
-
-    def enabled?
-      return false if find_repo.count == 0
-      actives = find_repo.map { |repo| repo[:active] }
-      actives = actives.uniq
-      actives.size == 1 && actives[0] = true
-    end
-
-    def to_s
-      "Apt Repository #{@deb_url}"
-    end
-
-    private
-
-    def find_repo
-      read_debs.select { |repo| repo[:url] == @deb_url && repo[:type] == 'deb' }
-    end
-
-    HTTP_URL_RE = /\A#{URI::DEFAULT_PARSER.make_regexp(%w{http https})}\z/
-
-    # read
-    def read_debs
-      return @repo_cache if defined?(@repo_cache)
-
-      # load all lists
-      cmd = inspec.command("find /etc/apt/ -name \*.list -exec sh -c 'cat {} || echo -n' \\;")
-
-      # @see https://help.ubuntu.com/community/Repositories/CommandLine#Explanation_of_the_Repository_Format
-      @repo_cache = cmd.stdout.chomp.split("\n").each_with_object([]) do |raw_line, lines|
-        active = true
-
-        # detect if the repo is commented out
-        line = raw_line.gsub(/^(#\s*)*/, '')
-        active = false if raw_line != line
-
-        # eg.: deb http://archive.ubuntu.com/ubuntu/ wily main restricted
-        # or : deb [trusted=yes] http://archive.ubuntu.com/ubuntu/ wily main restricted
-        parse_repo = /^\s*(\S+)\s+(?:\[\S+\])?\s*"?([^ "\t\r\n\f]+)"?\s+(\S+)\s+(.*)$/.match(line)
-
-        # check if we got any result and the second param is an url
-        next if parse_repo.nil? || !parse_repo[2] =~ HTTP_URL_RE
-
-        # map data
-        repo = {
-          type: parse_repo[1],
-          url: parse_repo[2],
-          distro: parse_repo[3],
-          components: parse_repo[4].chomp.split(' '),
-          active: active,
-        }
-        next unless ['deb', 'deb-src'].include? repo[:type]
-
-        lines.push(repo)
-      end
-    end
-
-    # resolves ppa urls
-    # @see http://bazaar.launchpad.net/~ubuntu-core-dev/software-properties/main/view/head:/softwareproperties/ppa.py
-    def determine_ppa_url(ppa_url)
-      # verify if we have the url already, then just return
-      return ppa_url if ppa_url =~ HTTP_URL_RE
-      # otherwise start generating the ppa url
-
-      # special care if the name stats with :
-      ppa_url = ppa_url.split(':')[1] if ppa_url.start_with?('ppa:')
-
-      # parse ppa owner and repo
-      ppa_owner, ppa_repo = ppa_url.split('/')
-      ppa_repo = 'ppa' if ppa_repo.nil?
-
-      # construct new ppa url and return it
-      format('http://ppa.launchpad.net/%s/%s/ubuntu', ppa_owner, ppa_repo)
-    end
-  end
-
-  # for compatability with serverspec
-  # this is deprecated syntax and will be removed in future versions
-  class PpaRepository < AptRepository
-    name 'ppa'
-
-    def exists?
-      deprecated
-      super()
-    end
-
-    def enabled?
-      deprecated
-      super()
-    end
-
-    def deprecated
-      warn '[DEPRECATION] `ppa(reponame)` is deprecated.  Please use `apt(reponame)` instead.'
-    end
-  end
-end
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# Verifies apt and ppa repositories
+#
+# Usage:
+# describe apt('ubuntu-wine/ppa') do
+#   it { should exist }
+#   it { should be_enabled }
+# end
+#
+# it also understands a ppa url
+# describe apt('ppa:ubuntu-wine/ppa') do
+#   it { should exist }
+#   it { should be_enabled }
+# end
+#
+# The following ppa formats are supported:
+# - ubuntu-wine/ppa
+# - ppa:ubuntu-wine/ppa
+# - http://ppa.launchpad.net/juju/stable/ubuntu
+#
+# Install a ppa as following:
+# apt-get install python-software-properties
+# apt-get install software-properties-common
+# add-apt-repository ppa:ubuntu-wine/ppa
+
+require 'uri'
+
+module Inspec::Resources
+  class AptRepository < Inspec.resource(1)
+    name 'apt'
+    desc 'Use the apt InSpec audit resource to verify Apt repositories on the Debian and Ubuntu platforms, and also PPA repositories on the Ubuntu platform.'
+    example "
+      describe apt('nginx/stable') do
+        it { should exist }
+        it { should be_enabled }
+      end
+    "
+
+    def initialize(ppa_name)
+      @deb_url = nil
+      # check if the os is ubuntu or debian
+      if inspec.os.debian?
+        @deb_url = determine_ppa_url(ppa_name)
+      else
+        # this resource is only supported on ubuntu and debian
+        skip_resource 'The `apt` resource is not supported on your OS yet.'
+      end
+    end
+
+    def exists?
+      find_repo.count > 0
+    end
+
+    def enabled?
+      return false if find_repo.count == 0
+      actives = find_repo.map { |repo| repo[:active] }
+      actives = actives.uniq
+      actives.size == 1 && actives[0] = true
+    end
+
+    def to_s
+      "Apt Repository #{@deb_url}"
+    end
+
+    private
+
+    def find_repo
+      read_debs.select { |repo| repo[:url] == @deb_url && repo[:type] == 'deb' }
+    end
+
+    HTTP_URL_RE = /\A#{URI::DEFAULT_PARSER.make_regexp(%w{http https})}\z/
+
+    # read
+    def read_debs
+      return @repo_cache if defined?(@repo_cache)
+
+      # load all lists
+      cmd = inspec.command("find /etc/apt/ -name \*.list -exec sh -c 'cat {} || echo -n' \\;")
+
+      # @see https://help.ubuntu.com/community/Repositories/CommandLine#Explanation_of_the_Repository_Format
+      @repo_cache = cmd.stdout.chomp.split("\n").each_with_object([]) do |raw_line, lines|
+        active = true
+
+        # detect if the repo is commented out
+        line = raw_line.gsub(/^(#\s*)*/, '')
+        active = false if raw_line != line
+
+        # eg.: deb http://archive.ubuntu.com/ubuntu/ wily main restricted
+        # or : deb [trusted=yes] http://archive.ubuntu.com/ubuntu/ wily main restricted
+        parse_repo = /^\s*(\S+)\s+(?:\[\S+\])?\s*"?([^ "\t\r\n\f]+)"?\s+(\S+)\s+(.*)$/.match(line)
+
+        # check if we got any result and the second param is an url
+        next if parse_repo.nil? || !parse_repo[2] =~ HTTP_URL_RE
+
+        # map data
+        repo = {
+          type: parse_repo[1],
+          url: parse_repo[2],
+          distro: parse_repo[3],
+          components: parse_repo[4].chomp.split(' '),
+          active: active,
+        }
+        next unless ['deb', 'deb-src'].include? repo[:type]
+
+        lines.push(repo)
+      end
+    end
+
+    # resolves ppa urls
+    # @see http://bazaar.launchpad.net/~ubuntu-core-dev/software-properties/main/view/head:/softwareproperties/ppa.py
+    def determine_ppa_url(ppa_url)
+      # verify if we have the url already, then just return
+      return ppa_url if ppa_url =~ HTTP_URL_RE
+      # otherwise start generating the ppa url
+
+      # special care if the name stats with :
+      ppa_url = ppa_url.split(':')[1] if ppa_url.start_with?('ppa:')
+
+      # parse ppa owner and repo
+      ppa_owner, ppa_repo = ppa_url.split('/')
+      ppa_repo = 'ppa' if ppa_repo.nil?
+
+      # construct new ppa url and return it
+      format('http://ppa.launchpad.net/%s/%s/ubuntu', ppa_owner, ppa_repo)
+    end
+  end
+
+  # for compatability with serverspec
+  # this is deprecated syntax and will be removed in future versions
+  class PpaRepository < AptRepository
+    name 'ppa'
+
+    def exists?
+      deprecated
+      super()
+    end
+
+    def enabled?
+      deprecated
+      super()
+    end
+
+    def deprecated
+      warn '[DEPRECATION] `ppa(reponame)` is deprecated.  Please use `apt(reponame)` instead.'
+    end
+  end
+end

data/lib/resources/audit_policy.rb

@@ -1,64 +1,64 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-# author: Christoph Hartmann
-# author: Dominik Richter
-
-# Advanced Auditing:
-# As soon as you start applying Advanced Audit Configuration Policy, legacy policies will be completely ignored.
-# reference: https://technet.microsoft.com/en-us/library/cc753632.aspx
-# use:
-#  - list all categories: Auditpol /list /subcategory:* /r
-#  - list parameters: Auditpol /get /category:"System" /subcategory:"IPsec Driver"
-#  - list specific parameter: Auditpol /get /subcategory:"IPsec Driver"
-#
-# @link: http://blogs.technet.com/b/askds/archive/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2.aspx
-#
-# Valid values are:
-#
-# - "No Auditing"
-# - "Not Specified"
-# - "Success"
-# - "Success and Failure"
-# - "Failure"
-#
-# Further information is available at: https://msdn.microsoft.com/en-us/library/dd973859.aspx
-
-module Inspec::Resources
-  class AuditPolicy < Inspec.resource(1)
-    name 'audit_policy'
-    desc 'Use the audit_policy InSpec audit resource to test auditing policies on the Microsoft Windows platform. An auditing policy is a category of security-related events to be audited. Auditing is disabled by default and may be enabled for categories like account management, logon events, policy changes, process tracking, privilege use, system events, or object access. For each enabled auditing category property, the auditing level may be set to No Auditing, Not Specified, Success, Success and Failure, or Failure.'
-    example "
-      describe audit_policy do
-        its('parameter') { should eq 'value' }
-      end
-    "
-
-    def method_missing(method)
-      key = method.to_s
-
-      # expected result:
-      # Machine Name,Policy Target,Subcategory,Subcategory GUID,Inclusion Setting,Exclusion Setting
-      # WIN-MB8NINQ388J,System,Kerberos Authentication Service,{0CCE9242-69AE-11D9-BED3-505054503030},No Auditing,
-      result ||= inspec.command("Auditpol /get /subcategory:'#{key}' /r").stdout
-
-      # find line
-      target = nil
-      result.each_line do |s|
-        target = s.strip if s =~ /\b.*#{key}.*\b/
-      end
-
-      # extract value
-      values = nil
-      unless target.nil?
-        # split csv values and return value
-        values = target.split(',')[4]
-      end
-
-      values
-    end
-
-    def to_s
-      'Audit Policy'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# Advanced Auditing:
+# As soon as you start applying Advanced Audit Configuration Policy, legacy policies will be completely ignored.
+# reference: https://technet.microsoft.com/en-us/library/cc753632.aspx
+# use:
+#  - list all categories: Auditpol /list /subcategory:* /r
+#  - list parameters: Auditpol /get /category:"System" /subcategory:"IPsec Driver"
+#  - list specific parameter: Auditpol /get /subcategory:"IPsec Driver"
+#
+# @link: http://blogs.technet.com/b/askds/archive/2011/03/11/getting-the-effective-audit-policy-in-windows-7-and-2008-r2.aspx
+#
+# Valid values are:
+#
+# - "No Auditing"
+# - "Not Specified"
+# - "Success"
+# - "Success and Failure"
+# - "Failure"
+#
+# Further information is available at: https://msdn.microsoft.com/en-us/library/dd973859.aspx
+
+module Inspec::Resources
+  class AuditPolicy < Inspec.resource(1)
+    name 'audit_policy'
+    desc 'Use the audit_policy InSpec audit resource to test auditing policies on the Microsoft Windows platform. An auditing policy is a category of security-related events to be audited. Auditing is disabled by default and may be enabled for categories like account management, logon events, policy changes, process tracking, privilege use, system events, or object access. For each enabled auditing category property, the auditing level may be set to No Auditing, Not Specified, Success, Success and Failure, or Failure.'
+    example "
+      describe audit_policy do
+        its('parameter') { should eq 'value' }
+      end
+    "
+
+    def method_missing(method)
+      key = method.to_s
+
+      # expected result:
+      # Machine Name,Policy Target,Subcategory,Subcategory GUID,Inclusion Setting,Exclusion Setting
+      # WIN-MB8NINQ388J,System,Kerberos Authentication Service,{0CCE9242-69AE-11D9-BED3-505054503030},No Auditing,
+      result ||= inspec.command("Auditpol /get /subcategory:'#{key}' /r").stdout
+
+      # find line
+      target = nil
+      result.each_line do |s|
+        target = s.strip if s =~ /\b.*#{key}.*\b/
+      end
+
+      # extract value
+      values = nil
+      unless target.nil?
+        # split csv values and return value
+        values = target.split(',')[4]
+      end
+
+      values
+    end
+
+    def to_s
+      'Audit Policy'
+    end
+  end
+end

data/lib/resources/auditd.rb

@@ -1,233 +1,233 @@
-# encoding: utf-8
-# author: Christoph Hartmann
-# author: Dominik Richter
-# author: Jen Burns
-
-require 'forwardable'
-require 'utils/filter_array'
-require 'utils/filter'
-require 'utils/parser'
-
-module Inspec::Resources
-  class AuditDaemon < Inspec.resource(1)
-    extend Forwardable
-    attr_accessor :lines
-    attr_reader :params
-
-    name 'auditd'
-    desc 'Use the auditd InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files. These rules are output using the auditcl -l command.'
-    example "
-      describe auditd.syscall('chown').where {arch == 'b32'} do
-        its('action') { should eq ['always'] }
-        its('list') { should eq ['exit'] }
-      end
-
-      describe auditd.where {key == 'privileged'} do
-        its('permissions') { should include ['x'] }
-      end
-
-      describe auditd do
-        its('lines') { should include %r(-w /etc/ssh/sshd_config) }
-      end
-    "
-
-    def initialize
-      @content = inspec.command('/sbin/auditctl -l').stdout.chomp
-      @params = []
-
-      if @content =~ /^LIST_RULES:/
-        return skip_resource 'The version of audit is outdated. The `auditd` resource supports versions of audit >= 2.3.'
-      end
-      parse_content
-    end
-
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:file,         field: 'file')
-          .add(:list,         field: 'list')
-          .add(:action,       field: 'action')
-          .add(:fields,       field: 'fields')
-          .add(:fields_nokey, field: 'fields_nokey')
-          .add(:syscall,      field: 'syscall')
-          .add(:key,          field: 'key')
-          .add(:arch,         field: 'arch')
-          .add(:path,         field: 'path')
-          .add(:permissions,  field: 'permissions')
-          .add(:exit,         field: 'exit')
-
-    filter.connect(self, :params)
-
-    def status(name = nil)
-      @status_content ||= inspec.command('/sbin/auditctl -s').stdout.chomp
-      @status_params ||= Hash[@status_content.scan(/^([^ ]+) (.*)$/)]
-
-      return @status_params[name] if name
-      @status_params
-    end
-
-    def parse_content
-      @lines = @content.lines.map(&:chomp)
-
-      lines.each do |line|
-        if is_file_syscall_syntax?(line)
-          file_syscall_syntax_rules_for(line)
-        end
-
-        if is_syscall?(line)
-          syscall_rules_for(line)
-
-        elsif is_file?(line)
-          file_rules_for(line)
-        end
-      end
-    end
-
-    def file_syscall_syntax_rules_for(line)
-      file = file_syscall_syntax_for(line)
-      action, list = action_list_for(line)
-      fields = rule_fields_for(line)
-      key_field, fields_nokey = remove_key_from(fields)
-      key = key_in(key_field.join(''))
-      perms = perms_in(fields)
-
-      @params.push(
-        {
-          'file' => file,
-          'list' => list,
-          'action' => action,
-          'fields' => fields,
-          'permissions' => perms,
-          'key' => key,
-          'fields_nokey' => fields_nokey,
-        },
-      )
-    end
-
-    def syscall_rules_for(line)
-      syscalls = syscalls_for(line)
-      action, list = action_list_for(line)
-      fields = rule_fields_for(line)
-      key_field, fields_nokey = remove_key_from(fields)
-      key = key_in(key_field.join(''))
-      arch = arch_in(fields)
-      path = path_in(fields)
-      perms = perms_in(fields)
-      exit_field = exit_in(fields)
-
-      syscalls.each do |s|
-        @params.push(
-          {
-            'syscall' => s,
-            'list' => list,
-            'action' => action,
-            'fields' => fields,
-            'key' => key,
-            'arch' => arch,
-            'path' => path,
-            'permissions' => perms,
-            'exit' => exit_field,
-            'fields_nokey' => fields_nokey,
-          },
-        )
-      end
-    end
-
-    def file_rules_for(line)
-      file = file_for(line)
-      perms = permissions_for(line)
-      key = key_for(line)
-
-      @params.push(
-        {
-          'file' => file,
-          'key' => key,
-          'permissions' => perms,
-        },
-      )
-    end
-
-    def to_s
-      'Auditd Rules'
-    end
-
-    private
-
-    def is_syscall?(line)
-      line.match(/-S /)
-    end
-
-    def is_file?(line)
-      line.match(/-w /)
-    end
-
-    def is_file_syscall_syntax?(line)
-      line.match(/-F path=/)
-    end
-
-    def syscalls_for(line)
-      line.scan(/-S ([^ ]+)\s?/).flatten.first.split(',')
-    end
-
-    def action_list_for(line)
-      line.scan(/-a ([^,]+),([^ ]+)\s?/).flatten
-    end
-
-    def key_for(line)
-      line.match(/-k ([^ ]+)\s?/)[1] if line.include?('-k ')
-    end
-
-    def file_for(line)
-      line.match(/-w ([^ ]+)\s?/)[1]
-    end
-
-    def file_syscall_syntax_for(line)
-      line.match(/-F path=(\S+)\s?/)[1]
-    end
-
-    def permissions_for(line)
-      line.match(/-p ([^ ]+)/)[1].scan(/\w/)
-    end
-
-    def rule_fields_for(line)
-      line.gsub(/-[aS] [^ ]+ /, '').split('-F ').map { |l| l.split(' ') }.flatten
-    end
-
-    def arch_in(fields)
-      fields.each do |field|
-        return field.match(/arch=(\S+)\s?/)[1] if field.start_with?('arch=')
-      end
-      nil
-    end
-
-    def perms_in(fields)
-      fields.each do |field|
-        return field.match(/perm=(\S+)\s?/)[1].scan(/\w/) if field.start_with?('perm=')
-      end
-      nil
-    end
-
-    def path_in(fields)
-      fields.each do |field|
-        return field.match(/path=(\S+)\s?/)[1] if field.start_with?('path=')
-      end
-      nil
-    end
-
-    def exit_in(fields)
-      fields.each do |field|
-        return field.match(/exit=(\S+)\s?/)[1] if field.start_with?('exit=')
-      end
-      nil
-    end
-
-    def key_in(field)
-      _, v = field.split('=')
-      v
-    end
-
-    def remove_key_from(fields)
-      fields.partition { |x| x.start_with? 'key' }
-    end
-  end
-end
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+# author: Jen Burns
+
+require 'forwardable'
+require 'utils/filter_array'
+require 'utils/filter'
+require 'utils/parser'
+
+module Inspec::Resources
+  class AuditDaemon < Inspec.resource(1)
+    extend Forwardable
+    attr_accessor :lines
+    attr_reader :params
+
+    name 'auditd'
+    desc 'Use the auditd InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files. These rules are output using the auditcl -l command.'
+    example "
+      describe auditd.syscall('chown').where {arch == 'b32'} do
+        its('action') { should eq ['always'] }
+        its('list') { should eq ['exit'] }
+      end
+
+      describe auditd.where {key == 'privileged'} do
+        its('permissions') { should include ['x'] }
+      end
+
+      describe auditd do
+        its('lines') { should include %r(-w /etc/ssh/sshd_config) }
+      end
+    "
+
+    def initialize
+      @content = inspec.command('/sbin/auditctl -l').stdout.chomp
+      @params = []
+
+      if @content =~ /^LIST_RULES:/
+        return skip_resource 'The version of audit is outdated. The `auditd` resource supports versions of audit >= 2.3.'
+      end
+      parse_content
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:file,         field: 'file')
+          .add(:list,         field: 'list')
+          .add(:action,       field: 'action')
+          .add(:fields,       field: 'fields')
+          .add(:fields_nokey, field: 'fields_nokey')
+          .add(:syscall,      field: 'syscall')
+          .add(:key,          field: 'key')
+          .add(:arch,         field: 'arch')
+          .add(:path,         field: 'path')
+          .add(:permissions,  field: 'permissions')
+          .add(:exit,         field: 'exit')
+
+    filter.connect(self, :params)
+
+    def status(name = nil)
+      @status_content ||= inspec.command('/sbin/auditctl -s').stdout.chomp
+      @status_params ||= Hash[@status_content.scan(/^([^ ]+) (.*)$/)]
+
+      return @status_params[name] if name
+      @status_params
+    end
+
+    def parse_content
+      @lines = @content.lines.map(&:chomp)
+
+      lines.each do |line|
+        if is_file_syscall_syntax?(line)
+          file_syscall_syntax_rules_for(line)
+        end
+
+        if is_syscall?(line)
+          syscall_rules_for(line)
+
+        elsif is_file?(line)
+          file_rules_for(line)
+        end
+      end
+    end
+
+    def file_syscall_syntax_rules_for(line)
+      file = file_syscall_syntax_for(line)
+      action, list = action_list_for(line)
+      fields = rule_fields_for(line)
+      key_field, fields_nokey = remove_key_from(fields)
+      key = key_in(key_field.join(''))
+      perms = perms_in(fields)
+
+      @params.push(
+        {
+          'file' => file,
+          'list' => list,
+          'action' => action,
+          'fields' => fields,
+          'permissions' => perms,
+          'key' => key,
+          'fields_nokey' => fields_nokey,
+        },
+      )
+    end
+
+    def syscall_rules_for(line)
+      syscalls = syscalls_for(line)
+      action, list = action_list_for(line)
+      fields = rule_fields_for(line)
+      key_field, fields_nokey = remove_key_from(fields)
+      key = key_in(key_field.join(''))
+      arch = arch_in(fields)
+      path = path_in(fields)
+      perms = perms_in(fields)
+      exit_field = exit_in(fields)
+
+      syscalls.each do |s|
+        @params.push(
+          {
+            'syscall' => s,
+            'list' => list,
+            'action' => action,
+            'fields' => fields,
+            'key' => key,
+            'arch' => arch,
+            'path' => path,
+            'permissions' => perms,
+            'exit' => exit_field,
+            'fields_nokey' => fields_nokey,
+          },
+        )
+      end
+    end
+
+    def file_rules_for(line)
+      file = file_for(line)
+      perms = permissions_for(line)
+      key = key_for(line)
+
+      @params.push(
+        {
+          'file' => file,
+          'key' => key,
+          'permissions' => perms,
+        },
+      )
+    end
+
+    def to_s
+      'Auditd Rules'
+    end
+
+    private
+
+    def is_syscall?(line)
+      line.match(/-S /)
+    end
+
+    def is_file?(line)
+      line.match(/-w /)
+    end
+
+    def is_file_syscall_syntax?(line)
+      line.match(/-F path=/)
+    end
+
+    def syscalls_for(line)
+      line.scan(/-S ([^ ]+)\s?/).flatten.first.split(',')
+    end
+
+    def action_list_for(line)
+      line.scan(/-a ([^,]+),([^ ]+)\s?/).flatten
+    end
+
+    def key_for(line)
+      line.match(/-k ([^ ]+)\s?/)[1] if line.include?('-k ')
+    end
+
+    def file_for(line)
+      line.match(/-w ([^ ]+)\s?/)[1]
+    end
+
+    def file_syscall_syntax_for(line)
+      line.match(/-F path=(\S+)\s?/)[1]
+    end
+
+    def permissions_for(line)
+      line.match(/-p ([^ ]+)/)[1].scan(/\w/)
+    end
+
+    def rule_fields_for(line)
+      line.gsub(/-[aS] [^ ]+ /, '').split('-F ').map { |l| l.split(' ') }.flatten
+    end
+
+    def arch_in(fields)
+      fields.each do |field|
+        return field.match(/arch=(\S+)\s?/)[1] if field.start_with?('arch=')
+      end
+      nil
+    end
+
+    def perms_in(fields)
+      fields.each do |field|
+        return field.match(/perm=(\S+)\s?/)[1].scan(/\w/) if field.start_with?('perm=')
+      end
+      nil
+    end
+
+    def path_in(fields)
+      fields.each do |field|
+        return field.match(/path=(\S+)\s?/)[1] if field.start_with?('path=')
+      end
+      nil
+    end
+
+    def exit_in(fields)
+      fields.each do |field|
+        return field.match(/exit=(\S+)\s?/)[1] if field.start_with?('exit=')
+      end
+      nil
+    end
+
+    def key_in(field)
+      _, v = field.split('=')
+      v
+    end
+
+    def remove_key_from(fields)
+      fields.partition { |x| x.start_with? 'key' }
+    end
+  end
+end