inspec 1.51.6 → 1.51.15

data/lib/resources/passwd.rb

@@ -1,96 +1,96 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-# author: Christoph Hartmann
-# author: Dominik Richter
-
-# The file format consists of
-# - username
-# - password
-# - userid
-# - groupid
-# - user id info
-# - home directory
-# - command
-
-require 'utils/parser'
-require 'utils/filter'
-
-module Inspec::Resources
-  class Passwd < Inspec.resource(1)
-    name 'passwd'
-    desc 'Use the passwd InSpec audit resource to test the contents of /etc/passwd, which contains the following information for users that may log into the system and/or as users that own running processes.'
-    example "
-      describe passwd do
-        its('users') { should_not include 'forbidden_user' }
-      end
-
-      describe passwd.uids(0) do
-        its('users') { should cmp 'root' }
-        its('count') { should eq 1 }
-      end
-
-      describe passwd.shells(/nologin/) do
-        # find all users with a nologin shell
-        its('users') { should_not include 'my_login_user' }
-      end
-    "
-
-    include PasswdParser
-
-    attr_reader :params
-    attr_reader :content
-    attr_reader :lines
-
-    def initialize(path = nil, opts = nil)
-      opts ||= {}
-      @path = path || '/etc/passwd'
-      @content = opts[:content] || inspec.file(@path).content
-      @lines = @content.to_s.split("\n")
-      @params = parse_passwd(@content)
-    end
-
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:users,     field: 'user')
-          .add(:passwords, field: 'password')
-          .add(:uids,      field: 'uid')
-          .add(:gids,      field: 'gid')
-          .add(:descs,     field: 'desc')
-          .add(:homes,     field: 'home')
-          .add(:shells,    field: 'shell')
-
-    filter.add(:count) { |t, _|
-      warn '[DEPRECATION] `passwd.count` is deprecated. Please use `passwd.entries.length` instead. It will be removed in the next major version.'
-      t.entries.length
-    }
-
-    filter.add(:usernames) { |t, x|
-      warn '[DEPRECATION] `passwd.usernames` is deprecated. Please use `passwd.users` instead. It will be removed in the next major version.'
-      t.users(x)
-    }
-
-    filter.add(:username) { |t, x|
-      warn '[DEPRECATION] `passwd.username` is deprecated. Please use `passwd.users` instead. It will be removed in the next major version.'
-      t.users(x)[0]
-    }
-
-    # rebuild the passwd line from raw content
-    filter.add(:content) { |t, _|
-      t.entries.map do |e|
-        [e.user, e.password, e.uid, e.gid, e.desc, e.home, e.shell].join(':')
-      end.join("\n")
-    }
-
-    def uid(x)
-      warn '[DEPRECATION] `passwd.uid(arg)` is deprecated. Please use `passwd.uids(arg)` instead. It will be removed in the next major version.'
-      uids(x)
-    end
-
-    filter.connect(self, :params)
-
-    def to_s
-      '/etc/passwd'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# The file format consists of
+# - username
+# - password
+# - userid
+# - groupid
+# - user id info
+# - home directory
+# - command
+
+require 'utils/parser'
+require 'utils/filter'
+
+module Inspec::Resources
+  class Passwd < Inspec.resource(1)
+    name 'passwd'
+    desc 'Use the passwd InSpec audit resource to test the contents of /etc/passwd, which contains the following information for users that may log into the system and/or as users that own running processes.'
+    example "
+      describe passwd do
+        its('users') { should_not include 'forbidden_user' }
+      end
+
+      describe passwd.uids(0) do
+        its('users') { should cmp 'root' }
+        its('count') { should eq 1 }
+      end
+
+      describe passwd.shells(/nologin/) do
+        # find all users with a nologin shell
+        its('users') { should_not include 'my_login_user' }
+      end
+    "
+
+    include PasswdParser
+
+    attr_reader :params
+    attr_reader :content
+    attr_reader :lines
+
+    def initialize(path = nil, opts = nil)
+      opts ||= {}
+      @path = path || '/etc/passwd'
+      @content = opts[:content] || inspec.file(@path).content
+      @lines = @content.to_s.split("\n")
+      @params = parse_passwd(@content)
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:users,     field: 'user')
+          .add(:passwords, field: 'password')
+          .add(:uids,      field: 'uid')
+          .add(:gids,      field: 'gid')
+          .add(:descs,     field: 'desc')
+          .add(:homes,     field: 'home')
+          .add(:shells,    field: 'shell')
+
+    filter.add(:count) { |t, _|
+      warn '[DEPRECATION] `passwd.count` is deprecated. Please use `passwd.entries.length` instead. It will be removed in the next major version.'
+      t.entries.length
+    }
+
+    filter.add(:usernames) { |t, x|
+      warn '[DEPRECATION] `passwd.usernames` is deprecated. Please use `passwd.users` instead. It will be removed in the next major version.'
+      t.users(x)
+    }
+
+    filter.add(:username) { |t, x|
+      warn '[DEPRECATION] `passwd.username` is deprecated. Please use `passwd.users` instead. It will be removed in the next major version.'
+      t.users(x)[0]
+    }
+
+    # rebuild the passwd line from raw content
+    filter.add(:content) { |t, _|
+      t.entries.map do |e|
+        [e.user, e.password, e.uid, e.gid, e.desc, e.home, e.shell].join(':')
+      end.join("\n")
+    }
+
+    def uid(x)
+      warn '[DEPRECATION] `passwd.uid(arg)` is deprecated. Please use `passwd.uids(arg)` instead. It will be removed in the next major version.'
+      uids(x)
+    end
+
+    filter.connect(self, :params)
+
+    def to_s
+      '/etc/passwd'
+    end
+  end
+end

data/lib/resources/pip.rb

@@ -1,89 +1,89 @@
-# encoding: utf-8
-# author: Christoph Hartmann
-# author: Dominik Richter
-
-# Usage:
-# describe pip('Jinja2') do
-#   it { should be_installed }
-# end
-#
-
-module Inspec::Resources
-  class PipPackage < Inspec.resource(1)
-    name 'pip'
-    desc 'Use the pip InSpec audit resource to test packages that are installed using the pip installer.'
-    example "
-      describe pip('Jinja2') do
-        it { should be_installed }
-      end
-
-      describe pip('django', '/path/to/virtualenv/bin/pip') do
-        it { should be_installed }
-        its('version') { should eq('1.11.4')}
-      end
-    "
-
-    def initialize(package_name, pip_path = nil)
-      @package_name = package_name
-      @pip_cmd = pip_path || default_pip_path
-      return skip_resource 'pip not found' unless inspec.command(@pip_cmd).exist?
-    end
-
-    def info
-      return @info if defined?(@info)
-
-      @info = {}
-      @info[:type] = 'pip'
-      cmd = inspec.command("#{@pip_cmd} show #{@package_name}")
-      return @info if cmd.exit_status != 0
-
-      params = SimpleConfig.new(
-        cmd.stdout,
-        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
-        multiple_values: false,
-      ).params
-      @info[:name] = params['Name']
-      @info[:version] = params['Version']
-      @info[:installed] = true
-      @info
-    end
-
-    def installed?
-      info[:installed] == true
-    end
-
-    def version
-      info[:version]
-    end
-
-    def to_s
-      "Pip Package #{@package_name}"
-    end
-
-    private
-
-    def default_pip_path
-      return 'pip' unless inspec.os.windows?
-
-      # Pip is not on the default path for Windows, therefore we do some logic
-      # to find the binary on Windows
-      cmd = inspec.command('New-Object -Type PSObject | Add-Member -MemberType NoteProperty -Name Pip -Value (Invoke-Command -ScriptBlock {where.exe pip}) -PassThru | Add-Member -MemberType NoteProperty -Name Python -Value (Invoke-Command -ScriptBlock {where.exe python}) -PassThru | ConvertTo-Json')
-      begin
-        paths = JSON.parse(cmd.stdout)
-        # use pip if it on system path
-        pipcmd = paths['Pip']
-        # calculate path on windows
-        if defined?(paths['Python']) && pipcmd.nil?
-          pipdir = paths['Python'].split('\\')
-          # remove python.exe
-          pipdir.pop
-          pipcmd = pipdir.push('Scripts').push('pip.exe').join('/')
-        end
-      rescue JSON::ParserError => _e
-        return nil
-      end
-
-      pipcmd
-    end
-  end
-end
+# encoding: utf-8
+# author: Christoph Hartmann
+# author: Dominik Richter
+
+# Usage:
+# describe pip('Jinja2') do
+#   it { should be_installed }
+# end
+#
+
+module Inspec::Resources
+  class PipPackage < Inspec.resource(1)
+    name 'pip'
+    desc 'Use the pip InSpec audit resource to test packages that are installed using the pip installer.'
+    example "
+      describe pip('Jinja2') do
+        it { should be_installed }
+      end
+
+      describe pip('django', '/path/to/virtualenv/bin/pip') do
+        it { should be_installed }
+        its('version') { should eq('1.11.4')}
+      end
+    "
+
+    def initialize(package_name, pip_path = nil)
+      @package_name = package_name
+      @pip_cmd = pip_path || default_pip_path
+      return skip_resource 'pip not found' unless inspec.command(@pip_cmd).exist?
+    end
+
+    def info
+      return @info if defined?(@info)
+
+      @info = {}
+      @info[:type] = 'pip'
+      cmd = inspec.command("#{@pip_cmd} show #{@package_name}")
+      return @info if cmd.exit_status != 0
+
+      params = SimpleConfig.new(
+        cmd.stdout,
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        multiple_values: false,
+      ).params
+      @info[:name] = params['Name']
+      @info[:version] = params['Version']
+      @info[:installed] = true
+      @info
+    end
+
+    def installed?
+      info[:installed] == true
+    end
+
+    def version
+      info[:version]
+    end
+
+    def to_s
+      "Pip Package #{@package_name}"
+    end
+
+    private
+
+    def default_pip_path
+      return 'pip' unless inspec.os.windows?
+
+      # Pip is not on the default path for Windows, therefore we do some logic
+      # to find the binary on Windows
+      cmd = inspec.command('New-Object -Type PSObject | Add-Member -MemberType NoteProperty -Name Pip -Value (Invoke-Command -ScriptBlock {where.exe pip}) -PassThru | Add-Member -MemberType NoteProperty -Name Python -Value (Invoke-Command -ScriptBlock {where.exe python}) -PassThru | ConvertTo-Json')
+      begin
+        paths = JSON.parse(cmd.stdout)
+        # use pip if it on system path
+        pipcmd = paths['Pip']
+        # calculate path on windows
+        if defined?(paths['Python']) && pipcmd.nil?
+          pipdir = paths['Python'].split('\\')
+          # remove python.exe
+          pipdir.pop
+          pipcmd = pipdir.push('Scripts').push('pip.exe').join('/')
+        end
+      rescue JSON::ParserError => _e
+        return nil
+      end
+
+      pipcmd
+    end
+  end
+end

data/lib/resources/platform.rb

@@ -1,112 +1,112 @@
-# encoding: utf-8
-
-module Inspec::Resources
-  class PlatformResource < Inspec.resource(1)
-    name 'platform'
-    desc 'Use the platform InSpec resource to test the platform on which the system is running.'
-    example "
-      describe platform do
-        its('name') { should eq 'redhat' }
-      end
-
-      describe platform do
-        it { should be_in_family('unix') }
-      end
-    "
-
-    def initialize
-      @platform = inspec.backend.os
-    end
-
-    # add helper methods for easy access of properties
-    %w{family release arch}.each do |property|
-      define_method(property.to_sym) do
-        @platform.send(property)
-      end
-    end
-
-    # This is a string override for platform.name.
-    # TODO: removed in inspec 2.0
-    class NameCleaned < String
-      def ==(other)
-        if other =~ /[A-Z ]/
-          cleaned = other.downcase.tr(' ', '_')
-          Inspec::Log.warn "[DEPRECATED] Platform names will become lowercase in InSpec 2.0. Please match on '#{cleaned}' instead of '#{other}'"
-          super(cleaned)
-        else
-          super(other)
-        end
-      end
-    end
-
-    def name
-      NameCleaned.new(@platform.name)
-    end
-
-    def [](key)
-      # convert string to symbol
-      key = key.to_sym if key.is_a? String
-      return name if key == :name
-
-      @platform[key]
-    end
-
-    def platform?(name)
-      @platform.name == name ||
-        @platform.family_hierarchy.include?(name)
-    end
-
-    def in_family?(family)
-      @platform.family_hierarchy.include?(family)
-    end
-
-    def families
-      @platform.family_hierarchy
-    end
-
-    def supported?(supports)
-      return true if supports.nil? || supports.empty?
-
-      status = true
-      supports.each do |s|
-        s.each do |k, v|
-          # ignore the inspec check for supports
-          # TODO: remove in inspec 2.0
-          if k == :inspec
-            next
-          elsif %i(os_family os-family platform_family platform-family).include?(k)
-            status = in_family?(v)
-          elsif %i(os platform).include?(k)
-            status = platform?(v)
-          elsif %i(os_name os-name platform_name platform-name).include?(k)
-            status = name == v
-          elsif k == :release
-            status = check_release(v)
-          else
-            status = false
-          end
-          break if status == false
-        end
-        return true if status == true
-      end
-
-      status
-    end
-
-    def to_s
-      'Platform Detection'
-    end
-
-    private
-
-    def check_release(value)
-      # allow wild card matching
-      if value.include?('*')
-        cleaned = Regexp.escape(value).gsub('\*', '.*?')
-        !(release =~ /#{cleaned}/).nil?
-      else
-        release == value
-      end
-    end
-  end
-end
+# encoding: utf-8
+
+module Inspec::Resources
+  class PlatformResource < Inspec.resource(1)
+    name 'platform'
+    desc 'Use the platform InSpec resource to test the platform on which the system is running.'
+    example "
+      describe platform do
+        its('name') { should eq 'redhat' }
+      end
+
+      describe platform do
+        it { should be_in_family('unix') }
+      end
+    "
+
+    def initialize
+      @platform = inspec.backend.os
+    end
+
+    # add helper methods for easy access of properties
+    %w{family release arch}.each do |property|
+      define_method(property.to_sym) do
+        @platform.send(property)
+      end
+    end
+
+    # This is a string override for platform.name.
+    # TODO: removed in inspec 2.0
+    class NameCleaned < String
+      def ==(other)
+        if other =~ /[A-Z ]/
+          cleaned = other.downcase.tr(' ', '_')
+          Inspec::Log.warn "[DEPRECATED] Platform names will become lowercase in InSpec 2.0. Please match on '#{cleaned}' instead of '#{other}'"
+          super(cleaned)
+        else
+          super(other)
+        end
+      end
+    end
+
+    def name
+      NameCleaned.new(@platform.name)
+    end
+
+    def [](key)
+      # convert string to symbol
+      key = key.to_sym if key.is_a? String
+      return name if key == :name
+
+      @platform[key]
+    end
+
+    def platform?(name)
+      @platform.name == name ||
+        @platform.family_hierarchy.include?(name)
+    end
+
+    def in_family?(family)
+      @platform.family_hierarchy.include?(family)
+    end
+
+    def families
+      @platform.family_hierarchy
+    end
+
+    def supported?(supports)
+      return true if supports.nil? || supports.empty?
+
+      status = true
+      supports.each do |s|
+        s.each do |k, v|
+          # ignore the inspec check for supports
+          # TODO: remove in inspec 2.0
+          if k == :inspec
+            next
+          elsif %i(os_family os-family platform_family platform-family).include?(k)
+            status = in_family?(v)
+          elsif %i(os platform).include?(k)
+            status = platform?(v)
+          elsif %i(os_name os-name platform_name platform-name).include?(k)
+            status = name == v
+          elsif k == :release
+            status = check_release(v)
+          else
+            status = false
+          end
+          break if status == false
+        end
+        return true if status == true
+      end
+
+      status
+    end
+
+    def to_s
+      'Platform Detection'
+    end
+
+    private
+
+    def check_release(value)
+      # allow wild card matching
+      if value.include?('*')
+        cleaned = Regexp.escape(value).gsub('\*', '.*?')
+        !(release =~ /#{cleaned}/).nil?
+      else
+        release == value
+      end
+    end
+  end
+end