inspec 2.1.0 → 2.1.10

data/lib/resources/key_rsa.rb

@@ -1,67 +1,61 @@
-# encoding: utf-8
-
-require 'openssl'
-require 'hashie/mash'
-
-module Inspec::Resources
-  class RsaKey < Inspec.resource(1)
-    name 'key_rsa'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    desc 'public/private RSA key pair test'
-    example "
-      describe key_rsa('/etc/pki/www.mywebsite.com.key') do
-        its('public_key') { should match /BEGIN RSA PUBLIC KEY/ }
-      end
-
-      describe key_rsa('/etc/pki/www.mywebsite.com.key', 'passphrase') do
-        it { should be_private }
-        it { should be_public }
-      end
-    "
-
-    def initialize(keypath, passphrase = nil)
-      @key_path = keypath
-      @key_file = inspec.file(@key_path)
-      @key = nil
-      @passphrase = passphrase
-
-      return skip_resource "Unable to find key file #{@key_path}" unless @key_file.exist?
-
-      begin
-        @key = OpenSSL::PKey.read(@key_file.content, @passphrase)
-      rescue OpenSSL::PKey::RSAError => _
-        return skip_resource "Unable to load key file #{@key_path}"
-      end
-    end
-
-    def public?
-      return if @key.nil?
-      @key.public?
-    end
-
-    def public_key
-      return if @key.nil?
-      @key.public_key.to_s
-    end
-
-    def private?
-      return if @key.nil?
-      @key.private?
-    end
-
-    def private_key
-      return if @key.nil?
-      @key.to_s
-    end
-
-    def key_length
-      return if @key.nil?
-      @key.public_key.n.num_bytes * 8
-    end
-
-    def to_s
-      "rsa_key #{@key_path}"
-    end
-  end
-end
+# encoding: utf-8
+
+require 'openssl'
+require 'hashie/mash'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class RsaKey < Inspec.resource(1)
+    name 'key_rsa'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'public/private RSA key pair test'
+    example "
+      describe key_rsa('/etc/pki/www.mywebsite.com.key') do
+        its('public_key') { should match /BEGIN RSA PUBLIC KEY/ }
+      end
+
+      describe key_rsa('/etc/pki/www.mywebsite.com.key', 'passphrase') do
+        it { should be_private }
+        it { should be_public }
+      end
+    "
+
+    include FileReader
+
+    def initialize(keypath, passphrase = nil)
+      @key_path = keypath
+      @passphrase = passphrase
+      @key = OpenSSL::PKey.read(read_file_content(@key_path, allow_empty: true), @passphrase)
+    end
+
+    def public?
+      return if @key.nil?
+      @key.public?
+    end
+
+    def public_key
+      return if @key.nil?
+      @key.public_key.to_s
+    end
+
+    def private?
+      return if @key.nil?
+      @key.private?
+    end
+
+    def private_key
+      return if @key.nil?
+      @key.to_s
+    end
+
+    def key_length
+      return if @key.nil?
+      @key.public_key.n.num_bytes * 8
+    end
+
+    def to_s
+      "rsa_key #{@key_path}"
+    end
+  end
+end

data/lib/resources/limits_conf.rb

@@ -1,55 +1,46 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-require 'utils/simpleconfig'
-
-module Inspec::Resources
-  class LimitsConf < Inspec.resource(1)
-    name 'limits_conf'
-    supports platform: 'unix'
-    desc 'Use the limits_conf InSpec audit resource to test configuration settings in the /etc/security/limits.conf file. The limits.conf defines limits for processes (by user and/or group names) and helps ensure that the system on which those processes are running remains stable. Each process may be assigned a hard or soft limit.'
-    example "
-      describe limits_conf do
-        its('*') { should include ['hard','core','0'] }
-      end
-    "
-
-    def initialize(path = nil)
-      @conf_path = path || '/etc/security/limits.conf'
-    end
-
-    def method_missing(name)
-      read_params[name.to_s]
-    end
-
-    def read_params
-      return @params if defined?(@params)
-
-      # read the file
-      file = inspec.file(@conf_path)
-      if !file.file?
-        skip_resource "Can't find file \"#{@conf_path}\""
-        return @params = {}
-      end
-
-      content = file.content
-      if content.empty? && !file.empty?
-        skip_resource "Can't read file \"#{@conf_path}\""
-        return @params = {}
-      end
-
-      # parse the file
-      conf = SimpleConfig.new(
-        content,
-        assignment_regex: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
-        key_values: 3,
-        multiple_values: true,
-      )
-      @params = conf.params
-    end
-
-    def to_s
-      'limits.conf'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'utils/simpleconfig'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class LimitsConf < Inspec.resource(1)
+    name 'limits_conf'
+    supports platform: 'unix'
+    desc 'Use the limits_conf InSpec audit resource to test configuration settings in the /etc/security/limits.conf file. The limits.conf defines limits for processes (by user and/or group names) and helps ensure that the system on which those processes are running remains stable. Each process may be assigned a hard or soft limit.'
+    example "
+      describe limits_conf do
+        its('*') { should include ['hard','core','0'] }
+      end
+    "
+
+    include FileReader
+
+    def initialize(path = nil)
+      @conf_path = path || '/etc/security/limits.conf'
+      @content = read_file_content(@conf_path)
+    end
+
+    def method_missing(name)
+      read_params[name.to_s]
+    end
+
+    def read_params
+      return @params if defined?(@params)
+
+      # parse the file
+      conf = SimpleConfig.new(
+        @content,
+        assignment_regex: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
+        key_values: 3,
+        multiple_values: true,
+      )
+      @params = conf.params
+    end
+
+    def to_s
+      'limits.conf'
+    end
+  end
+end

data/lib/resources/login_def.rb

@@ -1,66 +1,57 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-require 'utils/simpleconfig'
-
-# Usage:
-#
-# describe login_def do
-#   its('UMASK') {
-#     should eq '077'
-#   }
-#
-#   its('PASS_MAX_DAYS.to_i') {
-#     should be <= 90
-#   }
-# end
-
-module Inspec::Resources
-  class LoginDef < Inspec.resource(1)
-    name 'login_defs'
-    supports platform: 'unix'
-    desc 'Use the login_defs InSpec audit resource to test configuration settings in the /etc/login.defs file. The logins.defs file defines site-specific configuration for the shadow password suite on Linux and UNIX platforms, such as password expiration ranges, minimum/maximum values for automatic selection of user and group identifiers, or the method with which passwords are encrypted.'
-    example "
-      describe login_defs do
-        its('ENCRYPT_METHOD') { should eq 'SHA512' }
-      end
-    "
-
-    def initialize(path = nil)
-      @conf_path = path || '/etc/login.defs'
-    end
-
-    def method_missing(name)
-      read_params[name.to_s]
-    end
-
-    def read_params
-      return @params if defined?(@params)
-
-      # read the file
-      file = inspec.file(@conf_path)
-      if !file.file?
-        skip_resource "Can't find file \"#{@conf_path}\""
-        return @params = {}
-      end
-
-      content = file.content
-      if content.empty? && !file.empty?
-        skip_resource "Can't read file \"#{@conf_path}\""
-        return @params = {}
-      end
-
-      # parse the file
-      conf = SimpleConfig.new(
-        content,
-        assignment_regex: /^\s*(\S+)\s+(\S*)\s*$/,
-        multiple_values: false,
-      )
-      @params = conf.params
-    end
-
-    def to_s
-      'login.defs'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'utils/simpleconfig'
+require 'utils/file_reader'
+
+# Usage:
+#
+# describe login_def do
+#   its('UMASK') {
+#     should eq '077'
+#   }
+#
+#   its('PASS_MAX_DAYS.to_i') {
+#     should be <= 90
+#   }
+# end
+
+module Inspec::Resources
+  class LoginDef < Inspec.resource(1)
+    name 'login_defs'
+    supports platform: 'unix'
+    desc 'Use the login_defs InSpec audit resource to test configuration settings in the /etc/login.defs file. The logins.defs file defines site-specific configuration for the shadow password suite on Linux and UNIX platforms, such as password expiration ranges, minimum/maximum values for automatic selection of user and group identifiers, or the method with which passwords are encrypted.'
+    example "
+      describe login_defs do
+        its('ENCRYPT_METHOD') { should eq 'SHA512' }
+      end
+    "
+
+    include FileReader
+
+    def initialize(path = nil)
+      @conf_path = path || '/etc/login.defs'
+      @content = read_file_content(@conf_path)
+    end
+
+    def method_missing(name)
+      read_params[name.to_s]
+    end
+
+    def read_params
+      return @params if defined?(@params)
+
+      # parse the file
+      conf = SimpleConfig.new(
+        @content,
+        assignment_regex: /^\s*(\S+)\s+(\S*)\s*$/,
+        multiple_values: false,
+      )
+      @params = conf.params
+    end
+
+    def to_s
+      'login.defs'
+    end
+  end
+end

data/lib/resources/mount.rb

@@ -1,88 +1,88 @@
-# encoding: utf-8
-
-require 'utils/simpleconfig'
-
-module Inspec::Resources
-  class Mount < Inspec.resource(1)
-    name 'mount'
-    supports platform: 'unix'
-    desc 'Use the mount InSpec audit resource to test if mount points.'
-    example "
-      describe mount('/') do
-        it { should be_mounted }
-        its('count') { should eq 1 }
-        its('device') { should eq  '/dev/mapper/VolGroup-lv_root' }
-        its('type') { should eq  'ext4' }
-        its('options') { should eq ['rw', 'mode=620'] }
-        its('options') { should include 'nodev' }
-      end
-    "
-    attr_reader :file
-
-    def initialize(path)
-      @path = path
-      @mount_manager = mount_manager_for_os
-      return skip_resource 'The `mount` resource is not supported on your OS yet.' if @mount_manager.nil?
-      @file = inspec.backend.file(@path)
-    end
-
-    def mounted?
-      file.mounted?
-    end
-
-    def count
-      mounted = file.mounted
-      return nil if mounted.nil? || mounted.stdout.nil?
-      mounted.stdout.lines.count
-    end
-
-    def method_missing(name)
-      return nil if !file.mounted?
-
-      mounted = file.mounted
-      return nil if mounted.nil? || mounted.stdout.nil?
-
-      line = mounted.stdout
-      # if we got multiple lines, only use the last entry
-      line = mounted.stdout.lines.to_a.last if mounted.stdout.lines.count > 1
-
-      # parse content if we are on linux
-      @mount_options ||= @mount_manager.parse_mount_options(line)
-      @mount_options[name]
-    end
-
-    def to_s
-      "Mount #{@path}"
-    end
-
-    private
-
-    def mount_manager_for_os
-      os = inspec.os
-      if os.linux?
-        LinuxMounts.new(inspec)
-      elsif ['freebsd'].include?(os[:family])
-        BsdMounts.new(inspec)
-      end
-    end
-  end
-
-  class MountsInfo
-    attr_reader :inspec
-    def initialize(inspec)
-      @inspec = inspec
-    end
-
-    def parse_mount_options(_mount_line, _compatibility = false)
-      raise NotImplementedError
-    end
-  end
-
-  class LinuxMounts < MountsInfo
-    include LinuxMountParser
-  end
-
-  class BsdMounts < MountsInfo
-    include BsdMountParser
-  end
-end
+# encoding: utf-8
+
+require 'utils/simpleconfig'
+
+module Inspec::Resources
+  class Mount < Inspec.resource(1)
+    name 'mount'
+    supports platform: 'unix'
+    desc 'Use the mount InSpec audit resource to test if mount points.'
+    example "
+      describe mount('/') do
+        it { should be_mounted }
+        its('count') { should eq 1 }
+        its('device') { should eq  '/dev/mapper/VolGroup-lv_root' }
+        its('type') { should eq  'ext4' }
+        its('options') { should eq ['rw', 'mode=620'] }
+        its('options') { should include 'nodev' }
+      end
+    "
+    attr_reader :file
+
+    def initialize(path)
+      @path = path
+      @mount_manager = mount_manager_for_os
+      return skip_resource 'The `mount` resource is not supported on your OS yet.' if @mount_manager.nil?
+      @file = inspec.backend.file(@path)
+    end
+
+    def mounted?
+      file.mounted?
+    end
+
+    def count
+      mounted = file.mounted
+      return nil if mounted.nil? || mounted.stdout.nil?
+      mounted.stdout.lines.count
+    end
+
+    def method_missing(name)
+      return nil if !file.mounted?
+
+      mounted = file.mounted
+      return nil if mounted.nil? || mounted.stdout.nil?
+
+      line = mounted.stdout
+      # if we got multiple lines, only use the last entry
+      line = mounted.stdout.lines.to_a.last if mounted.stdout.lines.count > 1
+
+      # parse content if we are on linux
+      @mount_options ||= @mount_manager.parse_mount_options(line)
+      @mount_options[name]
+    end
+
+    def to_s
+      "Mount #{@path}"
+    end
+
+    private
+
+    def mount_manager_for_os
+      os = inspec.os
+      if os.linux?
+        LinuxMounts.new(inspec)
+      elsif ['freebsd'].include?(os[:family])
+        BsdMounts.new(inspec)
+      end
+    end
+  end
+
+  class MountsInfo
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+
+    def parse_mount_options(_mount_line, _compatibility = false)
+      raise NotImplementedError
+    end
+  end
+
+  class LinuxMounts < MountsInfo
+    include LinuxMountParser
+  end
+
+  class BsdMounts < MountsInfo
+    include BsdMountParser
+  end
+end