inspec 2.1.0 → 2.1.10

data/lib/resources/apache.rb

@@ -1,48 +1,48 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-module Inspec::Resources
-  class Apache < Inspec.resource(1)
-    name 'apache'
-    supports platform: 'unix'
-    desc 'Use the apache InSpec audit resource to retrieve Apache environment settings.'
-    example "
-      describe apache do
-        its ('service') { should cmp 'apache2' }
-      end
-
-      describe apache do
-        its ('conf_dir') { should cmp '/etc/apache2' }
-      end
-
-      describe apache do
-        its ('conf_path') { should cmp '/etc/apache2/apache2.conf' }
-      end
-
-      describe apache do
-        its ('user') { should cmp 'www-data' }
-      end
-    "
-
-    attr_reader :service, :conf_dir, :conf_path, :user
-    def initialize
-      warn '[DEPRECATED] The `apache` resource is deprecated and will be removed in InSpec 3.0.'
-
-      if inspec.os.debian?
-        @service = 'apache2'
-        @conf_dir = '/etc/apache2/'
-        @conf_path = File.join @conf_dir, 'apache2.conf'
-        @user = 'www-data'
-      else
-        @service = 'httpd'
-        @conf_dir = '/etc/httpd/'
-        @conf_path = File.join @conf_dir, '/conf/httpd.conf'
-        @user = 'apache'
-      end
-    end
-
-    def to_s
-      'Apache Environment'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+module Inspec::Resources
+  class Apache < Inspec.resource(1)
+    name 'apache'
+    supports platform: 'unix'
+    desc 'Use the apache InSpec audit resource to retrieve Apache environment settings.'
+    example "
+      describe apache do
+        its ('service') { should cmp 'apache2' }
+      end
+
+      describe apache do
+        its ('conf_dir') { should cmp '/etc/apache2' }
+      end
+
+      describe apache do
+        its ('conf_path') { should cmp '/etc/apache2/apache2.conf' }
+      end
+
+      describe apache do
+        its ('user') { should cmp 'www-data' }
+      end
+    "
+
+    attr_reader :service, :conf_dir, :conf_path, :user
+    def initialize
+      warn '[DEPRECATED] The `apache` resource is deprecated and will be removed in InSpec 3.0.'
+
+      if inspec.os.debian?
+        @service = 'apache2'
+        @conf_dir = '/etc/apache2/'
+        @conf_path = File.join @conf_dir, 'apache2.conf'
+        @user = 'www-data'
+      else
+        @service = 'httpd'
+        @conf_dir = '/etc/httpd/'
+        @conf_path = File.join @conf_dir, '/conf/httpd.conf'
+        @user = 'apache'
+      end
+    end
+
+    def to_s
+      'Apache Environment'
+    end
+  end
+end

data/lib/resources/apache_conf.rb

@@ -1,156 +1,149 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-require 'utils/simpleconfig'
-require 'utils/find_files'
-
-module Inspec::Resources
-  class ApacheConf < Inspec.resource(1)
-    name 'apache_conf'
-    supports platform: 'linux'
-    supports platform: 'debian'
-    desc 'Use the apache_conf InSpec audit resource to test the configuration settings for Apache. This file is typically located under /etc/apache2 on the Debian and Ubuntu platforms and under /etc/httpd on the Fedora, CentOS, Red Hat Enterprise Linux, and Arch Linux platforms. The configuration settings may vary significantly from platform to platform.'
-    example "
-      describe apache_conf do
-        its('setting_name') { should eq 'value' }
-      end
-    "
-
-    include FindFiles
-
-    attr_reader :conf_path
-
-    def initialize(conf_path = nil)
-      @conf_path = conf_path || default_conf_path
-      @files_contents = {}
-      @content = nil
-      @params = nil
-      read_content
-    end
-
-    def content
-      @content ||= read_content
-    end
-
-    def params(*opts)
-      @params || read_content
-      res = @params
-      opts.each do |opt|
-        res = res[opt] unless res.nil?
-      end
-      res
-    end
-
-    def method_missing(name)
-      # ensure params are loaded
-      @params || read_content
-
-      # extract values
-      @params[name.to_s] unless @params.nil?
-    end
-
-    def filter_comments(data)
-      content = ''
-      data.each_line do |line|
-        if !line.match(/^\s*#/)
-          content << line
-        end
-      end
-      content
-    end
-
-    def read_content
-      @content = ''
-      @params = {}
-
-      # skip if the main configuration file doesn't exist
-      file = inspec.file(conf_path)
-      if !file.file?
-        return skip_resource "Can't find file \"#{conf_path}\""
-      end
-
-      raw_conf = file.content
-      if raw_conf.empty? && !file.empty?
-        return skip_resource("Can't read file \"#{conf_path}\"")
-      end
-
-      to_read = [conf_path]
-      until to_read.empty?
-        raw_conf = read_file(to_read[0])
-        @content += raw_conf
-
-        # An explaination of the below regular expression.
-        # Creates two capture groups.
-        # The first group captures the first group of non-whitespace character
-        # surrounded whitespace characters.
-        # The second group contains a conditional with a positive lookahead
-        # (does the line end with one or more spaces?). If the lookahead succeeds
-        # a non-greedy capture takes place, if it fails then a greedy capture takes place.
-        # The regex is terminated by an expression that matches zero or more spaces.
-        params = SimpleConfig.new(
-          raw_conf,
-          assignment_regex: /^\s*(\S+)\s+((?=.*\s+$).*?|.*)\s*$/,
-          multiple_values: true,
-        ).params
-        @params.merge!(params)
-
-        to_read = to_read.drop(1)
-        to_read += include_files(params).find_all do |fp|
-          not @files_contents.key? fp
-        end
-      end
-
-      # fiter comments
-      @content = filter_comments @content
-      @content
-    end
-
-    def include_files(params)
-      # see if there is more config files to include
-      include_files = params['Include'] || []
-      include_files_optional = params['IncludeOptional'] || []
-
-      includes = []
-      (include_files + include_files_optional).each do |f|
-        id    = Pathname.new(f).absolute? ? f : File.join(conf_dir, f)
-        files = find_files(id, depth: 1, type: 'file')
-        files += find_files(id, depth: 1, type: 'link')
-
-        includes.push(files) if files
-      end
-
-      # [].flatten! == nil
-      includes.flatten! || []
-    end
-
-    def read_file(path)
-      @files_contents[path] ||= inspec.file(path).content
-    end
-
-    def conf_dir
-      if inspec.os.debian?
-        File.dirname(conf_path)
-      else
-        # On RHEL-based systems, the configuration is usually in a /conf directory
-        # that contains the primary config file. We assume the "config path" is the
-        # directory that contains the /conf directory, such as /etc/httpd, so that
-        # the conf.d directory can be properly located.
-        Pathname.new(File.dirname(conf_path)).parent.to_s
-      end
-    end
-
-    def to_s
-      "Apache Config #{conf_path}"
-    end
-
-    private
-
-    def default_conf_path
-      if inspec.os.debian?
-        '/etc/apache2/apache2.conf'
-      else
-        '/etc/httpd/conf/httpd.conf'
-      end
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'utils/simpleconfig'
+require 'utils/find_files'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class ApacheConf < Inspec.resource(1)
+    name 'apache_conf'
+    supports platform: 'linux'
+    supports platform: 'debian'
+    desc 'Use the apache_conf InSpec audit resource to test the configuration settings for Apache. This file is typically located under /etc/apache2 on the Debian and Ubuntu platforms and under /etc/httpd on the Fedora, CentOS, Red Hat Enterprise Linux, and Arch Linux platforms. The configuration settings may vary significantly from platform to platform.'
+    example "
+      describe apache_conf do
+        its('setting_name') { should eq 'value' }
+      end
+    "
+
+    include FindFiles
+    include FileReader
+
+    attr_reader :conf_path
+
+    def initialize(conf_path = nil)
+      @conf_path = conf_path || default_conf_path
+      @files_contents = {}
+      @content = nil
+      @params = nil
+      read_content
+    end
+
+    def content
+      @content ||= read_content
+    end
+
+    def params(*opts)
+      @params || read_content
+      res = @params
+      opts.each do |opt|
+        res = res[opt] unless res.nil?
+      end
+      res
+    end
+
+    def method_missing(name)
+      # ensure params are loaded
+      @params || read_content
+
+      # extract values
+      @params[name.to_s] unless @params.nil?
+    end
+
+    def filter_comments(data)
+      content = ''
+      data.each_line do |line|
+        if !line.match(/^\s*#/)
+          content << line
+        end
+      end
+      content
+    end
+
+    def read_content
+      @content = ''
+      @params = {}
+
+      read_file_content(conf_path)
+
+      to_read = [conf_path]
+      until to_read.empty?
+        raw_conf = read_file(to_read[0])
+        @content += raw_conf
+
+        # An explaination of the below regular expression.
+        # Creates two capture groups.
+        # The first group captures the first group of non-whitespace character
+        # surrounded whitespace characters.
+        # The second group contains a conditional with a positive lookahead
+        # (does the line end with one or more spaces?). If the lookahead succeeds
+        # a non-greedy capture takes place, if it fails then a greedy capture takes place.
+        # The regex is terminated by an expression that matches zero or more spaces.
+        params = SimpleConfig.new(
+          raw_conf,
+          assignment_regex: /^\s*(\S+)\s+((?=.*\s+$).*?|.*)\s*$/,
+          multiple_values: true,
+        ).params
+        @params.merge!(params)
+
+        to_read = to_read.drop(1)
+        to_read += include_files(params).find_all do |fp|
+          not @files_contents.key? fp
+        end
+      end
+
+      # fiter comments
+      @content = filter_comments @content
+      @content
+    end
+
+    def include_files(params)
+      # see if there is more config files to include
+      include_files = params['Include'] || []
+      include_files_optional = params['IncludeOptional'] || []
+
+      includes = []
+      (include_files + include_files_optional).each do |f|
+        id    = Pathname.new(f).absolute? ? f : File.join(conf_dir, f)
+        files = find_files(id, depth: 1, type: 'file')
+        files += find_files(id, depth: 1, type: 'link')
+
+        includes.push(files) if files
+      end
+
+      # [].flatten! == nil
+      includes.flatten! || []
+    end
+
+    def read_file(path)
+      @files_contents[path] ||= read_file_content(path)
+    end
+
+    def conf_dir
+      if inspec.os.debian?
+        File.dirname(conf_path)
+      else
+        # On RHEL-based systems, the configuration is usually in a /conf directory
+        # that contains the primary config file. We assume the "config path" is the
+        # directory that contains the /conf directory, such as /etc/httpd, so that
+        # the conf.d directory can be properly located.
+        Pathname.new(File.dirname(conf_path)).parent.to_s
+      end
+    end
+
+    def to_s
+      "Apache Config #{conf_path}"
+    end
+
+    private
+
+    def default_conf_path
+      if inspec.os.debian?
+        '/etc/apache2/apache2.conf'
+      else
+        '/etc/httpd/conf/httpd.conf'
+      end
+    end
+  end
+end

data/lib/resources/apt.rb

@@ -1,149 +1,149 @@
-# encoding: utf-8
-
-# Verifies apt and ppa repositories
-#
-# Usage:
-# describe apt('ubuntu-wine/ppa') do
-#   it { should exist }
-#   it { should be_enabled }
-# end
-#
-# it also understands a ppa url
-# describe apt('ppa:ubuntu-wine/ppa') do
-#   it { should exist }
-#   it { should be_enabled }
-# end
-#
-# The following ppa formats are supported:
-# - ubuntu-wine/ppa
-# - ppa:ubuntu-wine/ppa
-# - http://ppa.launchpad.net/juju/stable/ubuntu
-#
-# Install a ppa as following:
-# apt-get install python-software-properties
-# apt-get install software-properties-common
-# add-apt-repository ppa:ubuntu-wine/ppa
-
-require 'uri'
-
-module Inspec::Resources
-  class AptRepository < Inspec.resource(1)
-    name 'apt'
-    supports platform: 'unix'
-    desc 'Use the apt InSpec audit resource to verify Apt repositories on the Debian and Ubuntu platforms, and also PPA repositories on the Ubuntu platform.'
-    example "
-      describe apt('nginx/stable') do
-        it { should exist }
-        it { should be_enabled }
-      end
-    "
-
-    def initialize(ppa_name)
-      @deb_url = nil
-      # check if the os is ubuntu or debian
-      if inspec.os.debian?
-        @deb_url = determine_ppa_url(ppa_name)
-      else
-        # this resource is only supported on ubuntu and debian
-        skip_resource 'The `apt` resource is not supported on your OS yet.'
-      end
-    end
-
-    def exists?
-      find_repo.count > 0
-    end
-
-    def enabled?
-      return false if find_repo.count == 0
-      actives = find_repo.map { |repo| repo[:active] }
-      actives = actives.uniq
-      actives.size == 1 && actives[0] = true
-    end
-
-    def to_s
-      "Apt Repository #{@deb_url}"
-    end
-
-    private
-
-    def find_repo
-      read_debs.select { |repo| repo[:url] == @deb_url && repo[:type] == 'deb' }
-    end
-
-    HTTP_URL_RE = /\A#{URI::DEFAULT_PARSER.make_regexp(%w{http https})}\z/
-
-    # read
-    def read_debs
-      return @repo_cache if defined?(@repo_cache)
-
-      # load all lists
-      cmd = inspec.command("find /etc/apt/ -name \*.list -exec sh -c 'cat {} || echo -n' \\;")
-
-      # @see https://help.ubuntu.com/community/Repositories/CommandLine#Explanation_of_the_Repository_Format
-      @repo_cache = cmd.stdout.chomp.split("\n").each_with_object([]) do |raw_line, lines|
-        active = true
-
-        # detect if the repo is commented out
-        line = raw_line.gsub(/^(#\s*)*/, '')
-        active = false if raw_line != line
-
-        # eg.: deb http://archive.ubuntu.com/ubuntu/ wily main restricted
-        # or : deb [trusted=yes] http://archive.ubuntu.com/ubuntu/ wily main restricted
-        parse_repo = /^\s*(\S+)\s+(?:\[\S+\])?\s*"?([^ "\t\r\n\f]+)"?\s+(\S+)\s+(.*)$/.match(line)
-
-        # check if we got any result and the second param is an url
-        next if parse_repo.nil? || !parse_repo[2] =~ HTTP_URL_RE
-
-        # map data
-        repo = {
-          type: parse_repo[1],
-          url: parse_repo[2],
-          distro: parse_repo[3],
-          components: parse_repo[4].chomp.split(' '),
-          active: active,
-        }
-        next unless ['deb', 'deb-src'].include? repo[:type]
-
-        lines.push(repo)
-      end
-    end
-
-    # resolves ppa urls
-    # @see http://bazaar.launchpad.net/~ubuntu-core-dev/software-properties/main/view/head:/softwareproperties/ppa.py
-    def determine_ppa_url(ppa_url)
-      # verify if we have the url already, then just return
-      return ppa_url if ppa_url =~ HTTP_URL_RE
-      # otherwise start generating the ppa url
-
-      # special care if the name stats with :
-      ppa_url = ppa_url.split(':')[1] if ppa_url.start_with?('ppa:')
-
-      # parse ppa owner and repo
-      ppa_owner, ppa_repo = ppa_url.split('/')
-      ppa_repo = 'ppa' if ppa_repo.nil?
-
-      # construct new ppa url and return it
-      format('http://ppa.launchpad.net/%s/%s/ubuntu', ppa_owner, ppa_repo)
-    end
-  end
-
-  # for compatability with serverspec
-  # this is deprecated syntax and will be removed in future versions
-  class PpaRepository < AptRepository
-    name 'ppa'
-
-    def exists?
-      deprecated
-      super()
-    end
-
-    def enabled?
-      deprecated
-      super()
-    end
-
-    def deprecated
-      warn '[DEPRECATION] `ppa(reponame)` is deprecated.  Please use `apt(reponame)` instead.'
-    end
-  end
-end
+# encoding: utf-8
+
+# Verifies apt and ppa repositories
+#
+# Usage:
+# describe apt('ubuntu-wine/ppa') do
+#   it { should exist }
+#   it { should be_enabled }
+# end
+#
+# it also understands a ppa url
+# describe apt('ppa:ubuntu-wine/ppa') do
+#   it { should exist }
+#   it { should be_enabled }
+# end
+#
+# The following ppa formats are supported:
+# - ubuntu-wine/ppa
+# - ppa:ubuntu-wine/ppa
+# - http://ppa.launchpad.net/juju/stable/ubuntu
+#
+# Install a ppa as following:
+# apt-get install python-software-properties
+# apt-get install software-properties-common
+# add-apt-repository ppa:ubuntu-wine/ppa
+
+require 'uri'
+
+module Inspec::Resources
+  class AptRepository < Inspec.resource(1)
+    name 'apt'
+    supports platform: 'unix'
+    desc 'Use the apt InSpec audit resource to verify Apt repositories on the Debian and Ubuntu platforms, and also PPA repositories on the Ubuntu platform.'
+    example "
+      describe apt('nginx/stable') do
+        it { should exist }
+        it { should be_enabled }
+      end
+    "
+
+    def initialize(ppa_name)
+      @deb_url = nil
+      # check if the os is ubuntu or debian
+      if inspec.os.debian?
+        @deb_url = determine_ppa_url(ppa_name)
+      else
+        # this resource is only supported on ubuntu and debian
+        skip_resource 'The `apt` resource is not supported on your OS yet.'
+      end
+    end
+
+    def exists?
+      find_repo.count > 0
+    end
+
+    def enabled?
+      return false if find_repo.count == 0
+      actives = find_repo.map { |repo| repo[:active] }
+      actives = actives.uniq
+      actives.size == 1 && actives[0] = true
+    end
+
+    def to_s
+      "Apt Repository #{@deb_url}"
+    end
+
+    private
+
+    def find_repo
+      read_debs.select { |repo| repo[:url] == @deb_url && repo[:type] == 'deb' }
+    end
+
+    HTTP_URL_RE = /\A#{URI::DEFAULT_PARSER.make_regexp(%w{http https})}\z/
+
+    # read
+    def read_debs
+      return @repo_cache if defined?(@repo_cache)
+
+      # load all lists
+      cmd = inspec.command("find /etc/apt/ -name \*.list -exec sh -c 'cat {} || echo -n' \\;")
+
+      # @see https://help.ubuntu.com/community/Repositories/CommandLine#Explanation_of_the_Repository_Format
+      @repo_cache = cmd.stdout.chomp.split("\n").each_with_object([]) do |raw_line, lines|
+        active = true
+
+        # detect if the repo is commented out
+        line = raw_line.gsub(/^(#\s*)*/, '')
+        active = false if raw_line != line
+
+        # eg.: deb http://archive.ubuntu.com/ubuntu/ wily main restricted
+        # or : deb [trusted=yes] http://archive.ubuntu.com/ubuntu/ wily main restricted
+        parse_repo = /^\s*(\S+)\s+(?:\[\S+\])?\s*"?([^ "\t\r\n\f]+)"?\s+(\S+)\s+(.*)$/.match(line)
+
+        # check if we got any result and the second param is an url
+        next if parse_repo.nil? || !parse_repo[2] =~ HTTP_URL_RE
+
+        # map data
+        repo = {
+          type: parse_repo[1],
+          url: parse_repo[2],
+          distro: parse_repo[3],
+          components: parse_repo[4].chomp.split(' '),
+          active: active,
+        }
+        next unless ['deb', 'deb-src'].include? repo[:type]
+
+        lines.push(repo)
+      end
+    end
+
+    # resolves ppa urls
+    # @see http://bazaar.launchpad.net/~ubuntu-core-dev/software-properties/main/view/head:/softwareproperties/ppa.py
+    def determine_ppa_url(ppa_url)
+      # verify if we have the url already, then just return
+      return ppa_url if ppa_url =~ HTTP_URL_RE
+      # otherwise start generating the ppa url
+
+      # special care if the name stats with :
+      ppa_url = ppa_url.split(':')[1] if ppa_url.start_with?('ppa:')
+
+      # parse ppa owner and repo
+      ppa_owner, ppa_repo = ppa_url.split('/')
+      ppa_repo = 'ppa' if ppa_repo.nil?
+
+      # construct new ppa url and return it
+      format('http://ppa.launchpad.net/%s/%s/ubuntu', ppa_owner, ppa_repo)
+    end
+  end
+
+  # for compatability with serverspec
+  # this is deprecated syntax and will be removed in future versions
+  class PpaRepository < AptRepository
+    name 'ppa'
+
+    def exists?
+      deprecated
+      super()
+    end
+
+    def enabled?
+      deprecated
+      super()
+    end
+
+    def deprecated
+      warn '[DEPRECATION] `ppa(reponame)` is deprecated.  Please use `apt(reponame)` instead.'
+    end
+  end
+end