inspec 2.1.21 → 2.1.30

data/lib/resources/packages.rb

@@ -1,111 +1,111 @@
-# encoding: utf-8
-# copyright: 2017, Chef Software, Inc. <legal@chef.io>
-
-require 'utils/filter'
-
-module Inspec::Resources
-  class Packages < Inspec.resource(1)
-    name 'packages'
-    supports platform: 'unix'
-    desc 'Use the packages InSpec audit resource to test properties for multiple packages installed on the system'
-    example "
-      describe packages(/xserver-xorg.*/) do
-        its('entries') { should be_empty }
-      end
-      describe packages('vim').entries.length do
-        it { should be > 1 }
-      end
-      describe packages(/vi.+/).where { status != 'installed' } do
-        its('statuses') { should be_empty }
-      end
-    "
-
-    def initialize(pattern)
-      os = inspec.os
-      if os.debian?
-        @pkgs = Debs.new(inspec)
-      elsif os.redhat? || %w{suse amazon fedora}.include?(os[:family])
-        @pkgs = Rpms.new(inspec)
-      else
-        return skip_resource "The packages resource is not yet supported on OS #{inspec.os.name}"
-      end
-
-      @pattern = pattern_regexp(pattern)
-      all_pkgs = @pkgs.build_package_list
-      @list = all_pkgs.find_all do |hm|
-        hm[:name] =~ @pattern
-      end
-    end
-
-    def to_s
-      "Packages #{@pattern.class == String ? @pattern : @pattern.inspect}"
-    end
-
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:statuses,  field: 'status', style: :simple)
-          .add(:names,     field: 'name')
-          .add(:versions,  field: 'version')
-          .add(:architectures, field: 'architecture')
-          .connect(self, :filtered_packages)
-
-    private
-
-    def pattern_regexp(p)
-      if p.class == String
-        Regexp.new(Regexp.escape(p))
-      elsif p.class == Regexp
-        p
-      else
-        raise 'Invalid name argument to packages resource, please use a "string" or /regexp/'
-      end
-    end
-
-    def filtered_packages
-      warn "The packages resource is not yet supported on OS #{inspec.os.name}" if resource_skipped?
-      @list
-    end
-  end
-
-  class PkgsManagement
-    PackageStruct = Struct.new(:status, :name, :version, :architecture)
-    attr_reader :inspec
-    def initialize(inspec)
-      @inspec = inspec
-    end
-  end
-
-  # Debian / Ubuntu
-  class Debs < PkgsManagement
-    def build_package_list
-      # use two spaces as delimiter in case any of the fields has a space in it
-      command = "dpkg-query -W -f='${db:Status-Abbrev}  ${Package}  ${Version}  ${Architecture}\\n'"
-      cmd = inspec.command(command)
-      all = cmd.stdout.split("\n")
-      return [] if all.nil?
-      all.map do |m|
-        a = m.split(/ {2,}/)
-        a[0] = 'installed' if a[0] =~ /^.i/
-        a[2] = a[2].split(':').last
-        PackageStruct.new(*a)
-      end
-    end
-  end
-
-  # RedHat family
-  class Rpms < PkgsManagement
-    def build_package_list
-      # use two spaces as delimiter in case any of the fields has a space in it
-      command = "rpm -qa --queryformat '%{NAME}  %{VERSION}-%{RELEASE}  %{ARCH}\\n'" # rubocop:disable Style/FormatStringToken
-      cmd = inspec.command(command)
-      all = cmd.stdout.split("\n")
-      return [] if all.nil?
-      all.map do |m|
-        a = m.split('  ')
-        a.unshift('installed')
-        PackageStruct.new(*a)
-      end
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2017, Chef Software, Inc. <legal@chef.io>
+
+require 'utils/filter'
+
+module Inspec::Resources
+  class Packages < Inspec.resource(1)
+    name 'packages'
+    supports platform: 'unix'
+    desc 'Use the packages InSpec audit resource to test properties for multiple packages installed on the system'
+    example "
+      describe packages(/xserver-xorg.*/) do
+        its('entries') { should be_empty }
+      end
+      describe packages('vim').entries.length do
+        it { should be > 1 }
+      end
+      describe packages(/vi.+/).where { status != 'installed' } do
+        its('statuses') { should be_empty }
+      end
+    "
+
+    def initialize(pattern)
+      os = inspec.os
+      if os.debian?
+        @pkgs = Debs.new(inspec)
+      elsif os.redhat? || %w{suse amazon fedora}.include?(os[:family])
+        @pkgs = Rpms.new(inspec)
+      else
+        return skip_resource "The packages resource is not yet supported on OS #{inspec.os.name}"
+      end
+
+      @pattern = pattern_regexp(pattern)
+      all_pkgs = @pkgs.build_package_list
+      @list = all_pkgs.find_all do |hm|
+        hm[:name] =~ @pattern
+      end
+    end
+
+    def to_s
+      "Packages #{@pattern.class == String ? @pattern : @pattern.inspect}"
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:statuses,  field: 'status', style: :simple)
+          .add(:names,     field: 'name')
+          .add(:versions,  field: 'version')
+          .add(:architectures, field: 'architecture')
+          .connect(self, :filtered_packages)
+
+    private
+
+    def pattern_regexp(p)
+      if p.class == String
+        Regexp.new(Regexp.escape(p))
+      elsif p.class == Regexp
+        p
+      else
+        raise 'Invalid name argument to packages resource, please use a "string" or /regexp/'
+      end
+    end
+
+    def filtered_packages
+      warn "The packages resource is not yet supported on OS #{inspec.os.name}" if resource_skipped?
+      @list
+    end
+  end
+
+  class PkgsManagement
+    PackageStruct = Struct.new(:status, :name, :version, :architecture)
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+  end
+
+  # Debian / Ubuntu
+  class Debs < PkgsManagement
+    def build_package_list
+      # use two spaces as delimiter in case any of the fields has a space in it
+      command = "dpkg-query -W -f='${db:Status-Abbrev}  ${Package}  ${Version}  ${Architecture}\\n'"
+      cmd = inspec.command(command)
+      all = cmd.stdout.split("\n")
+      return [] if all.nil?
+      all.map do |m|
+        a = m.split(/ {2,}/)
+        a[0] = 'installed' if a[0] =~ /^.i/
+        a[2] = a[2].split(':').last
+        PackageStruct.new(*a)
+      end
+    end
+  end
+
+  # RedHat family
+  class Rpms < PkgsManagement
+    def build_package_list
+      # use two spaces as delimiter in case any of the fields has a space in it
+      command = "rpm -qa --queryformat '%{NAME}  %{VERSION}-%{RELEASE}  %{ARCH}\\n'" # rubocop:disable Style/FormatStringToken
+      cmd = inspec.command(command)
+      all = cmd.stdout.split("\n")
+      return [] if all.nil?
+      all.map do |m|
+        a = m.split('  ')
+        a.unshift('installed')
+        PackageStruct.new(*a)
+      end
+    end
+  end
+end

data/lib/resources/parse_config.rb

@@ -1,112 +1,112 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-# Usage example:
-#
-#  audit = command('/sbin/auditctl -l').stdout
-#  options = {
-#    assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
-#    multiple_values: true
-#  }
-#  describe parse_config(audit, options ) do
-
-require 'utils/file_reader'
-
-module Inspec::Resources
-  class PConfig < Inspec.resource(1)
-    name 'parse_config'
-    supports platform: 'unix'
-    supports platform: 'windows'
-    desc 'Use the parse_config InSpec audit resource to test arbitrary configuration files.'
-    example "
-      output = command('some-command').stdout
-      describe parse_config(output, { data_config_option: value } ) do
-        its('setting') { should eq 1 }
-      end
-
-      output2 = command('curl http://127.0.0.1/php_status').stdout
-      # php status is in format 'key : value', and we do not allow for multiple values
-      options2 = {
-        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
-        multiple_values: false
-      }
-
-      describe parse_config(output2, options2) do
-        its('pool') { should eq 'www'}
-        its('process manager') { should eq process_manager }
-      end
-
-      # getting specific key from the output above, convert it to integer and then compare
-      # make sure 'listen queue' is below 100
-      describe parse_config(output2, options2 ).params['listen queue'].to_i do
-        it { should be < 100 }
-      end
-    "
-
-    include FileReader
-
-    attr_reader :content
-    def initialize(content = nil, useropts = nil)
-      @opts = {}
-      @opts = useropts.dup unless useropts.nil?
-      @files_contents = {}
-
-      @content = content
-      read_params unless @content.nil?
-    end
-
-    def method_missing(name)
-      read_params[name.to_s]
-    end
-
-    def params(*opts)
-      opts.inject(read_params) do |res, nxt|
-        res.respond_to?(:key) ? res[nxt] : nil
-      end
-    end
-
-    def to_s
-      "Parse Config #{@conf_path}"
-    end
-
-    private
-
-    def parse_file(conf_path)
-      @conf_path = conf_path
-      @content = read_file(conf_path).to_s
-
-      read_params
-    end
-
-    def read_file(path)
-      @files_contents[path] ||= read_file_content(path)
-    end
-
-    def read_params
-      @params ||= if content.nil?
-                    {}
-                  else
-                    SimpleConfig.new(content, @opts).params
-                  end
-    end
-  end
-
-  class PConfigFile < PConfig
-    name 'parse_config_file'
-    desc 'Use the parse_config_file InSpec resource to test arbitrary configuration files. It works identically to parse_config. Instead of using a command output, this resource works with files.'
-    example "
-      describe parse_config_file('/path/to/file') do
-        its('setting') { should eq 1 }
-      end
-    "
-
-    def initialize(path, opts = nil)
-      super(nil, opts)
-      parse_file(path)
-    end
-
-    def to_s
-      "Parse Config File #{@conf_path}"
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+# Usage example:
+#
+#  audit = command('/sbin/auditctl -l').stdout
+#  options = {
+#    assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+#    multiple_values: true
+#  }
+#  describe parse_config(audit, options ) do
+
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class PConfig < Inspec.resource(1)
+    name 'parse_config'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'Use the parse_config InSpec audit resource to test arbitrary configuration files.'
+    example "
+      output = command('some-command').stdout
+      describe parse_config(output, { data_config_option: value } ) do
+        its('setting') { should eq 1 }
+      end
+
+      output2 = command('curl http://127.0.0.1/php_status').stdout
+      # php status is in format 'key : value', and we do not allow for multiple values
+      options2 = {
+        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
+        multiple_values: false
+      }
+
+      describe parse_config(output2, options2) do
+        its('pool') { should eq 'www'}
+        its('process manager') { should eq process_manager }
+      end
+
+      # getting specific key from the output above, convert it to integer and then compare
+      # make sure 'listen queue' is below 100
+      describe parse_config(output2, options2 ).params['listen queue'].to_i do
+        it { should be < 100 }
+      end
+    "
+
+    include FileReader
+
+    attr_reader :content
+    def initialize(content = nil, useropts = nil)
+      @opts = {}
+      @opts = useropts.dup unless useropts.nil?
+      @files_contents = {}
+
+      @content = content
+      read_params unless @content.nil?
+    end
+
+    def method_missing(name)
+      read_params[name.to_s]
+    end
+
+    def params(*opts)
+      opts.inject(read_params) do |res, nxt|
+        res.respond_to?(:key) ? res[nxt] : nil
+      end
+    end
+
+    def to_s
+      "Parse Config #{@conf_path}"
+    end
+
+    private
+
+    def parse_file(conf_path)
+      @conf_path = conf_path
+      @content = read_file(conf_path).to_s
+
+      read_params
+    end
+
+    def read_file(path)
+      @files_contents[path] ||= read_file_content(path)
+    end
+
+    def read_params
+      @params ||= if content.nil?
+                    {}
+                  else
+                    SimpleConfig.new(content, @opts).params
+                  end
+    end
+  end
+
+  class PConfigFile < PConfig
+    name 'parse_config_file'
+    desc 'Use the parse_config_file InSpec resource to test arbitrary configuration files. It works identically to parse_config. Instead of using a command output, this resource works with files.'
+    example "
+      describe parse_config_file('/path/to/file') do
+        its('setting') { should eq 1 }
+      end
+    "
+
+    def initialize(path, opts = nil)
+      super(nil, opts)
+      parse_file(path)
+    end
+
+    def to_s
+      "Parse Config File #{@conf_path}"
+    end
+  end
+end

data/lib/resources/passwd.rb

@@ -1,76 +1,76 @@
-# encoding: utf-8
-# copyright: 2015, Vulcano Security GmbH
-
-# The file format consists of
-# - username
-# - password
-# - userid
-# - groupid
-# - user id info
-# - home directory
-# - command
-
-require 'utils/parser'
-require 'utils/filter'
-require 'utils/file_reader'
-
-module Inspec::Resources
-  class Passwd < Inspec.resource(1)
-    name 'passwd'
-    supports platform: 'unix'
-    desc 'Use the passwd InSpec audit resource to test the contents of /etc/passwd, which contains the following information for users that may log into the system and/or as users that own running processes.'
-    example "
-      describe passwd do
-        its('users') { should_not include 'forbidden_user' }
-      end
-
-      describe passwd.uids(0) do
-        its('users') { should cmp 'root' }
-      end
-
-      describe passwd.shells(/nologin/) do
-        # find all users with a nologin shell
-        its('users') { should_not include 'my_login_user' }
-      end
-    "
-
-    include PasswdParser
-    include FileReader
-
-    attr_reader :params
-    attr_reader :content
-    attr_reader :lines
-
-    def initialize(path = nil, opts = nil)
-      opts ||= {}
-      @path = path || '/etc/passwd'
-      @content = opts[:content] || read_file_content(@path, allow_empty: true)
-      @lines = @content.to_s.split("\n")
-      @params = parse_passwd(@content)
-    end
-
-    filter = FilterTable.create
-    filter.add_accessor(:where)
-          .add_accessor(:entries)
-          .add(:users,     field: 'user')
-          .add(:passwords, field: 'password')
-          .add(:uids,      field: 'uid')
-          .add(:gids,      field: 'gid')
-          .add(:descs,     field: 'desc')
-          .add(:homes,     field: 'home')
-          .add(:shells,    field: 'shell')
-
-    # rebuild the passwd line from raw content
-    filter.add(:content) { |t, _|
-      t.entries.map do |e|
-        [e.user, e.password, e.uid, e.gid, e.desc, e.home, e.shell].join(':')
-      end.join("\n")
-    }
-
-    filter.connect(self, :params)
-
-    def to_s
-      '/etc/passwd'
-    end
-  end
-end
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+# The file format consists of
+# - username
+# - password
+# - userid
+# - groupid
+# - user id info
+# - home directory
+# - command
+
+require 'utils/parser'
+require 'utils/filter'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class Passwd < Inspec.resource(1)
+    name 'passwd'
+    supports platform: 'unix'
+    desc 'Use the passwd InSpec audit resource to test the contents of /etc/passwd, which contains the following information for users that may log into the system and/or as users that own running processes.'
+    example "
+      describe passwd do
+        its('users') { should_not include 'forbidden_user' }
+      end
+
+      describe passwd.uids(0) do
+        its('users') { should cmp 'root' }
+      end
+
+      describe passwd.shells(/nologin/) do
+        # find all users with a nologin shell
+        its('users') { should_not include 'my_login_user' }
+      end
+    "
+
+    include PasswdParser
+    include FileReader
+
+    attr_reader :params
+    attr_reader :content
+    attr_reader :lines
+
+    def initialize(path = nil, opts = nil)
+      opts ||= {}
+      @path = path || '/etc/passwd'
+      @content = opts[:content] || read_file_content(@path, allow_empty: true)
+      @lines = @content.to_s.split("\n")
+      @params = parse_passwd(@content)
+    end
+
+    filter = FilterTable.create
+    filter.add_accessor(:where)
+          .add_accessor(:entries)
+          .add(:users,     field: 'user')
+          .add(:passwords, field: 'password')
+          .add(:uids,      field: 'uid')
+          .add(:gids,      field: 'gid')
+          .add(:descs,     field: 'desc')
+          .add(:homes,     field: 'home')
+          .add(:shells,    field: 'shell')
+
+    # rebuild the passwd line from raw content
+    filter.add(:content) { |t, _|
+      t.entries.map do |e|
+        [e.user, e.password, e.uid, e.gid, e.desc, e.home, e.shell].join(':')
+      end.join("\n")
+    }
+
+    filter.connect(self, :params)
+
+    def to_s
+      '/etc/passwd'
+    end
+  end
+end