inspec 2.2.34 → 2.2.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29857224509b0eeb7fb9942ce70b5520b54d44b15cb996db137d24f09cb18b73
-  data.tar.gz: 95f7da542bd317544cd1ab5e225f7366cfc9d1430970b8fb976c1d71e79f0dec
+  metadata.gz: 7b68a3dbcdc7b0027e8ea20219c6a9c79ce05a74fbe97a99c05e3c1850d5f440
+  data.tar.gz: dbfe2c8d73e50157beed8645da83e1e0b97f94367e6b2da81473b5484299a1cc
 SHA512:
-  metadata.gz: e1d5acf1b120e9dbeac94bbaaaa483ebeb8e08202b41c383ed7743e34f626e6d8915b67d6d8e59bd5648b9d497670ca032b3aaf10b9c8908a4bd0e68feb318bf
-  data.tar.gz: a838959692ee73761ec76d9a39659d875b592fd747c74e67b98e73357ae84a522c9013c0c790d1f9bccef552c9bb6a94cec69754f49dba456fc7b692c2f79e6e
+  metadata.gz: b770c51a3b4fd4c5252d197866b6daded7168a1c1bc14532de5edd9ef1b5e22bbec92200b4d8a16f46cbd42b38ab063baed53bba2c550b112575edccf45b695a
+  data.tar.gz: b8e6fbdcdf4debfdc57ce0a16ccedc67450cfaf4d7d4da11578e111df18f4ecad88e1250ebec04b3153680db7f9e00267247179b8adc0f6e898e27792dbbec05

data/CHANGELOG.md

@@ -1,32 +1,38 @@
 # Change Log
 <!-- usage documentation: http://expeditor-docs.es.chef.io/configuration/changelog/ -->
-<!-- latest_release 2.2.34 -->
-## [v2.2.34](https://github.com/inspec/inspec/tree/v2.2.34) (2018-07-05)
+<!-- latest_release 2.2.35 -->
+## [v2.2.35](https://github.com/inspec/inspec/tree/v2.2.35) (2018-07-09)
 
-#### Bug Fixes
-- fix for apache_conf to handle quoted Includes [#3193](https://github.com/inspec/inspec/pull/3193) ([voroniys](https://github.com/voroniys))
+#### New Features
+- A number of bug fixes and new features for oracledb_session resource [#3170](https://github.com/inspec/inspec/pull/3170) ([voroniys](https://github.com/voroniys))
 <!-- latest_release -->
 
-<!-- release_rollup since=2.2.27 -->
-### Changes since 2.2.27 release
+<!-- release_rollup since=2.2.34 -->
+### Changes since 2.2.34 release
 
 #### New Features
-- cli: Add `--insecure` option for `exec` and `shell` [#3195](https://github.com/inspec/inspec/pull/3195) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.2.31 -->
+- A number of bug fixes and new features for oracledb_session resource [#3170](https://github.com/inspec/inspec/pull/3170) ([voroniys](https://github.com/voroniys)) <!-- 2.2.35 -->
+<!-- release_rollup -->
 
-#### Bug Fixes
-- fix for apache_conf to handle quoted Includes [#3193](https://github.com/inspec/inspec/pull/3193) ([voroniys](https://github.com/voroniys)) <!-- 2.2.34 -->
-- Fix some issues with the vendor functional tests [#3196](https://github.com/inspec/inspec/pull/3196) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.2.30 -->
+<!-- latest_stable_release -->
+## [v2.2.34](https://github.com/inspec/inspec/tree/v2.2.34) (2018-07-05)
 
-#### Merged Pull Requests
-- Prevent Slashes in profile names [#3175](https://github.com/inspec/inspec/pull/3175) ([miah](https://github.com/miah)) <!-- 2.2.32 -->
-- Fix vendor functional test to not validate a repo hash that can change. [#3198](https://github.com/inspec/inspec/pull/3198) ([miah](https://github.com/miah)) <!-- 2.2.29 -->
+#### New Features
+- cli: Add `--insecure` option for `exec` and `shell` [#3195](https://github.com/inspec/inspec/pull/3195) ([jerryaldrichiii](https://github.com/jerryaldrichiii))
 
 #### Enhancements
-- Accept regexes for --controls option to inspec exec [#3179](https://github.com/inspec/inspec/pull/3179) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 2.2.33 -->
-- Update the node platform issues to warn severity [#3186](https://github.com/inspec/inspec/pull/3186) ([jquick](https://github.com/jquick)) <!-- 2.2.28 -->
-<!-- release_rollup -->
+- Update the node platform issues to warn severity [#3186](https://github.com/inspec/inspec/pull/3186) ([jquick](https://github.com/jquick))
+- Accept regexes for --controls option to inspec exec [#3179](https://github.com/inspec/inspec/pull/3179) ([clintoncwolfe](https://github.com/clintoncwolfe))
+
+#### Bug Fixes
+- Fix some issues with the vendor functional tests [#3196](https://github.com/inspec/inspec/pull/3196) ([jerryaldrichiii](https://github.com/jerryaldrichiii))
+- fix for apache_conf to handle quoted Includes [#3193](https://github.com/inspec/inspec/pull/3193) ([voroniys](https://github.com/voroniys))
 
+#### Merged Pull Requests
+- Fix vendor functional test to not validate a repo hash that can change. [#3198](https://github.com/inspec/inspec/pull/3198) ([miah](https://github.com/miah))
+- Prevent Slashes in profile names [#3175](https://github.com/inspec/inspec/pull/3175) ([miah](https://github.com/miah))
 <!-- latest_stable_release -->
+
 ## [v2.2.27](https://github.com/inspec/inspec/tree/v2.2.27) (2018-06-29)
 
 #### New Features
@@ -43,7 +49,6 @@
 
 #### Merged Pull Requests
 - Add functional tests for nested attributes [#3157](https://github.com/inspec/inspec/pull/3157) ([clintoncwolfe](https://github.com/clintoncwolfe))
-<!-- latest_stable_release -->
 
 ## [v2.2.20](https://github.com/inspec/inspec/tree/v2.2.20) (2018-06-21)
 

data/docs/resources/oracledb_session.md.erb

@@ -20,11 +20,17 @@ A `oracledb_session` resource block declares the username and password to use fo
 where
 
 * `oracledb_session` declares a username and password with permission to run the query (required), and an optional parameters for host (default: `localhost`), SID (default: `nil`, which uses the default SID, and path to the sqlplus binary (default: `sqlplus`).
+* it is possible to run queries as sysdba/sysoper by using `as_db_role option`, see examples
 * `query('QUERY')` contains the query to be run
 * `its('value') { should eq('') }` compares the results of the query against the expected result in the test
 
 <br>
 
+## oracledb_session(...).query method Properties
+* rows the query result as array of hashes
+* row(number)  selected row from query result, where number is just a row number in the query result
+* column(name) array with values from selected column
+ 
 ## Examples
 
 The following examples show how to use this InSpec audit resource.
@@ -45,6 +51,41 @@ The following examples show how to use this InSpec audit resource.
       its('value') { should cmp 'ORCL' }
     end
 
+### Test for table contains a specified value in any row for the given column name
+
+    sql = oracledb_session(user: 'my_user', pass: 'password', service: 'MYSID')
+
+    describe sql.query('SELECT * FROM my_table;').column('my_column') do
+      it { should include 'my_value' }
+    end
+
+### Test tablespace exists as sysdba
+    The check will change user (with su) to specified user and run 'sqlplus / as sysdba' (sysoper, sysasm) 
+
+    sql = oracledb_session(as_os_user: 'oracle', as_db_role: 'sysdba', service: 'MYSID')
+
+    describe sql.query('SELECT tablespace_name AS name FROM dba_tablespaces;').column('name') do
+      it { should include 'MYTABLESPACE' }
+    end
+    NOTE: option `as_os_user` available only on unix-like systems and not supported on Windows. Also this option requires that you are running inspec as `root` or with `--sudo`
+
+### Test number of rows in the query result
+
+    sql = oracledb_session(user: 'my_user', pass: 'password')
+
+    describe sql.query('SELECT * FROM my_table;').rows do
+      its('count') { should eq 20 }
+    end
+
+### Use data out of (remote) DB query to build other tests
+
+    sql = oracledb_session(user: 'my_user', pass: 'password', host: 'my.remote.db', service: 'MYSID')
+
+    sql.query('SELECT * FROM files;').rows.each do |file_row|
+      describe file(file_row['path']) do
+	its('owner') { should eq file_row['owner']}
+      end
+    end
 <br>
 
 ## Matchers

data/lib/inspec/version.rb

@@ -4,5 +4,5 @@
 # author: Christoph Hartmann
 
 module Inspec
-  VERSION = '2.2.34'
+  VERSION = '2.2.35'
 end

data/lib/resources/oracledb_session.rb

@@ -22,7 +22,8 @@ module Inspec::Resources
       end
     "
 
-    attr_reader :user, :password, :host, :service
+    attr_reader :user, :password, :host, :service, :as_os_user, :as_db_role
+    # rubocop:disable Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity
     def initialize(opts = {})
       @user = opts[:user]
       @password = opts[:password] || opts[:pass]
@@ -34,12 +35,17 @@ module Inspec::Resources
       @port = opts[:port] || '1521'
       @service = opts[:service]
 
+      # connection as sysdba stuff
+      return skip_resource "Option 'as_os_user' not available in Windows" if inspec.os.windows? && opts[:as_os_user]
+      @su_user = opts[:as_os_user]
+      @db_role = opts[:as_db_role]
+
       # we prefer sqlci although it is way slower than sqlplus, but it understands csv properly
-      @sqlcl_bin = 'sql'
+      @sqlcl_bin = 'sql' unless opts.key?(:sqlplus_bin) # don't use it if user specified sqlplus_bin option
       @sqlplus_bin = opts[:sqlplus_bin] || 'sqlplus'
 
-      return skip_resource "Can't run Oracle checks without authentication" if @user.nil? || @password.nil?
-      return skip_resource 'You must provide a service name for the session' if @service.nil?
+      return fail_resource "Can't run Oracle checks without authentication" if @su_user.nil? && (@user.nil? || @password.nil?)
+      return fail_resource 'You must provide a service name for the session' if @service.nil?
     end
 
     def query(q)
@@ -49,19 +55,25 @@ module Inspec::Resources
 
       p = nil
       # use sqlplus if sqlcl is not available
-      if inspec.command(@sqlcl_bin).exist?
+      if @sqlcl_bin and inspec.command(@sqlcl_bin).exist?
         bin = @sqlcl_bin
         opts = "set sqlformat csv\nSET FEEDBACK OFF"
         p = :parse_csv_result
       else
         bin = @sqlplus_bin
-        opts = "SET MARKUP HTML ON\nSET FEEDBACK OFF"
+        opts = "SET MARKUP HTML ON\nSET PAGESIZE 32000\nSET FEEDBACK OFF"
         p = :parse_html_result
       end
 
       query = verify_query(escaped_query)
       query += ';' unless query.end_with?(';')
-      command = %{echo "#{opts}\n#{query}\nEXIT" | #{bin} "#{@user}"/"#{@password}"@#{@host}:#{@port}/#{@service}}
+      if @db_role.nil?
+        command = %{#{bin} "#{@user}"/"#{@password}"@#{@host}:#{@port}/#{@service} <<EOC\n#{opts}\n#{query}\nEXIT\nEOC}
+      elsif @su_user.nil?
+        command = %{#{bin} "#{@user}"/"#{@password}"@#{@host}:#{@port}/#{@service} as #{@db_role} <<EOC\n#{opts}\n#{query}\nEXIT\nEOC}
+      else
+        command = %{su - #{@su_user} -c "env ORACLE_SID=#{@service} #{bin} / as #{@db_role} <<EOC\n#{opts}\n#{query}\nEXIT\nEOC"}
+      end
       cmd = inspec.command(command)
 
       out = cmd.stdout + "\n" + cmd.stderr

data/lib/utils/database_helpers.rb

@@ -48,10 +48,22 @@ module DatabaseHelper
       @cmd.exit_status == 0 && @error.nil?
     end
 
+    def rows
+      @results
+    end
+
     def row(id)
       SQLRow.new(self, @results[id])
     end
 
+    def column(column)
+      result = []
+      @results.each do |row|
+        result << row[column]
+      end
+      result
+    end
+
     def size
       @results.size
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec
 version: !ruby/object:Gem::Version
-  version: 2.2.34
+  version: 2.2.35
 platform: ruby
 authors:
 - Dominik Richter
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-05 00:00:00.000000000 Z
+date: 2018-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: train