inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/aide_conf.rb

@@ -1,153 +0,0 @@
-require "inspec/utils/filter"
-require "inspec/utils/parser"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class AideConf < Inspec.resource(1)
-    name "aide_conf"
-    supports platform: "unix"
-    desc 'Use the aide_conf InSpec audit resource to test the rules established for
-      the file integrity tool AIDE. Controlled by the aide.conf file typically at /etc/aide.conf.'
-    example <<~EXAMPLE
-      describe aide_conf do
-        its('selection_lines') { should include '/sbin' }
-      end
-
-      describe aide_conf.where { selection_line == '/bin' } do
-        its('rules.flatten') { should include 'r' }
-      end
-
-      describe aide_conf.all_have_rule('sha512') do
-        it { should eq true }
-      end
-    EXAMPLE
-
-    attr_reader :params
-
-    include CommentParser
-    include FileReader
-
-    def initialize(aide_conf_path = nil)
-      @conf_path = aide_conf_path || "/etc/aide.conf"
-      @content = nil
-      @rules = nil
-      read_content
-    end
-
-    def all_have_rule(rule)
-      # Case when file didn't exist or perms didn't allow an open
-      return false if @content.nil?
-
-      lines = @params.reject { |line| line["rules"].include? rule }
-      lines.empty?
-    end
-
-    filter = FilterTable.create
-    filter.register_column(:selection_lines, field: "selection_line")
-      .register_column(:rules, field: "rules")
-
-    filter.install_filter_methods_on_resource(self, :params)
-
-    def to_s
-      "AIDE Config"
-    end
-
-    private
-
-    def read_content
-      return @content unless @content.nil?
-
-      @rules = {}
-
-      raw_conf = read_file_content(@conf_path)
-
-      # If there is a file and it contains content, continue
-      @content = filter_comments(raw_conf.lines)
-      @params = parse_conf(@content)
-    end
-
-    def filter_comments(data)
-      content = []
-      data.each do |line|
-        content_line, = parse_comment_line(line, comment_char: "#", standalone_comments: false)
-        content.push(content_line)
-      end
-      content
-    end
-
-    def parse_conf(content)
-      params = []
-      content.each do |line|
-        param = parse_line(line)
-        unless param["selection_line"].nil?
-          params.push(param)
-        end
-      end
-      params
-    end
-
-    def parse_line(line)
-      line_and_rules = {}
-      # Case when line is a rule line
-      if line.include?(" = ")
-        parse_rule_line(line)
-      # Case when line is a selection line
-      elsif line.start_with?("/", "!", "=")
-        line_and_rules = parse_selection_line(line)
-      end
-      line_and_rules
-    end
-
-    def parse_rule_line(line)
-      line.gsub!(/\s+/, "")
-      rule_line_arr = line.split("=")
-      rules_list = rule_line_arr.last.split("+")
-      rule_name = rule_line_arr.first
-      rules_list.each_index do |i|
-        # Cases where rule respresents one or more other rules
-        if @rules.key?(rules_list[i])
-          rules_list[i] = @rules[rules_list[i]]
-        end
-        rules_list[i] = handle_multi_rule(rules_list, i)
-      end
-      @rules[rule_name] = rules_list.flatten
-    end
-
-    def parse_selection_line(line)
-      selec_line_arr = line.split(" ")
-      selection_line = selec_line_arr.first
-      selection_line.chop! if selection_line.end_with?("/")
-      rule_list = selec_line_arr.last.split("+")
-      rule_list.each_index do |i|
-        hash_list = @rules[rule_list[i]]
-        # Cases where rule respresents one or more other rules
-        unless hash_list.nil?
-          rule_list[i] = hash_list
-        end
-        rule_list[i] = handle_multi_rule(rule_list, i)
-      end
-      rule_list.flatten!
-      {
-        "selection_line" => selection_line,
-        "rules" => rule_list,
-      }
-    end
-
-    def handle_multi_rule(rule_list, i)
-      # Rules that represent multiple rules (R,L,>)
-      r_rules = %w{p i l n u g s m c md5}
-      l_rules = %w{p i l n u g}
-      grow_log_rules = %w{p l u g i n S}
-
-      case rule_list[i]
-      when "R"
-        return r_rules
-      when "L"
-        return l_rules
-      when ">"
-        return grow_log_rules
-      end
-      rule_list[i]
-    end
-  end
-end

data/lib/inspec/resources/apache.rb

@@ -1,47 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-module Inspec::Resources
-  class Apache < Inspec.resource(1)
-    name "apache"
-    supports platform: "unix"
-    desc "Use the apache InSpec audit resource to retrieve Apache environment settings."
-    example <<~EXAMPLE
-      describe apache do
-        its ('service') { should cmp 'apache2' }
-      end
-
-      describe apache do
-        its ('conf_dir') { should cmp '/etc/apache2' }
-      end
-
-      describe apache do
-        its ('conf_path') { should cmp '/etc/apache2/apache2.conf' }
-      end
-
-      describe apache do
-        its ('user') { should cmp 'www-data' }
-      end
-    EXAMPLE
-
-    attr_reader :service, :conf_dir, :conf_path, :user
-    def initialize
-      Inspec.deprecate(:resource_apache, "The apache resource is deprecated")
-
-      if inspec.os.debian?
-        @service = "apache2"
-        @conf_dir = "/etc/apache2/"
-        @conf_path = File.join @conf_dir, "apache2.conf"
-        @user = "www-data"
-      else
-        @service = "httpd"
-        @conf_dir = "/etc/httpd/"
-        @conf_path = File.join @conf_dir, "/conf/httpd.conf"
-        @user = "apache"
-      end
-    end
-
-    def to_s
-      "Apache Environment"
-    end
-  end
-end

data/lib/inspec/resources/apache_conf.rb

@@ -1,156 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-require "inspec/utils/simpleconfig"
-require "inspec/utils/find_files"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class ApacheConf < Inspec.resource(1)
-    name "apache_conf"
-    supports platform: "linux"
-    supports platform: "debian"
-    desc "Use the apache_conf InSpec audit resource to test the configuration settings for Apache. This file is typically located under /etc/apache2 on the Debian and Ubuntu platforms and under /etc/httpd on the Fedora, CentOS, Red Hat Enterprise Linux, and Arch Linux platforms. The configuration settings may vary significantly from platform to platform."
-    example <<~EXAMPLE
-      describe apache_conf do
-        its('setting_name') { should eq 'value' }
-      end
-    EXAMPLE
-
-    include FindFiles
-    include FileReader
-
-    attr_reader :conf_path
-
-    def initialize(conf_path = nil)
-      @conf_path = conf_path || default_conf_path
-      @files_contents = {}
-      @content = nil
-      @params = nil
-      read_content
-    end
-
-    def content
-      @content ||= read_content
-    end
-
-    def params(*opts)
-      @params || read_content
-      res = @params
-      opts.each do |opt|
-        res = res[opt] unless res.nil?
-      end
-      res
-    end
-
-    def method_missing(name)
-      # ensure params are loaded
-      @params || read_content
-
-      # extract values
-      @params[name.to_s] unless @params.nil?
-    end
-
-    def filter_comments(data)
-      content = ""
-      data.each_line do |line|
-        unless line.match(/^\s*#/)
-          content << line
-        end
-      end
-      content
-    end
-
-    def read_content
-      @content = ""
-      @params = {}
-
-      read_file_content(conf_path)
-
-      to_read = [conf_path]
-      until to_read.empty?
-        raw_conf = read_file(to_read[0])
-        @content += raw_conf
-
-        # An explaination of the below regular expression.
-        # Creates two capture groups.
-        # The first group captures the first group of non-whitespace character
-        # surrounded whitespace characters.
-        # The second group contains a conditional with a positive lookahead
-        # (does the line end with one or more spaces?). If the lookahead succeeds
-        # a non-greedy capture takes place, if it fails then a greedy capture takes place.
-        # The regex is terminated by an expression that matches zero or more spaces.
-        params = SimpleConfig.new(
-          raw_conf,
-          assignment_regex: /^\s*(\S+)\s+['"]*((?=.*\s+$).*?|.*?)['"]*\s*$/,
-          multiple_values: true
-        ).params
-
-        # Capture any characters between quotes that are not escaped in values
-        params.values.map! do |value|
-          value.map! do |sub_value|
-            sub_value[/(?<=["|'])(?:\\.|[^"'\\])*(?=["|'])/] || sub_value
-          end
-        end
-
-        @params.merge!(params)
-
-        to_read = to_read.drop(1)
-        to_read += include_files(params).find_all do |fp|
-          not @files_contents.key? fp
-        end
-      end
-
-      # fiter comments
-      @content = filter_comments @content
-      @content
-    end
-
-    def include_files(params)
-      # see if there is more config files to include
-      include_files = params["Include"] || []
-      include_files_optional = params["IncludeOptional"] || []
-
-      includes = []
-      (include_files + include_files_optional).each do |f|
-        id    = Pathname.new(f).absolute? ? f : File.join(conf_dir, f)
-        files = find_files(id, depth: 1, type: "file")
-        files += find_files(id, depth: 1, type: "link")
-
-        includes.push(files) if files
-      end
-
-      # [].flatten! == nil
-      includes.flatten! || []
-    end
-
-    def read_file(path)
-      @files_contents[path] ||= read_file_content(path, true)
-    end
-
-    def conf_dir
-      if inspec.os.debian?
-        File.dirname(conf_path)
-      else
-        # On RHEL-based systems, the configuration is usually in a /conf directory
-        # that contains the primary config file. We assume the "config path" is the
-        # directory that contains the /conf directory, such as /etc/httpd, so that
-        # the conf.d directory can be properly located.
-        Pathname.new(File.dirname(conf_path)).parent.to_s
-      end
-    end
-
-    def to_s
-      "Apache Config #{conf_path}"
-    end
-
-    private
-
-    def default_conf_path
-      if inspec.os.debian?
-        "/etc/apache2/apache2.conf"
-      else
-        "/etc/httpd/conf/httpd.conf"
-      end
-    end
-  end
-end

data/lib/inspec/resources/apt.rb

@@ -1,151 +0,0 @@
-require "inspec/resources/command"
-
-# Verifies apt and ppa repositories
-#
-# Usage:
-# describe apt('ubuntu-wine/ppa') do
-#   it { should exist }
-#   it { should be_enabled }
-# end
-#
-# it also understands a ppa url
-# describe apt('ppa:ubuntu-wine/ppa') do
-#   it { should exist }
-#   it { should be_enabled }
-# end
-#
-# The following ppa formats are supported:
-# - ubuntu-wine/ppa
-# - ppa:ubuntu-wine/ppa
-# - http://ppa.launchpad.net/juju/stable/ubuntu
-#
-# Install a ppa as following:
-# apt-get install python-software-properties
-# apt-get install software-properties-common
-# add-apt-repository ppa:ubuntu-wine/ppa
-
-require "uri"
-
-module Inspec::Resources
-  class AptRepository < Inspec.resource(1)
-    name "apt"
-    supports platform: "unix"
-    desc "Use the apt InSpec audit resource to verify Apt repositories on the Debian and Ubuntu platforms, and also PPA repositories on the Ubuntu platform."
-    example <<~EXAMPLE
-      describe apt('nginx/stable') do
-        it { should exist }
-        it { should be_enabled }
-      end
-    EXAMPLE
-
-    def initialize(ppa_name)
-      @deb_url = nil
-      # check if the os is ubuntu or debian
-      if inspec.os.debian?
-        @deb_url = determine_ppa_url(ppa_name)
-      else
-        # this resource is only supported on ubuntu and debian
-        skip_resource "The `apt` resource is not supported on your OS yet."
-      end
-    end
-
-    def exists?
-      find_repo.count > 0
-    end
-
-    def enabled?
-      return false if find_repo.count == 0
-
-      actives = find_repo.map { |repo| repo[:active] }
-      actives = actives.uniq
-      actives.size == 1 && actives[0] = true
-    end
-
-    def to_s
-      "Apt Repository #{@deb_url}"
-    end
-
-    private
-
-    def find_repo
-      read_debs.select { |repo| repo[:url] == @deb_url && repo[:type] == "deb" }
-    end
-
-    # TODO: remove this. just see if it is valid w/ URI.parse
-    HTTP_URL_RE = /\A#{URI::DEFAULT_PARSER.make_regexp(%w{http https})}\z/.freeze
-
-    def read_debs
-      return @repo_cache if defined?(@repo_cache)
-
-      # load all lists
-      cmd = inspec.command("find /etc/apt/ -name \*.list -exec sh -c 'cat {} || echo -n' \\;")
-
-      # @see https://help.ubuntu.com/community/Repositories/CommandLine#Explanation_of_the_Repository_Format
-      @repo_cache = cmd.stdout.lines.map do |raw_line|
-        # detect if the repo is commented out
-        line = raw_line.gsub(/^(#\s*)*/, "")
-        active = raw_line == line
-
-        # formats:
-        # deb               "http://archive.ubuntu.com/ubuntu/" wily main restricted ...
-        # deb               http://archive.ubuntu.com/ubuntu/ wily main restricted ...
-        # deb [trusted=yes] http://archive.ubuntu.com/ubuntu/ wily main restricted ...
-
-        words = line.split
-        words.delete_at 1 if words[1] && words[1].start_with?("[")
-        type, url, distro, *components = words
-        url = url.delete('"') if url
-
-        next if components.empty?
-        next unless URI::HTTP === URI.parse(url)
-        next unless %w{deb deb-src}.include? type
-
-        # map data
-        {
-          type: type,
-          url: url,
-          distro: distro,
-          components: components,
-          active: active,
-        }
-      end.compact
-    end
-
-    # resolves ppa urls
-    # @see http://bazaar.launchpad.net/~ubuntu-core-dev/software-properties/main/view/head:/softwareproperties/ppa.py
-    def determine_ppa_url(ppa_url)
-      # verify if we have the url already, then just return
-      return ppa_url if ppa_url =~ HTTP_URL_RE
-
-      # otherwise start generating the ppa url
-
-      # special care if the name stats with :
-      ppa_url = ppa_url.split(":")[1] if ppa_url.start_with?("ppa:")
-
-      # parse ppa owner and repo
-      ppa_owner, ppa_repo = ppa_url.split("/")
-      ppa_repo = "ppa" if ppa_repo.nil?
-
-      # construct new ppa url and return it
-      format("http://ppa.launchpad.net/%s/%s/ubuntu", ppa_owner, ppa_repo)
-    end
-  end
-
-  class PpaRepository < AptRepository
-    name "ppa"
-
-    def exists?
-      deprecated
-      super()
-    end
-
-    def enabled?
-      deprecated
-      super()
-    end
-
-    def deprecated
-      Inspec.deprecate(:resource_ppa, "The `ppa` resource is deprecated. Please use `apt`")
-    end
-  end
-end