inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/bridge.rb

@@ -1,125 +0,0 @@
-require "inspec/resources/file"
-
-# Usage:
-# describe bridge('br0') do
-#   it { should exist }
-#   it { should have_interface 'eth0' }
-# end
-
-module Inspec::Resources
-  class Bridge < Inspec.resource(1)
-    name "bridge"
-    supports platform: "unix"
-    desc "Use the bridge InSpec audit resource to test basic network bridge properties, such as name, if an interface is defined, and the associations for any defined interface."
-    example <<~EXAMPLE
-      describe bridge 'br0' do
-        it { should exist }
-        it { should have_interface 'eth0' }
-      end
-    EXAMPLE
-
-    def initialize(bridge_name)
-      @bridge_name = bridge_name
-
-      @bridge_provider = nil
-      if inspec.os.linux?
-        @bridge_provider = LinuxBridge.new(inspec)
-      elsif inspec.os.windows?
-        @bridge_provider = WindowsBridge.new(inspec)
-      else
-        return skip_resource "The `bridge` resource is not supported on your OS yet."
-      end
-    end
-
-    def exists?
-      !bridge_info.nil? && !bridge_info[:name].nil?
-    end
-
-    def has_interface?(interface)
-      return skip_resource "The `bridge` resource does not provide interface detection for Windows yet" if inspec.os.windows?
-
-      bridge_info.nil? ? false : bridge_info[:interfaces].include?(interface)
-    end
-
-    def interfaces
-      bridge_info.nil? ? nil : bridge_info[:interfaces]
-    end
-
-    def to_s
-      "Bridge #{@bridge_name}"
-    end
-
-    private
-
-    def bridge_info
-      return @cache if defined?(@cache)
-
-      @cache = @bridge_provider.bridge_info(@bridge_name) unless @bridge_provider.nil?
-    end
-  end
-
-  class BridgeDetection
-    attr_reader :inspec
-    def initialize(inspec)
-      @inspec = inspec
-    end
-  end
-
-  # Linux Bridge
-  # If /sys/class/net/{interface}/bridge exists then it must be a bridge
-  # /sys/class/net/{interface}/brif contains the network interfaces
-  # @see http://www.tldp.org/HOWTO/BRIDGE-STP-HOWTO/set-up-the-bridge.html
-  # @see http://unix.stackexchange.com/questions/40560/how-to-know-if-a-network-interface-is-tap-tun-bridge-or-physical
-  class LinuxBridge < BridgeDetection
-    def bridge_info(bridge_name)
-      # read bridge information
-      bridge = inspec.file("/sys/class/net/#{bridge_name}/bridge").directory?
-      return nil unless bridge
-
-      # load interface names
-      interfaces = inspec.command("ls -1 /sys/class/net/#{bridge_name}/brif/")
-      interfaces = interfaces.stdout.chomp.split("\n")
-      {
-        name: bridge_name,
-        interfaces: interfaces,
-      }
-    end
-  end
-
-  # Windows Bridge
-  # select netadapter by adapter binding for windows
-  # Get-NetAdapterBinding -ComponentID ms_bridge | Get-NetAdapter
-  # @see https://technet.microsoft.com/en-us/library/jj130921(v=wps.630).aspx
-  # RegKeys: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
-  class WindowsBridge < BridgeDetection
-    def bridge_info(bridge_name)
-      # find all bridge adapters
-      cmd = inspec.command("Get-NetAdapterBinding -ComponentID ms_bridge | Get-NetAdapter | Select-Object -Property Name, InterfaceDescription | ConvertTo-Json")
-
-      # filter network interface
-      begin
-        bridges = JSON.parse(cmd.stdout)
-      rescue JSON::ParserError => _e
-        return nil
-      end
-
-      # ensure we have an array of groups
-      bridges = [bridges] unless bridges.is_a?(Array)
-
-      # select the requested interface
-      bridges = bridges.each_with_object([]) do |adapter, adapter_collection|
-        # map object
-        info = {
-          name: adapter["Name"],
-          interfaces: nil,
-        }
-        adapter_collection.push(info) if info[:name].casecmp(bridge_name) == 0
-      end
-
-      return nil if bridges.empty?
-
-      warn "[Possible Error] detected multiple bridges interfaces with the name #{bridge_name}" if bridges.size > 1
-      bridges[0]
-    end
-  end
-end

data/lib/inspec/resources/bsd_service.rb

@@ -1,2 +0,0 @@
-# This is just here to make the dynamic loader happy.
-require "inspec/resources/service"

data/lib/inspec/resources/chocolatey_package.rb

@@ -1,82 +0,0 @@
-# frozen_string_literal: true
-
-require "inspec/resources/command"
-require "inspec/resources/powershell"
-
-# Check for Chocolatey packages to be installed
-module Inspec::Resources
-  class ChocoPkg < Inspec.resource(1)
-    name "chocolatey_package"
-    supports platform: "windows"
-    desc "Use the chocolatey_package InSpec audit resource to test if the named package and/or package version is installed on the system."
-    example <<~EXAMPLE
-      describe chocolatey_package('git') do
-        it { should be_installed }
-        its('version') { should eq '2.15.1' }
-      end
-    EXAMPLE
-
-    attr_reader :package_name
-
-    def initialize(package_name, _opts = {})
-      raise "Chocolatey is not installed" unless inspec.command("choco").exist?
-
-      @package_name = package_name
-      @cache = base_data.update(generate_cache)
-    end
-
-    def installed?
-      @cache[:installed]
-    end
-
-    def info
-      @cache.dup
-    end
-
-    def respond_to_missing?(method_name, *)
-      @cache.key?(method_name) || super
-    end
-
-    def method_missing(method_name, *args, &block)
-      if @cache.key?(method_name)
-        @cache.fetch(method_name)
-      else
-        super
-      end
-    end
-
-    def to_s
-      "Chocolatey package #{package_name}"
-    end
-
-    private
-
-    def base_data
-      {
-        name: package_name,
-        version: nil,
-        installed: false,
-        type: "chocolatey",
-      }
-    end
-
-    def generate_cache
-      command = <<-EOH
-      (choco list --local-only --exact --include-programs --limit-output '#{package_name.gsub("'", "\`'")}') -Replace "\\|", "=" | ConvertFrom-StringData | ConvertTo-JSON
-      EOH
-
-      cmd = inspec.powershell(command.strip)
-
-      return {} if cmd.exit_status != 0 || cmd.stdout.strip.empty?
-
-      out = JSON.parse(cmd.stdout)
-
-      {
-        version: out.fetch(package_name),
-        installed: true,
-      }
-    rescue JSON::ParserError, KeyError
-      {}
-    end
-  end
-end

data/lib/inspec/resources/command.rb

@@ -1,91 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-require "inspec/resource"
-require "inspec/resources/platform"
-require "inspec/resources/os"
-
-module Inspec::Resources
-  class Cmd < Inspec.resource(1)
-    name "command"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the command InSpec audit resource to test an arbitrary command that is run on the system."
-    example <<~EXAMPLE
-      describe command('ls -al /') do
-        its('stdout') { should match /bin/ }
-        its('stderr') { should eq '' }
-        its('exit_status') { should eq 0 }
-      end
-
-      command('ls -al /').exist? will return false. Existence of command should be checked this way.
-      describe command('ls') do
-        it { should exist }
-      end
-    EXAMPLE
-
-    attr_reader :command
-
-    def initialize(cmd, options = {})
-      if cmd.nil?
-        raise "InSpec `command` was called with `nil` as the argument. This is not supported. Please provide a valid command instead."
-      end
-
-      @command = cmd
-
-      if options[:redact_regex]
-        unless options[:redact_regex].is_a?(Regexp)
-          # Make sure command is replaced so sensitive output isn't shown
-          @command = "ERROR"
-          raise Inspec::Exceptions::ResourceFailed,
-                "The `redact_regex` option must be a regular expression"
-        end
-        @redact_regex = options[:redact_regex]
-      end
-    end
-
-    def result
-      @result ||= inspec.backend.run_command(@command)
-    end
-
-    def stdout
-      result.stdout
-    end
-
-    def stderr
-      result.stderr
-    end
-
-    def exit_status
-      result.exit_status.to_i
-    end
-
-    def exist? # rubocop:disable Metrics/AbcSize
-      # silent for mock resources
-      return false if inspec.os.name.nil? || inspec.os.name == "mock"
-
-      if inspec.os.linux?
-        res = if inspec.platform.name == "alpine"
-                inspec.backend.run_command("which \"#{@command}\"")
-              else
-                inspec.backend.run_command("bash -c 'type \"#{@command}\"'")
-              end
-      elsif inspec.os.windows?
-        res = inspec.backend.run_command("Get-Command \"#{@command}\"")
-      elsif inspec.os.unix?
-        res = inspec.backend.run_command("type \"#{@command}\"")
-      else
-        warn "`command(#{@command}).exist?` is not supported on your OS: #{inspec.os[:name]}"
-        return false
-      end
-      res.exit_status.to_i == 0
-    end
-
-    def to_s
-      output = "Command: `#{@command}`"
-      # Redact output if the `redact_regex` option is passed
-      # If no capture groups are passed then `\1` and `\2` are ignored
-      output.gsub!(@redact_regex, '\1REDACTED\2') unless @redact_regex.nil?
-      output
-    end
-  end
-end

data/lib/inspec/resources/cpan.rb

@@ -1,58 +0,0 @@
-require "inspec/resources/command"
-
-# Usage:
-# describe cpan('DBD::Pg') do
-#   it { should be_installed }
-# end
-#
-
-module Inspec::Resources
-  class CpanPackage < Inspec.resource(1)
-    name "cpan"
-    supports platform: "unix"
-    desc "Use the `cpan` InSpec audit resource to test Perl modules that are installed by system packages or the CPAN installer."
-    example <<~EXAMPLE
-      describe cpan('DBD::Pg') do
-        it { should be_installed }
-      end
-    EXAMPLE
-
-    def initialize(package_name, perl_lib_path = nil)
-      @package_name = package_name
-      @perl_lib_path = perl_lib_path
-      @perl_cmd = "perl"
-
-      # this resource is not supported on Windows
-      return skip_resource "The `cpan` resource is not supported on your OS yet." if inspec.os.windows?
-      return skip_resource "perl not found" unless inspec.command(@perl_cmd).exist?
-    end
-
-    def info
-      return @info if defined?(@info)
-
-      @info = {}
-      @info[:type] = "cpan"
-      @info[:name] = @package_name
-      # set PERL5LIB environment variable if a custom lib path is given
-      lib_path = @perl_lib_path.nil? ? "" : "PERL5LIB=#{@perl_lib_path} "
-      cmd = inspec.command("#{lib_path + @perl_cmd} -le 'eval \"require $ARGV[0]\" and print $ARGV[0]->VERSION or exit 1' #{@package_name}")
-      @info[:installed] = cmd.exit_status == 0
-      return @info unless cmd.exit_status == 0
-
-      @info[:version] = cmd.stdout.strip
-      @info
-    end
-
-    def installed?
-      info[:installed] == true
-    end
-
-    def version
-      info[:version]
-    end
-
-    def to_s
-      "Perl Module #{@package_name}"
-    end
-  end
-end

data/lib/inspec/resources/cran.rb

@@ -1,64 +0,0 @@
-require "inspec/resources/command"
-
-# Usage:
-# describe cran('DBI') do
-#   it { should be_installed }
-# end
-#
-
-module Inspec::Resources
-  class CranPackage < Inspec.resource(1)
-    name "cran"
-    supports platform: "unix"
-    desc "Use the `cran` InSpec audit resource to test R modules that are installed from CRAN package repository."
-    example <<~EXAMPLE
-      describe cran('DBI') do
-        it { should be_installed }
-      end
-    EXAMPLE
-
-    def initialize(package_name)
-      @package_name = package_name
-      @r_cmd = "Rscript"
-
-      # this resource is not supported on Windows
-      return skip_resource "The `cran` resource is not supported on your OS yet." if inspec.os.windows?
-      return skip_resource "Rscript not found" unless inspec.command(@r_cmd).exist?
-    end
-
-    def info
-      return @info if defined?(@info)
-
-      @info = {}
-      @info[:type] = "cran"
-      @info[:name] = @package_name
-      cmd = inspec.command("#{@r_cmd} -e 'packageVersion(\"#{@package_name}\")'")
-      return @info unless cmd.exit_status == 0
-
-      # Extract package version from Rscript output
-      # Output includes unicode punctuation (backticks) characters like so:
-      # [1] '0.5.1'
-      #
-      # So make sure command output is converted to unicode, as it returns ASCII-8BIT by default
-      utf8_stdout = cmd.stdout.chomp.force_encoding(Encoding::UTF_8)
-      params = /^\[\d+\]\s+(?:['\p{Initial_Punctuation}])(.+)(?:['\p{Final_Punctuation}])$/.match(utf8_stdout)
-      @info[:installed] = !params.nil?
-      return @info unless @info[:installed]
-
-      @info[:version] = params[1]
-      @info
-    end
-
-    def installed?
-      info[:installed] == true
-    end
-
-    def version
-      info[:version]
-    end
-
-    def to_s
-      "R Module #{@package_name}"
-    end
-  end
-end

data/lib/inspec/resources/crontab.rb

@@ -1,173 +0,0 @@
-require "inspec/resources/file"
-require "inspec/utils/parser"
-require "inspec/utils/filter"
-
-module Inspec::Resources
-  class Crontab < Inspec.resource(1)
-    name "crontab"
-    supports platform: "unix"
-    desc "Use the crontab InSpec audit resource to test the contents of the crontab for a given user which contains information about scheduled tasks owned by that user."
-    example <<~EXAMPLE
-      describe crontab(user: 'root') do
-        its('commands') { should include '/path/to/some/script' }
-      end
-
-      describe crontab('myuser').commands('/home/myuser/build.sh') do
-        its('hours') { should cmp '*' }
-        its('minutes') { should cmp '*' }
-      end
-
-      describe crontab.where({'hour' => '*', 'minute' => '*'}) do
-        its('entries.length') { should cmp '0' }
-      end
-
-      describe crontab.where { command =~ /a partial command string/ } do
-        its('entries.length') { should cmp 1 }
-      end
-
-      describe crontab(path: '/etc/cron.d/some_crontab') do
-        its('commands') { should include '/path/to/some/script' }
-      end
-    EXAMPLE
-
-    attr_reader :params
-
-    include CommentParser
-
-    def initialize(opts = nil)
-      if opts.respond_to?(:fetch)
-        Hash[opts.map { |k, v| [k.to_sym, v] }]
-        @user = opts.fetch(:user, nil)
-        @path = opts.fetch(:path, nil)
-        raise Inspec::Exceptions::ResourceFailed, "A user or path must be supplied." if @user.nil? && @path.nil?
-        raise Inspec::Exceptions::ResourceFailed, "Either user or path must be supplied, not both!" if !@user.nil? && !@path.nil?
-      else
-        @user = opts
-        @path = nil
-      end
-      @params = read_crontab
-    end
-
-    def read_crontab
-      if is_system_crontab?
-        raise Inspec::Exceptions::ResourceFailed, "Supplied crontab path '#{@path}' must exist!" unless inspec.file(@path).exist?
-
-        ct = inspec.file(@path).content
-      else
-        ct = inspec.command(crontab_cmd).stdout
-      end
-      ct.lines.map { |l| parse_crontab_line(l) }.compact
-    end
-
-    def parse_crontab_line(l)
-      data, = parse_comment_line(l, comment_char: "#", standalone_comments: false)
-      return nil if data.nil? || data.empty?
-
-      is_system_crontab? ? parse_system_crontab(data) : parse_user_crontab(data)
-    end
-
-    def crontab_cmd
-      @user.nil? ? "crontab -l" : "crontab -l -u #{@user}"
-    end
-
-    filter = FilterTable.create
-    filter.register_column(:minutes, field: "minute")
-      .register_column(:hours,    field: "hour")
-      .register_column(:days,     field: "day")
-      .register_column(:months,   field: "month")
-      .register_column(:weekdays, field: "weekday")
-      .register_column(:user,     field: "user")
-      .register_column(:commands, field: "command")
-
-    # rebuild the crontab line from raw content
-    filter.register_custom_property(:content) do |t, _|
-      t.entries.map do |e|
-        [e.minute, e.hour, e.day, e.month, e.weekday, e.user, e.command].compact.join(" ")
-      end.join("\n")
-    end
-
-    filter.install_filter_methods_on_resource(self, :params)
-
-    def to_s
-      if is_system_crontab?
-        "crontab for path #{@path}"
-      elsif is_user_crontab?
-        "crontab for user #{@user}"
-      else
-        "crontab for current user"
-      end
-    end
-
-    private
-
-    def is_system_crontab?
-      !@path.nil?
-    end
-
-    def is_user_crontab?
-      !@user.nil?
-    end
-
-    def parse_system_crontab(data)
-      case data
-      when /@hourly .*/
-        elements = data.split(/\s+/, 3)
-        { "minute" => "0", "hour" => "*", "day" => "*", "month" => "*", "weekday" => "*", "user" => elements.at(1), "command" => elements.at(2) }
-      when /@(midnight|daily) .*/
-        elements = data.split(/\s+/, 3)
-        { "minute" => "0", "hour" => "0", "day" => "*", "month" => "*", "weekday" => "*", "user" => elements.at(1), "command" => elements.at(2) }
-      when /@weekly .*/
-        elements = data.split(/\s+/, 3)
-        { "minute" => "0", "hour" => "0", "day" => "*", "month" => "*", "weekday" => "0", "user" => elements.at(1), "command" => elements.at(2) }
-      when /@monthly ./
-        elements = data.split(/\s+/, 3)
-        { "minute" => "0", "hour" => "0", "day" => "1", "month" => "*", "weekday" => "*", "user" => elements.at(1), "command" => elements.at(2) }
-      when /@(annually|yearly) .*/
-        elements = data.split(/\s+/, 3)
-        { "minute" => "0", "hour" => "0", "day" => "1", "month" => "1", "weekday" => "*", "user" => elements.at(1), "command" => elements.at(2) }
-      when /@reboot .*/
-        elements = data.split(/\s+/, 3)
-        { "minute" => "-1", "hour" => "-1", "day" => "-1", "month" => "-1", "weekday" => "-1", "user" => elements.at(1), "command" => elements.at(2) }
-      else
-        elements = data.split(/\s+/, 7)
-        {
-          "minute" => elements.at(0),
-          "hour" => elements.at(1),
-          "day" => elements.at(2),
-          "month" => elements.at(3),
-          "weekday" => elements.at(4),
-          "user" => elements.at(5),
-          "command" => elements.at(6),
-        }
-      end
-    end
-
-    def parse_user_crontab(data)
-      case data
-      when /@hourly .*/
-        { "minute" => "0", "hour" => "*", "day" => "*", "month" => "*", "weekday" => "*", "user" => @user, "command" => data.split(/\s+/, 2).at(1) }
-      when /@(midnight|daily) .*/
-        { "minute" => "0", "hour" => "0", "day" => "*", "month" => "*", "weekday" => "*", "user" => @user, "command" => data.split(/\s+/, 2).at(1) }
-      when /@weekly .*/
-        { "minute" => "0", "hour" => "0", "day" => "*", "month" => "*", "weekday" => "0", "user" => @user, "command" => data.split(/\s+/, 2).at(1) }
-      when /@monthly ./
-        { "minute" => "0", "hour" => "0", "day" => "1", "month" => "*", "weekday" => "*", "user" => @user, "command" => data.split(/\s+/, 2).at(1) }
-      when /@(annually|yearly) .*/
-        { "minute" => "0", "hour" => "0", "day" => "1", "month" => "1", "weekday" => "*", "user" => @user, "command" => data.split(/\s+/, 2).at(1) }
-      when /@reboot .*/
-        { "minute" => "-1", "hour" => "-1", "day" => "-1", "month" => "-1", "weekday" => "-1", "user" => @user, "command" => data.split(/\s+/, 2).at(1) }
-      else
-        elements = data.split(/\s+/, 6)
-        {
-          "minute" => elements.at(0),
-          "hour" => elements.at(1),
-          "day" => elements.at(2),
-          "month" => elements.at(3),
-          "weekday" => elements.at(4),
-          "user" => @user,
-          "command" => elements.at(5),
-        }
-      end
-    end
-  end
-end