inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/filesystem.rb

@@ -1,139 +0,0 @@
-require "inspec/resources/command"
-
-module Inspec::Resources
-  class FileSystemResource < Inspec.resource(1)
-    name "filesystem"
-    supports platform: "linux"
-    supports platform: "windows"
-    desc "Use the filesystem InSpec resource to test file system"
-    example <<~EXAMPLE
-      describe filesystem('/') do
-        its('size_kb') { should be >= 32000 }
-        its('free_kb') { should be >= 3200 }
-        its('type') { should cmp 'ext4' }
-        its('percent_free') { should be >= 20 }
-      end
-      describe filesystem('c:') do
-        its('size_kb') { should be >= 9000 }
-        its('free_kb') { should be >= 3200 }
-        its('type') { should cmp 'NTFS' }
-        its('percent_free') { should be >= 20 }
-      end
-    EXAMPLE
-    attr_reader :partition
-
-    def initialize(partition)
-      @partition = partition
-      @cache = nil
-      # select file system manager
-      @fsman = nil
-
-      os = inspec.os
-      if os.linux?
-        @fsman = LinuxFileSystemResource.new(inspec)
-      elsif os.windows?
-        @fsman = WindowsFileSystemResource.new(inspec)
-      else
-        raise Inspec::Exceptions::ResourceSkipped, "The `filesystem` resource is not supported on your OS yet."
-      end
-    end
-
-    def info
-      return @cache unless @cache.nil?
-      return {} if @fsman.nil?
-
-      @cache = @fsman.info(@partition)
-    end
-
-    def to_s
-      "FileSystem #{@partition}"
-    end
-
-    def size_kb
-      info = @fsman.info(@partition)
-      info[:size_kb]
-    end
-
-    def size
-      Inspec.deprecate(:property_filesystem_size, "The `size` property did not reliably use the correct units. Please use `size_kb` instead.")
-      if inspec.os.windows?
-        # On windows, we had a bug prior to #3767 in which the
-        # 'size' value was be scaled to GB in powershell.
-        # We now collect it in KB.
-        (size_kb / (1024 * 1024)).to_i
-      else
-        size_kb
-      end
-    end
-
-    def free_kb
-      info = @fsman.info(@partition)
-      info[:free_kb]
-    end
-
-    def percent_free
-      100 * free_kb / size_kb
-    end
-
-    def type
-      info = @fsman.info(@partition)
-      info[:type]
-    end
-
-    def name
-      info = @fsman.info(@partition)
-      info[:name]
-    end
-  end
-
-  class FsManagement
-    attr_reader :inspec
-    def initialize(inspec)
-      @inspec = inspec
-    end
-  end
-
-  class LinuxFileSystemResource < FsManagement
-    def info(partition)
-      cmd = inspec.command("df #{partition} -PT")
-      if cmd.stdout.nil? || cmd.stdout.empty? || cmd.exit_status != 0
-        raise Inspec::Exceptions::ResourceFailed,
-              "Unable to get available space for partition #{partition}"
-      end
-      value = cmd.stdout.split(/\n/)[1].strip.split(" ")
-      {
-        name: partition,
-        size_kb: value[2].to_i,
-        free_kb: value[4].to_i,
-        type: value[1].to_s,
-      }
-    end
-  end
-
-  class WindowsFileSystemResource < FsManagement
-    def info(partition)
-      cmd = inspec.command <<-EOF.gsub(/^\s*/, "")
-        $disk = Get-WmiObject Win32_LogicalDisk -Filter "DeviceID='#{partition}'"
-        $disk.Size = $disk.Size / 1KB
-        $disk.FreeSpace = $disk.FreeSpace / 1KB
-        $disk | select -property DeviceID,Size,FileSystem,FreeSpace | ConvertTo-Json
-      EOF
-
-      raise Inspec::Exceptions::ResourceSkipped, "Unable to get available space for partition #{partition}" if cmd.stdout == "" || cmd.exit_status.to_i != 0
-
-      begin
-        fs = JSON.parse(cmd.stdout)
-      rescue JSON::ParserError => e
-        raise Inspec::Exceptions::ResourceFailed,
-              "Failed to parse JSON from Powershell. " \
-              "Error: #{e}"
-      end
-      {
-        name: fs["DeviceID"],
-        size_kb: fs["Size"].to_i,
-        free_kb: fs["FreeSpace"].to_i,
-        type: fs["FileSystem"],
-      }
-    end
-  end
-end

data/lib/inspec/resources/firewalld.rb

@@ -1,148 +0,0 @@
-require "inspec/resources/command"
-
-module Inspec::Resources
-  class FirewallD < Inspec.resource(1)
-    ###
-    #  This recourse assumes that the file sudo vim /etc/polkit-1/rules.d/49-nopasswd_global.rules has been
-    #  set to allow users in group "wheel" to perform any commands without authentication.
-    ###
-
-    name "firewalld"
-    supports platform: "linux"
-    desc "Use the firewalld resource to check and see if firewalld is configured to grand or deny access to specific hosts or services"
-    example <<~EXAMPLE
-      describe firewalld do
-        it { should be_running }
-        its('default_zone') { should eq 'public' }
-        it { should have_service_enabled_in_zone('ssh', 'public') }
-        it { should have_rule_enabled('rule family=ipv4 source address=192.168.0.14 accept', 'public') }
-      end
-
-      describe firewalld.where { zone == 'public' } do
-        its('interfaces') { should cmp ['enp0s3', 'eno2'] }
-        its('sources') { should cmp ['ssh', 'icmp'] }
-        its('services') { should cmp ['192.168.1.0/24', '192.168.1.2'] }
-      end
-    EXAMPLE
-
-    attr_reader :params
-
-    filter = FilterTable.create
-    filter.register_column(:zone, field: "zone")
-      .register_column(:interfaces, field: "interfaces")
-      .register_column(:sources,    field: "sources")
-      .register_column(:services,   field: "services")
-
-    filter.install_filter_methods_on_resource(self, :params)
-
-    def initialize
-      @params = parse_active_zones(active_zones)
-    end
-
-    def installed?
-      inspec.command("firewall-cmd").exist?
-    end
-
-    def has_zone?(query_zone)
-      return false unless installed?
-
-      result = firewalld_command("--get-zones").split(" ")
-      result.include?(query_zone)
-    end
-
-    def running?
-      return false unless installed?
-
-      result = firewalld_command("--state")
-      result =~ /^running/ ? true : false
-    end
-
-    def default_zone
-      # return: word associated with the name of the default zone
-      # example: 'public'
-      firewalld_command("--get-default-zone")
-    end
-
-    def has_service_enabled_in_zone?(query_service, query_zone = default_zone)
-      firewalld_command("--zone=#{query_zone} --query-service=#{query_service}") == "yes"
-    end
-
-    def service_ports_enabled_in_zone(query_service, query_zone = default_zone)
-      # return: String of ports open
-      # example: ['22/tcp', '4722/tcp']
-      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-ports --permanent").split(" ")
-    end
-
-    def service_protocols_enabled_in_zone(query_service, query_zone = default_zone)
-      # return: String of protocoals open
-      # example: ['icmp', 'ipv4', 'igmp']
-      firewalld_command("--zone=#{query_zone} --service=#{query_service} --get-protocols --permanent").split(" ")
-    end
-
-    def has_port_enabled_in_zone?(query_port, query_zone = default_zone)
-      firewalld_command("--zone=#{query_zone} --query-port=#{query_port}") == "yes"
-    end
-
-    def has_rule_enabled?(rule, query_zone = default_zone)
-      rule = "rule #{rule}" unless rule.start_with?("rule")
-      firewalld_command("--zone=#{query_zone} --query-rich-rule='#{rule}'") == "yes"
-    end
-
-    def to_s
-      "Firewall Rules"
-    end
-
-    private
-
-    def active_zones
-      # return syntax:
-      #   [default-zone-name]
-      #       interfaces: [open interfases]
-      #
-      # example:
-      #   public
-      #       interfaces: enp0s3
-      firewalld_command("--get-active-zones")
-    end
-
-    def parse_active_zones(content)
-      # Split by every second line, which contains the zone and the interfaces.
-      content = content.split(/\n/).each_slice(2).map { |slice| slice.join("\n") }
-      content.map do |line|
-        parse_line(line)
-      end.compact
-    end
-
-    def parse_line(line)
-      zone = line.split("\n")[0]
-      {
-        "zone" => zone,
-        "interfaces" => line.split(":")[1].split(" "),
-        "services" => services_bound(zone),
-        "sources" => sources_bound(zone),
-      }
-    end
-
-    def sources_bound(query_zone)
-      # result: a list containing either an ip address or ip address with a mask, or a ipset or an ipset with the ipset prefix.
-      # example: ['192.168.0.4', '192.168.0.0/16', '2111:DB28:ABC:12::', '2111:db89:ab3d:0112::0/64']
-      firewalld_command("--zone=#{query_zone} --list-sources").split(" ")
-    end
-
-    def services_bound(query_zone)
-      # result: a list of services bound to a zone.
-      # example: ['ssh', 'dhcpv6-client']
-      firewalld_command("--zone=#{query_zone} --list-services").split(" ")
-    end
-
-    def firewalld_command(command)
-      command = "firewall-cmd #{command}"
-      result = inspec.command(command)
-      if result.stderr != ""
-        return "Error on command #{command}: #{result.stderr}"
-      end
-
-      result.stdout.strip
-    end
-  end
-end

data/lib/inspec/resources/gem.rb

@@ -1,80 +0,0 @@
-# circular: require "inspec/resource"
-# but... already being included by inspec/resource.rb
-
-module Inspec::Resources
-  class GemPackage < Inspec.resource(1)
-    name "gem" # TODO: rename to "rubygem" and provide alias
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the gem InSpec audit resource to test if a global gem package is installed."
-    example <<~EXAMPLE
-      describe gem('rubocop') do
-        it { should be_installed }
-        its('version') { should eq '0.33.0' }
-      end
-    EXAMPLE
-
-    attr_reader :gem_binary
-
-    def initialize(package_name, gem_binary = nil)
-      @package_name = package_name
-      @gem_binary = case gem_binary # TODO: no. this is not right
-                    when nil
-                      "gem"
-                    when :chef
-                      if inspec.os.windows?
-                        # TODO: what about chef-dk or other installs?
-                        'c:\opscode\chef\embedded\bin\gem.bat'
-                      else
-                        "/opt/chef/embedded/bin/gem"
-                      end
-                    when :chef_server
-                      "/opt/opscode/embedded/bin/gem"
-                    else
-                      gem_binary
-                    end
-      skip_resource "Unable to retrieve gem information" if info.empty?
-    end
-
-    def info
-      return @info if defined?(@info)
-
-      require "inspec/resources/command"
-
-      cmd = inspec.command("#{@gem_binary} list --local -a -q \^#{@package_name}\$")
-      return {} unless cmd.exit_status == 0
-
-      # extract package name and version
-      # parses data like winrm (1.3.4, 1.3.3)
-      params = /^\s*([^\(]*?)\s*\((.*?)\)\s*$/.match(cmd.stdout.chomp)
-      @info = {
-        installed: !params.nil?,
-        type: "gem",
-      }
-      return @info unless @info[:installed]
-
-      versions = params[2].split(",").map(&:strip)
-      @info[:name] = params[1]
-      @info[:version] = versions[0]
-      @info[:versions] = versions
-      @info
-    end
-
-    def installed?
-      info[:installed] == true
-    end
-
-    def version
-      info[:version]
-    end
-
-    # this returns an array of strings
-    def versions
-      info[:versions]
-    end
-
-    def to_s
-      "gem package #{@package_name}"
-    end
-  end
-end

data/lib/inspec/resources/group.rb

@@ -1,2 +0,0 @@
-# This is just here to make the dynamic loader happy.
-require "inspec/resources/groups"

data/lib/inspec/resources/groups.rb

@@ -1,241 +0,0 @@
-require "inspec/resources/etc_group"
-require "inspec/resources/powershell"
-require "inspec/resources/parse_config"
-require "inspec/utils/filter"
-
-module Inspec::Resources
-  # This file contains two resources, the `group` and `groups` resource.
-  # The `group` resource is optimized for requests that verify specific groups
-  # that you know upfront for testing. If you need to query all groups or search
-  # specific groups with certain properties, use the `groups` resource.
-  module GroupManagementSelector
-    # select group provider based on the operating system
-    # returns nil, if no group manager was found for the operating system
-    def select_group_manager(os)
-      @group_provider = if os.darwin?
-                          DarwinGroup.new(inspec)
-                        elsif os.unix?
-                          UnixGroup.new(inspec)
-                        elsif os.windows?
-                          WindowsGroup.new(inspec)
-                        end
-    end
-  end
-
-  class Groups < Inspec.resource(1)
-    include GroupManagementSelector
-
-    name "groups"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the group InSpec audit resource to test groups on the system. Groups can be filtered."
-    example <<~EXAMPLE
-      describe groups.where { name == 'root'} do
-        its('names') { should eq ['root'] }
-        its('gids') { should eq [0] }
-      end
-
-      describe groups.where { name == 'Administrators'} do
-        its('names') { should eq ['Administrators'] }
-        its('gids') { should eq ['S-1-5-32-544'] }
-      end
-    EXAMPLE
-
-    def initialize
-      # select group manager
-      @group_provider = select_group_manager(inspec.os)
-      return skip_resource "The `groups` resource is not supported on your OS yet." if @group_provider.nil?
-    end
-
-    filter = FilterTable.create
-    filter.register_custom_matcher(:exists?) { |x| !x.entries.empty? }
-    filter.register_column(:names, field: "name")
-      .register_column(:gids,      field: "gid")
-      .register_column(:domains,   field: "domain")
-      .register_column(:members,   field: "members", style: :simple)
-    filter.install_filter_methods_on_resource(self, :collect_group_details)
-
-    def to_s
-      "Groups"
-    end
-
-    private
-
-    # collects information about every group
-    def collect_group_details
-      return @groups_cache ||= @group_provider.groups unless @group_provider.nil?
-
-      []
-    end
-  end
-
-  # Usage:
-  # describe group('root') do
-  #   it { should exist }
-  #   its('gid') { should eq 0 }
-  # end
-  #
-  class Group < Inspec.resource(1)
-    include GroupManagementSelector
-
-    name "group"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the group InSpec audit resource to test groups on the system."
-    example <<~EXAMPLE
-      describe group('root') do
-        it { should exist }
-        its('gid') { should eq 0 }
-      end
-
-      describe group('Administrators') do
-        its('members') { should include 'Administrator' }
-      end
-    EXAMPLE
-
-    def initialize(groupname)
-      @group = groupname
-
-      # select group manager
-      @group_provider = select_group_manager(inspec.os)
-      return skip_resource "The `group` resource is not supported on your OS yet." if @group_provider.nil?
-    end
-
-    # verifies if a group exists
-    def exists?
-      !group_info.entries.empty?
-    end
-
-    def gid
-      flatten_entry(group_info, "gid")
-    end
-
-    def members
-      flatten_entry(group_info, "members")
-    end
-
-    def local
-      # at this point the implementation only returns local groups
-      true
-    end
-
-    def to_s
-      "Group #{@group}"
-    end
-
-    private
-
-    def flatten_entry(group_info, prop)
-      entries = group_info.entries
-      if entries.empty?
-        nil
-      elsif entries.size == 1
-        entries.first.send(prop)
-      else
-        raise "found more than one group with the same name, please use `groups` resource"
-      end
-    end
-
-    def group_info
-      # we need a local copy for the block
-      group = @group.dup
-      @groups_cache ||= inspec.groups.where { name == group }
-    end
-  end
-
-  class GroupInfo
-    attr_reader :inspec
-    def initialize(inspec)
-      @inspec = inspec
-    end
-
-    def groups
-      raise "group provider must implement the `groups` method"
-    end
-  end
-
-  # implements generic unix groups via /etc/group
-  class UnixGroup < GroupInfo
-    def groups
-      inspec.etc_group.entries
-    end
-  end
-
-  # OSX uses opendirectory for groups, so `/etc/group` may not be fully accurate
-  # This uses `dscacheutil` to get the group info instead of `etc_group`
-  class DarwinGroup < GroupInfo
-    def runmap(cmd, &blk)
-      hashmap(inspec.command(cmd).stdout.lines, &blk)
-    end
-
-    def hashmap(enum, &blk)
-      enum.map(&blk).to_h
-    end
-
-    def groups
-      group_by_id = runmap("dscl . -list /Groups PrimaryGroupID")  { |l| name, id = l.split; [id.to_i, name] }
-      userss      = runmap("dscl . -list /Users  PrimaryGroupID")  { |l| name, id = l.split; [name, id.to_i] }
-      membership  = runmap("dscl . -list /Groups GroupMembership") { |l| key, *vs = l.split; [key, vs] }
-      membership.default_proc = ->(h, k) { h[k] = [] }
-
-      users_by_group = hashmap(userss.keys.group_by { |k| userss[k] }) { |k, vs| [group_by_id[k], vs] }
-      users_by_group.each do |name, users|
-        membership[name].concat users
-      end
-
-      group_info = inspec.command("dscacheutil -q group").stdout.split("\n\n").uniq
-
-      regex = /^([^:]*?)\s*:\s(.*?)\s*$/
-      groups = group_info.map do |data|
-        inspec.parse_config(data, assignment_regex: regex).params
-      end
-
-      # Convert the `dscacheutil` groups to match `inspec.etc_group.entries`
-      groups.each { |g| g["gid"] = g["gid"].to_i }
-      groups.each do |g|
-        users = g.delete("users") || ""
-        users = users.split
-        users += Array(users_by_group[g["name"]])
-        g["members"] = users
-        g["members"].sort.join ","
-      end
-    end
-  end
-
-  class WindowsGroup < GroupInfo
-    # returns all local groups
-    def groups
-      script = <<-EOH
-        Function ConvertTo-SID { Param([byte[]]$BinarySID)
-          (New-Object System.Security.Principal.SecurityIdentifier($BinarySID,0)).Value
-        }
-        $Computername = $Env:Computername
-        $adsi = [ADSI]"WinNT://$Computername"
-        $groups = $adsi.Children | where {$_.SchemaClassName -eq 'group'} | ForEach {
-          $name = $_.Name[0]
-          $sid = ConvertTo-SID -BinarySID $_.ObjectSID[0]
-          $group =[ADSI]$_.Path
-          $members = $_.Members() | Foreach-Object { $_.GetType().InvokeMember('Name', 'GetProperty', $null, $_, $null) }
-          # An empty collection of these objects isn't properly converted to an empty array by ConvertTo-Json
-          if(-not [bool]$members) {
-            $members = @()
-          }
-          new-object psobject -property @{name = $group.Name[0]; gid = $sid; domain = $Computername; members = $members}
-        }
-        $groups | ConvertTo-Json -Depth 3
-      EOH
-      cmd = inspec.powershell(script)
-      # cannot rely on exit code for now, successful command returns exit code 1
-      # return nil if cmd.exit_status != 0, try to parse json
-      begin
-        groups = JSON.parse(cmd.stdout)
-      rescue JSON::ParserError => _e
-        return []
-      end
-
-      # ensure we have an array of groups
-      groups = [groups] unless groups.is_a?(Array)
-      groups
-    end
-  end
-end