inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/iptables.rb

@@ -1,80 +0,0 @@
-require "inspec/resources/command"
-
-# Usage:
-# describe iptables do
-#   it { should have_rule('-P INPUT ACCEPT') }
-# end
-#
-# The following serverspec sytax is not implemented:
-# describe iptables do
-#   it { should have_rule('-P INPUT ACCEPT').with_table('mangle').with_chain('INPUT') }
-# end
-# Please use the new sytax:
-# describe iptables(table:'mangle', chain: 'input') do
-#   it { should have_rule('-P INPUT ACCEPT') }
-# end
-#
-# Note: Docker containers normally do not have iptables installed
-#
-# @see http://ipset.netfilter.org/iptables.man.html
-# @see http://ipset.netfilter.org/iptables.man.html
-# @see https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html
-module Inspec::Resources
-  class IpTables < Inspec.resource(1)
-    name "iptables"
-    supports platform: "linux"
-    desc "Use the iptables InSpec audit resource to test rules that are defined in iptables, which maintains tables of IP packet filtering rules. There may be more than one table. Each table contains one (or more) chains (both built-in and custom). A chain is a list of rules that match packets. When the rule matches, the rule defines what target to assign to the packet."
-    example <<~EXAMPLE
-      describe iptables do
-        it { should have_rule('-P INPUT ACCEPT') }
-      end
-    EXAMPLE
-
-    def initialize(params = {})
-      @table = params[:table]
-      @chain = params[:chain]
-
-      # we're done if we are on linux
-      return if inspec.os.linux?
-
-      # ensures, all calls are aborted for non-supported os
-      @iptables_cache = []
-      skip_resource "The `iptables` resource is not supported on your OS yet."
-    end
-
-    def has_rule?(rule = nil, _table = nil, _chain = nil)
-      # checks if the rule is part of the ruleset
-      # for now, we expect an exact match
-      retrieve_rules.any? { |line| line.casecmp(rule) == 0 }
-    end
-
-    def retrieve_rules
-      return @iptables_cache if defined?(@iptables_cache)
-
-      # construct iptables command to read all rules
-      bin = find_iptables_or_error
-      table_cmd = "-t #{@table}" if @table
-      iptables_cmd = format("%s %s -S %s", bin, table_cmd, @chain).strip
-
-      cmd = inspec.command(iptables_cmd)
-      return [] if cmd.exit_status.to_i != 0
-
-      # split rules, returns array or rules
-      @iptables_cache = cmd.stdout.split("\n").map(&:strip)
-    end
-
-    def to_s
-      format("Iptables %s %s", @table && "table: #{@table}", @chain && "chain: #{@chain}").strip
-    end
-
-    private
-
-    def find_iptables_or_error
-      %w{/usr/sbin/iptables /sbin/iptables iptables}.each do |cmd|
-        return cmd if inspec.command(cmd).exist?
-      end
-
-      raise Inspec::Exceptions::ResourceFailed, "Could not find `iptables`"
-    end
-  end
-end

data/lib/inspec/resources/json.rb

@@ -1,116 +0,0 @@
-require "inspec/utils/object_traversal"
-require "inspec/utils/enumerable_delegation"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class JsonConfig < Inspec.resource(1)
-    name "json"
-    supports platform: "os"
-    desc "Use the json InSpec audit resource to test data in a JSON file."
-    example <<~EXAMPLE
-      describe json('policyfile.lock.json') do
-        its(['cookbook_locks','omnibus','version']) { should eq('2.2.0') }
-      end
-
-      describe json({ command: 'retrieve_data.py --json' }) do
-        its('state') { should eq('open') }
-      end
-
-      describe json({ content: '{\"item1\": { \"status\": \"available\" } }' }) do
-        its(['item1', 'status']) { should cmp 'available' }
-      end
-    EXAMPLE
-
-    include ObjectTraverser
-    include FileReader
-
-    # make params readable
-    attr_reader :params, :raw_content
-
-    def initialize(opts)
-      # pre-initialize @params to an empty hash. In the event that reading/parsing the data
-      # throws an exception, this allows the resource to still be called outside of a
-      # describe/test and not throw errors when a caller attempts to fetch a value from the params.
-      @params = {}
-
-      # load the raw content from the source, and then parse it
-      @raw_content = load_raw_content(opts)
-      @params = parse(@raw_content)
-
-      # If the JSON content is enumerable, make this object enumerable too
-      extend EnumerableDelegation if @params.respond_to?(:each)
-    end
-
-    # Shorthand to retrieve a parameter name via `#its`.
-    # Example: describe json('file') { its('paramX') { should eq 'Y' } }
-    #
-    # @param [String] name name of the field to retrieve
-    # @return [Object] the value stored at this position
-    def method_missing(*keys)
-      # catch bahavior of rspec its implementation
-      # @see https://github.com/rspec/rspec-its/blob/master/lib/rspec/its.rb#L110
-      keys.shift if keys.is_a?(Array) && keys[0] == :[]
-      value(keys)
-    end
-
-    def value(key)
-      # uses ObjectTraverser.extract_value to walk the hash looking for the key,
-      # which may be an Array of keys for a nested Hash.
-      extract_value(key, params)
-    end
-
-    def to_s
-      "#{resource_base_name} #{@resource_name_supplement || "content"}"
-    end
-
-    private
-
-    def parse(content)
-      require "json"
-      JSON.parse(content)
-    rescue => e
-      raise Inspec::Exceptions::ResourceFailed, "Unable to parse JSON: #{e.message}"
-    end
-
-    def load_raw_content(opts)
-      # if the opts isn't a hash, we assume it's a path to a file
-      unless opts.is_a?(Hash)
-        @resource_name_supplement = opts
-        return load_raw_from_file(opts)
-      end
-
-      if opts.key?(:command)
-        @resource_name_supplement = "from command: #{opts[:command]}"
-        load_raw_from_command(opts[:command])
-      elsif opts.key?(:content)
-        opts[:content]
-      else
-        raise Inspec::Exceptions::ResourceFailed, "No JSON content; must specify a file, command, or raw JSON content"
-      end
-    end
-
-    def load_raw_from_file(path)
-      read_file_content(path)
-    end
-
-    def load_raw_from_command(command)
-      result = inspec.command(command)
-
-      return result.stdout unless result.stdout.empty?
-
-      msg = if result.stderr.empty?
-              "No JSON output, STDERR was empty"
-            else
-              "No JSON output, STDERR:\n #{result.stderr}"
-            end
-
-      raise Inspec::Exceptions::ResourceFailed, msg
-    end
-
-    # for resources the subclass JsonConfig, this allows specification of the resource
-    # base name in each subclass so we can build a good to_s method
-    def resource_base_name
-      "JSON"
-    end
-  end
-end

data/lib/inspec/resources/kernel_module.rb

@@ -1,106 +0,0 @@
-require "inspec/resources/command"
-
-module Inspec::Resources
-  class KernelModule < Inspec.resource(1)
-    name "kernel_module"
-    supports platform: "unix"
-    desc 'Use the kernel_module InSpec audit resource to test kernel modules on
-    Linux platforms. These parameters are located under /lib/modules. Any submodule
-    may be tested using this resource.
-
-    The `kernel_module` resource can also verify if a kernel module is `blacklisted`
-    or if a module is disabled via a fake install using the `bin_true` or `bin_false`
-    method.'
-
-    example <<~EXAMPLE
-      describe kernel_module('video') do
-        it { should be_loaded }
-        it { should_not be_disabled }
-        it { should_not be_blacklisted }
-      end
-
-      describe kernel_module('sstfb') do
-        it { should_not be_loaded }
-        it { should be_disabled }
-      end
-
-      describe kernel_module('floppy') do
-        it { should be_blacklisted }
-      end
-
-      describe kernel_module('dhcp') do
-        it { should_not be_loaded }
-      end
-    EXAMPLE
-
-    def initialize(modulename = nil)
-      @module = modulename
-      # this resource is only supported on Linux
-      return skip_resource "The `kernel_parameter` resource is not supported on your OS." unless inspec.os.linux?
-    end
-
-    def loaded?
-      if inspec.os.redhat? || inspec.os.name == "fedora"
-        lsmod_cmd = "/sbin/lsmod"
-      else
-        lsmod_cmd = "lsmod"
-      end
-
-      # get list of all modules
-      cmd = inspec.command(lsmod_cmd)
-      return false if cmd.exit_status != 0
-
-      # check if module is loaded
-      re = Regexp.new("^" + Regexp.quote(@module) + '\s')
-      found = cmd.stdout.match(re)
-      !found.nil?
-    end
-
-    def disabled?
-      !modprobe_output.match(%r{^install\s+#{@module}\s+/(s?)bin/(true|false)}).nil?
-    end
-
-    def blacklisted?
-      !modprobe_output.match(/^blacklist\s+#{@module}/).nil? || disabled_via_bin_true? || disabled_via_bin_false?
-    end
-
-    def version
-      cmd = inspec.command("#{modinfo_cmd_for_os} -F version #{@module}")
-      cmd.exit_status == 0 ? cmd.stdout.delete("\n") : nil
-    end
-
-    def to_s
-      "Kernel Module #{@module}"
-    end
-
-    private
-
-    def modprobe_output
-      @modprobe_output ||= inspec.command("#{modprobe_cmd_for_os} --showconfig").stdout
-    end
-
-    def modinfo_cmd_for_os
-      if inspec.os.redhat? || inspec.os.name == "fedora"
-        "/sbin/modinfo"
-      else
-        "modinfo"
-      end
-    end
-
-    def modprobe_cmd_for_os
-      if inspec.os.redhat? || inspec.os.name == "fedora"
-        "/sbin/modprobe"
-      else
-        "modprobe"
-      end
-    end
-
-    def disabled_via_bin_true?
-      !modprobe_output.match(%r{^install\s+#{@module}\s+/(s?)bin/true}).nil?
-    end
-
-    def disabled_via_bin_false?
-      !modprobe_output.match(%r{^install\s+#{@module}\s+/(s?)bin/false}).nil?
-    end
-  end
-end

data/lib/inspec/resources/kernel_parameter.rb

@@ -1,54 +0,0 @@
-require "inspec/resources/command"
-
-module Inspec::Resources
-  class KernelParameter < Inspec.resource(1)
-    name "kernel_parameter"
-    supports platform: "unix"
-    desc "Use the kernel_parameter InSpec audit resource to test kernel parameters on Linux platforms."
-    example <<~EXAMPLE
-      describe kernel_parameter('net.ipv4.conf.all.forwarding') do
-        its('value') { should eq 0 }
-      end
-    EXAMPLE
-
-    def initialize(parameter = nil)
-      @parameter = parameter
-
-      # this resource is only supported on Linux
-      return skip_resource "The `kernel_parameter` resource is not supported on your OS." unless inspec.os.linux?
-    end
-
-    def value
-      cmd = inspec.command("/sbin/sysctl -q -n #{@parameter}")
-      return nil if cmd.exit_status != 0
-
-      # remove whitespace
-      cmd = cmd.stdout.chomp.strip
-      # convert to number if possible
-      cmd = cmd.to_i if cmd =~ /^\d+$/
-      cmd
-    end
-
-    def to_s
-      "Kernel Parameter #{@parameter}"
-    end
-  end
-
-  class LinuxKernelParameter < KernelParameter
-    name "linux_kernel_parameter"
-
-    def initialize(parameter)
-      Inspec.deprecate(:resource_linux_kernel_parameter, "The `linux_kernel_parameter` resource is deprecated. Please use `kernel_parameter`")
-      super(parameter)
-    end
-
-    def value
-      Inspec.deprecate(:resource_linux_kernel_parameter, "The `linux_kernel_parameter` resource is deprecated. Please use `kernel_parameter`")
-      super()
-    end
-
-    def to_s
-      "Kernel Parameter #{@parameter}"
-    end
-  end
-end

data/lib/inspec/resources/key_rsa.rb

@@ -1,66 +0,0 @@
-require "openssl"
-require "hashie/mash"
-require "inspec/utils/file_reader"
-require "inspec/utils/pkey_reader"
-
-module Inspec::Resources
-  class RsaKey < Inspec.resource(1)
-    name "key_rsa"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "public/private RSA key pair test"
-    example <<~EXAMPLE
-      describe key_rsa('/etc/pki/www.mywebsite.com.key') do
-        its('public_key') { should match /BEGIN RSA PUBLIC KEY/ }
-      end
-
-      describe key_rsa('/etc/pki/www.mywebsite.com.key', 'passphrase') do
-        it { should be_private }
-        it { should be_public }
-      end
-    EXAMPLE
-
-    include FileReader
-    include PkeyReader
-
-    def initialize(keypath, passphrase = nil)
-      @key_path = keypath
-      @passphrase = passphrase
-      @key = read_pkey(read_file_content(@key_path, allow_empty: true), @passphrase)
-    end
-
-    def public?
-      return if @key.nil?
-
-      @key.public?
-    end
-
-    def public_key
-      return if @key.nil?
-
-      @key.public_key.to_s
-    end
-
-    def private?
-      return if @key.nil?
-
-      @key.private?
-    end
-
-    def private_key
-      return if @key.nil?
-
-      @key.to_s
-    end
-
-    def key_length
-      return if @key.nil?
-
-      @key.public_key.n.num_bytes * 8
-    end
-
-    def to_s
-      "rsa_key #{@key_path}"
-    end
-  end
-end

data/lib/inspec/resources/ksh.rb

@@ -1,33 +0,0 @@
-require "inspec/utils/command_wrapper"
-require "inspec/resources/command"
-
-module Inspec::Resources
-  class Ksh < Cmd
-    name "ksh"
-    supports platform: "unix"
-    desc "Run a command or script in KornShell."
-    example <<~EXAMPLE
-      describe ksh('ls -al /') do
-        its('stdout') { should match /bin/ }
-        its('stderr') { should eq '' }
-        its('exit_status') { should eq 0 }
-      end
-
-      # Specify the path of the executable:
-      ksh('...', path: '/usr/bin/ksh93')
-
-      # Specify arguments (defaults to -c)
-      ksh('...', args: '-x -c')
-    EXAMPLE
-
-    def initialize(command, options = {})
-      @raw_command = command
-      options[:shell] = "ksh" if options.is_a?(Hash)
-      super(CommandWrapper.wrap(command, options))
-    end
-
-    def to_s
-      "KornShell command #{@raw_command}"
-    end
-  end
-end