inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/launchd_service.rb

@@ -1,2 +0,0 @@
-# This is just here to make the dynamic loader happy.
-require "inspec/resources/service"

data/lib/inspec/resources/limits_conf.rb

@@ -1,45 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-require "inspec/utils/simpleconfig"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class LimitsConf < Inspec.resource(1)
-    name "limits_conf"
-    supports platform: "unix"
-    desc "Use the limits_conf InSpec audit resource to test configuration settings in the /etc/security/limits.conf file. The limits.conf defines limits for processes (by user and/or group names) and helps ensure that the system on which those processes are running remains stable. Each process may be assigned a hard or soft limit."
-    example <<~EXAMPLE
-      describe limits_conf do
-        its('*') { should include ['hard','core','0'] }
-      end
-    EXAMPLE
-
-    include FileReader
-
-    def initialize(path = nil)
-      @conf_path = path || "/etc/security/limits.conf"
-      @content = read_file_content(@conf_path)
-    end
-
-    def method_missing(name)
-      read_params[name.to_s]
-    end
-
-    def read_params
-      return @params if defined?(@params)
-
-      # parse the file
-      conf = SimpleConfig.new(
-        @content,
-        assignment_regex: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
-        key_values: 3,
-        multiple_values: true
-      )
-      @params = conf.params
-    end
-
-    def to_s
-      "limits.conf"
-    end
-  end
-end

data/lib/inspec/resources/linux_kernel_parameter.rb

@@ -1,2 +0,0 @@
-# This is just here to make the dynamic loader happy.
-require "inspec/resources/kernel_parameter"

data/lib/inspec/resources/login_defs.rb

@@ -1,56 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-require "inspec/utils/simpleconfig"
-require "inspec/utils/file_reader"
-
-# Usage:
-#
-# describe login_def do
-#   its('UMASK') {
-#     should eq '077'
-#   }
-#
-#   its('PASS_MAX_DAYS.to_i') {
-#     should be <= 90
-#   }
-# end
-
-module Inspec::Resources
-  class LoginDefs < Inspec.resource(1)
-    name "login_defs"
-    supports platform: "unix"
-    desc "Use the login_defs InSpec audit resource to test configuration settings in the /etc/login.defs file. The logins.defs file defines site-specific configuration for the shadow password suite on Linux and UNIX platforms, such as password expiration ranges, minimum/maximum values for automatic selection of user and group identifiers, or the method with which passwords are encrypted."
-    example <<~EXAMPLE
-      describe login_defs do
-        its('ENCRYPT_METHOD') { should eq 'SHA512' }
-      end
-    EXAMPLE
-
-    include FileReader
-
-    def initialize(path = nil)
-      @conf_path = path || "/etc/login.defs"
-      @content = read_file_content(@conf_path)
-    end
-
-    def method_missing(name)
-      read_params[name.to_s]
-    end
-
-    def read_params
-      return @params if defined?(@params)
-
-      # parse the file
-      conf = SimpleConfig.new(
-        @content,
-        assignment_regex: /^\s*(\S+)\s+(\S*)\s*$/,
-        multiple_values: false
-      )
-      @params = conf.params
-    end
-
-    def to_s
-      "login.defs"
-    end
-  end
-end

data/lib/inspec/resources/mount.rb

@@ -1,88 +0,0 @@
-require "inspec/utils/simpleconfig"
-
-module Inspec::Resources
-  class Mount < Inspec.resource(1)
-    name "mount"
-    supports platform: "unix"
-    desc "Use the mount InSpec audit resource to test if mount points."
-    example <<~EXAMPLE
-      describe mount('/') do
-        it { should be_mounted }
-        its('count') { should eq 1 }
-        its('device') { should eq  '/dev/mapper/VolGroup-lv_root' }
-        its('type') { should eq  'ext4' }
-        its('options') { should eq ['rw', 'mode=620'] }
-        its('options') { should include 'nodev' }
-      end
-    EXAMPLE
-    attr_reader :file
-
-    def initialize(path)
-      @path = path
-      @mount_manager = mount_manager_for_os
-      return skip_resource "The `mount` resource is not supported on your OS yet." if @mount_manager.nil?
-
-      @file = inspec.backend.file(@path)
-    end
-
-    def mounted?
-      file.mounted?
-    end
-
-    def count
-      mounted = file.mounted
-      return nil if mounted.nil? || mounted.stdout.nil?
-
-      mounted.stdout.lines.count
-    end
-
-    def method_missing(name)
-      return nil unless file.mounted?
-
-      mounted = file.mounted
-      return nil if mounted.nil? || mounted.stdout.nil?
-
-      line = mounted.stdout
-      # if we got multiple lines, only use the last entry
-      line = mounted.stdout.lines.to_a.last if mounted.stdout.lines.count > 1
-
-      # parse content if we are on linux
-      @mount_options ||= @mount_manager.parse_mount_options(line)
-      @mount_options[name]
-    end
-
-    def to_s
-      "Mount #{@path}"
-    end
-
-    private
-
-    def mount_manager_for_os
-      os = inspec.os
-      if os.linux?
-        LinuxMounts.new(inspec)
-      elsif ["freebsd"].include?(os[:family])
-        BsdMounts.new(inspec)
-      end
-    end
-  end
-
-  class MountsInfo
-    attr_reader :inspec
-    def initialize(inspec)
-      @inspec = inspec
-    end
-
-    def parse_mount_options(_mount_line, _compatibility = false)
-      raise NotImplementedError
-    end
-  end
-
-  class LinuxMounts < MountsInfo
-    include LinuxMountParser
-  end
-
-  class BsdMounts < MountsInfo
-    include BsdMountParser
-  end
-end

data/lib/inspec/resources/mssql_session.rb

@@ -1,117 +0,0 @@
-require "inspec/resources/command"
-require "hashie/mash"
-require "inspec/utils/database_helpers"
-
-module Inspec::Resources
-  # STABILITY: Experimental
-  # This resource needs further testing and refinement
-  #
-  # This requires the `sqlcmd` tool available on platform
-  # @see https://docs.microsoft.com/en-us/sql/relational-databases/scripting/sqlcmd-use-the-utility
-  # @see https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-connect-and-query-sqlcmd
-  class MssqlSession < Inspec.resource(1)
-    name "mssql_session"
-    supports platform: "windows"
-    desc "Use the mssql_session InSpec audit resource to test SQL commands run against a MS Sql Server database."
-    example <<~EXAMPLE
-      # Using SQL authentication
-      sql = mssql_session(user: 'myuser', pass: 'mypassword')
-      describe sql.query('SELECT * FROM table').row(0).column('columnname') do
-        its('value') { should cmp == 1 }
-      end
-
-      # Passing no credentials to mssql_session forces it to use Windows authentication
-      sql_windows_auth = mssql_session
-      describe sql_windows_auth.query(\"SELECT SERVERPROPERTY('IsIntegratedSecurityOnly') as \\\"login_mode\\\";\").row(0).column('login_mode') do
-        its('value') { should_not be_empty }
-        its('value') { should cmp == 1 }
-      end
-    EXAMPLE
-
-    attr_reader :user, :password, :host, :port, :instance, :local_mode, :db_name
-    def initialize(opts = {})
-      @user = opts[:user]
-      @password = opts[:password] || opts[:pass]
-      if opts[:pass]
-        Inspec.deprecate(:mssql_session_pass_option, "The mssql_session `pass` option is deprecated. Please use `password`.")
-      end
-      @local_mode = opts[:local_mode]
-      unless local_mode?
-        @host = opts[:host] || "localhost"
-        if opts.key?(:port)
-          @port = opts[:port]
-        else
-          @port = "1433"
-        end
-      end
-      @instance = opts[:instance]
-      @db_name = opts[:db_name]
-
-      # check if sqlcmd is available
-      raise Inspec::Exceptions::ResourceSkipped, "sqlcmd is missing" unless inspec.command("sqlcmd").exist?
-      # check that database is reachable
-      raise Inspec::Exceptions::ResourceSkipped, "Can't connect to the MS SQL Server." unless test_connection
-    end
-
-    def query(q) # rubocop:disable Metrics/PerceivedComplexity
-      escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '""').gsub(/\$/, '\\$')
-      # surpress 'x rows affected' in SQLCMD with 'set nocount on;'
-      cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
-      cmd_string += " -U '#{@user}' -P '#{@password}'" unless @user.nil? || @password.nil?
-      cmd_string += " -d '#{@db_name}'" unless @db_name.nil?
-      unless local_mode?
-        if @port.nil?
-          cmd_string += " -S '#{@host}"
-        else
-          cmd_string += " -S '#{@host},#{@port}"
-        end
-        if @instance.nil?
-          cmd_string += "'"
-        else
-          cmd_string += "\\#{@instance}'"
-        end
-      end
-      cmd = inspec.command(cmd_string)
-      out = cmd.stdout + "\n" + cmd.stderr
-      if cmd.exit_status != 0 || out =~ /Sqlcmd: Error/
-        raise Inspec::Exceptions::ResourceFailed, "Could not execute the sql query #{out}"
-      else
-        DatabaseHelper::SQLQueryResult.new(cmd, parse_csv_result(cmd))
-      end
-    end
-
-    def to_s
-      "MSSQL session"
-    end
-
-    private
-
-    def local_mode?
-      !!@local_mode # rubocop:disable Style/DoubleNegation
-    end
-
-    def test_connection
-      !query("select getdate()").empty?
-    end
-
-    def parse_csv_result(cmd)
-      require "csv"
-      table = CSV.parse(cmd.stdout, headers: true)
-
-      # remove first row, since it will be a seperator line
-      table.delete(0)
-
-      # convert to hash
-      headers = table.headers
-
-      results = table.map do |row|
-        res = {}
-        headers.each do |header|
-          res[header.downcase] = row[header] if header
-        end
-        Hashie::Mash.new(res)
-      end
-      results
-    end
-  end
-end

data/lib/inspec/resources/mysql.rb

@@ -1,81 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-module Inspec::Resources
-  class Mysql < Inspec.resource(1)
-    name "mysql"
-    supports platform: "unix"
-    desc "The 'mysql' resource is a helper for the 'mysql_conf' & 'mysql_session' resources.  Please use those instead."
-
-    attr_reader :package, :service, :conf_dir, :conf_path, :data_dir, :log_dir, :log_path, :log_group, :log_dir_group
-    def initialize
-      # set OS-dependent filenames and paths
-      case inspec.os[:family]
-      when "debian"
-        init_ubuntu
-      when "redhat", "fedora"
-        init_redhat
-      when "arch"
-        init_arch
-      else
-        # TODO: could not detect
-        init_default
-      end
-    end
-
-    def init_ubuntu
-      @package = "mysql-server"
-      @service = "mysql"
-      @conf_path = "/etc/mysql/my.cnf"
-      @conf_dir = "/etc/mysql/"
-      @data_dir = "/var/lib/mysql/"
-      @log_dir = "/var/log/"
-      @log_path = "/var/log/mysql.log"
-      @log_group = "adm"
-      case inspec.os[:release]
-      when "14.04"
-        @log_dir_group = "syslog"
-      else
-        @log_dir_group = "root"
-      end
-    end
-
-    def init_redhat
-      @package = "mysql-server"
-      @service = "mysqld"
-      @conf_path = "/etc/my.cnf"
-      @conf_dir = "/etc/"
-      @data_dir = "/var/lib/mysql/"
-      @log_dir = "/var/log/"
-      @log_path = "/var/log/mysqld.log"
-      @log_group = "mysql"
-      @log_dir_group = "root"
-    end
-
-    def init_arch
-      @package = "mariadb"
-      @service = "mysql"
-      @conf_path = "/etc/mysql/my.cnf"
-      @conf_dir = "/etc/mysql/"
-      @data_dir = "/var/lib/mysql/"
-      @log_dir = "/var/log/"
-      @log_path = "/var/log/mysql.log"
-      @log_group = "mysql"
-      @log_dir_group = "root"
-    end
-
-    def init_default
-      @service = "mysqld"
-      @conf_path = "/etc/my.cnf"
-      @conf_dir = "/etc/"
-      @data_dir = "/var/lib/mysql/"
-      @log_dir = "/var/log/"
-      @log_path = "/var/log/mysqld.log"
-      @log_group = "mysql"
-      @log_dir_group = "root"
-    end
-
-    def to_s
-      "MySQL"
-    end
-  end
-end

data/lib/inspec/resources/mysql_conf.rb

@@ -1,128 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-require "inspec/utils/simpleconfig"
-require "inspec/utils/find_files"
-require "inspec/utils/file_reader"
-require "inspec/utils/hash"
-require "inspec/resources/mysql"
-
-module Inspec::Resources
-  class MysqlConfEntry
-    def initialize(path, params)
-      @params = params
-      @path = path
-    end
-
-    def method_missing(name, *_)
-      k = name.to_s
-      res = @params[k]
-      return true if res.nil? && @params.key?(k)
-
-      @params[k]
-    end
-
-    def to_s
-      "MySQL Config entry [#{@path.join(" ")}]"
-    end
-  end
-
-  class MysqlConf < Inspec.resource(1)
-    name "mysql_conf"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the mysql_conf InSpec audit resource to test the contents of the configuration file for MySQL, typically located at /etc/mysql/my.cnf or /etc/my.cnf."
-    example <<~EXAMPLE
-      describe mysql_conf('path') do
-        its('setting') { should eq 'value' }
-      end
-
-      # Test a parameter set within the [mysqld] section
-      describe mysql_conf do
-        its('mysqld.port') { should cmp 3306 }
-      end
-
-      # Test a parameter set within the [mariadb] section using array notation
-      describe mysql_conf do
-        its(['mariadb', 'max-connections']) { should_not be_nil }
-      end
-    EXAMPLE
-
-    include FindFiles
-    include FileReader
-
-    def initialize(conf_path = nil)
-      @conf_path = conf_path || inspec.mysql.conf_path
-      @files_contents = {}
-      @content = nil
-      @params = nil
-      read_content
-    end
-
-    def content
-      @content ||= read_content
-    end
-
-    def params(*opts)
-      @params || read_content
-      res = @params
-      opts.each do |opt|
-        res = res[opt] unless res.nil?
-      end
-      MysqlConfEntry.new(opts, res)
-    end
-
-    def method_missing(name)
-      @params || read_content
-      @params[name.to_s]
-    end
-
-    def read_content
-      @content = ""
-      @params = {}
-
-      to_read = [@conf_path]
-      until to_read.empty?
-        cur_file = to_read[0]
-        raw_conf = read_file(cur_file)
-        @content += raw_conf
-
-        params = SimpleConfig.new(raw_conf).params
-        @params = @params.deep_merge(params)
-
-        to_read = to_read.drop(1)
-        # see if there is more stuff to include
-
-        dir = File.dirname(cur_file)
-        to_read += include_files(dir, raw_conf).find_all do |fp|
-          not @files_contents.key? fp
-        end
-      end
-      #
-      @content
-    end
-
-    def include_files(reldir, conf)
-      files = conf.scan(/^!include\s+(.*)\s*/).flatten.compact.map { |x| abs_path(reldir, x) }
-      dirs = conf.scan(/^!includedir\s+(.*)\s*/).flatten.compact.map { |x| abs_path(reldir, x) }
-      dirs.map do |dir|
-        # @TODO: non local glob
-        files += find_files(dir, depth: 1, type: "file")
-      end
-      files
-    end
-
-    def abs_path(dir, f)
-      return f if f.start_with? "/"
-
-      File.join(dir, f)
-    end
-
-    def read_file(path)
-      @files_contents[path] ||= read_file_content(path)
-    end
-
-    def to_s
-      "MySQL Configuration"
-    end
-  end
-end