inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/packages.rb

@@ -1,111 +0,0 @@
-# copyright: 2017, Chef Software, Inc. <legal@chef.io>
-
-require "inspec/utils/filter"
-require "inspec/resources/command"
-
-module Inspec::Resources
-  class Packages < Inspec.resource(1)
-    name "packages"
-    supports platform: "unix"
-    desc "Use the packages InSpec audit resource to test properties for multiple packages installed on the system"
-    example <<~EXAMPLE
-      describe packages(/xserver-xorg.*/) do
-        its('entries') { should be_empty }
-      end
-      describe packages('vim').entries.length do
-        it { should be > 1 }
-      end
-      describe packages(/vi.+/).where { status != 'installed' } do
-        its('statuses') { should be_empty }
-      end
-    EXAMPLE
-
-    def initialize(pattern)
-      os = inspec.os
-      if os.debian?
-        @pkgs = Debs.new(inspec)
-      elsif os.redhat? || %w{suse amazon fedora}.include?(os[:family])
-        @pkgs = Rpms.new(inspec)
-      else
-        return skip_resource "The packages resource is not yet supported on OS #{inspec.os.name}"
-      end
-
-      @pattern = pattern_regexp(pattern)
-      all_pkgs = @pkgs.build_package_list
-      @list = all_pkgs.find_all do |hm|
-        hm[:name] =~ @pattern
-      end
-    end
-
-    def to_s
-      "Packages #{@pattern.class == String ? @pattern : @pattern.inspect}"
-    end
-
-    filter = FilterTable.create
-    filter.register_column(:statuses, field: "status", style: :simple)
-      .register_column(:names,     field: "name")
-      .register_column(:versions,  field: "version")
-      .register_column(:architectures, field: "architecture")
-      .install_filter_methods_on_resource(self, :filtered_packages)
-
-    private
-
-    def pattern_regexp(p)
-      if p.class == String
-        Regexp.new(Regexp.escape(p))
-      elsif p.class == Regexp
-        p
-      else
-        raise 'Invalid name argument to packages resource, please use a "string" or /regexp/'
-      end
-    end
-
-    def filtered_packages
-      warn "The packages resource is not yet supported on OS #{inspec.os.name}" if resource_skipped?
-      @list
-    end
-  end
-
-  class PkgsManagement
-    PackageStruct = Struct.new(:status, :name, :version, :architecture)
-    attr_reader :inspec
-    def initialize(inspec)
-      @inspec = inspec
-    end
-  end
-
-  # Debian / Ubuntu
-  class Debs < PkgsManagement
-    def build_package_list
-      # use two spaces as delimiter in case any of the fields has a space in it
-      command = "dpkg-query -W -f='${db:Status-Abbrev}  ${Package}  ${Version}  ${Architecture}\\n'"
-      cmd = inspec.command(command)
-      all = cmd.stdout.split("\n")
-      return [] if all.nil?
-
-      all.map do |m|
-        a = m.split(/ {2,}/)
-        a[0] = "installed" if a[0] =~ /^.i/
-        a[2] = a[2].split(":").last
-        PackageStruct.new(*a)
-      end
-    end
-  end
-
-  # RedHat family
-  class Rpms < PkgsManagement
-    def build_package_list
-      # use two spaces as delimiter in case any of the fields has a space in it
-      command = "rpm -qa --queryformat '%{NAME}  %{VERSION}-%{RELEASE}  %{ARCH}\\n'" # rubocop:disable Style/FormatStringToken
-      cmd = inspec.command(command)
-      all = cmd.stdout.split("\n")
-      return [] if all.nil?
-
-      all.map do |m|
-        a = m.split("  ")
-        a.unshift("installed")
-        PackageStruct.new(*a)
-      end
-    end
-  end
-end

data/lib/inspec/resources/parse_config.rb

@@ -1,112 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-# Usage example:
-#
-#  audit = command('/sbin/auditctl -l').stdout
-#  options = {
-#    assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
-#    multiple_values: true
-#  }
-#  describe parse_config(audit, options ) do
-
-require "inspec/utils/file_reader"
-require "inspec/utils/simpleconfig"
-
-module Inspec::Resources
-  class PConfig < Inspec.resource(1)
-    name "parse_config"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the parse_config InSpec audit resource to test arbitrary configuration files."
-    example <<~EXAMPLE
-      output = command('some-command').stdout
-      describe parse_config(output, { data_config_option: value } ) do
-        its('setting') { should eq 1 }
-      end
-
-      output2 = command('curl http://127.0.0.1/php_status').stdout
-      # php status is in format 'key : value', and we do not allow for multiple values
-      options2 = {
-        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
-        multiple_values: false
-      }
-
-      describe parse_config(output2, options2) do
-        its('pool') { should eq 'www'}
-        its('process manager') { should eq process_manager }
-      end
-
-      # getting specific key from the output above, convert it to integer and then compare
-      # make sure 'listen queue' is below 100
-      describe parse_config(output2, options2 ).params['listen queue'].to_i do
-        it { should be < 100 }
-      end
-    EXAMPLE
-
-    include FileReader
-
-    attr_reader :content
-    def initialize(content = nil, useropts = nil)
-      @opts = {}
-      @opts = useropts.dup unless useropts.nil?
-      @files_contents = {}
-
-      @content = content
-      read_params unless @content.nil?
-    end
-
-    def method_missing(name)
-      read_params[name.to_s]
-    end
-
-    def params(*opts)
-      opts.inject(read_params) do |res, nxt|
-        res.respond_to?(:key) ? res[nxt] : nil
-      end
-    end
-
-    def to_s
-      "Parse Config #{@conf_path}"
-    end
-
-    private
-
-    def parse_file(conf_path)
-      @conf_path = conf_path
-      @content = read_file(conf_path).to_s
-
-      read_params
-    end
-
-    def read_file(path)
-      @files_contents[path] ||= read_file_content(path)
-    end
-
-    def read_params
-      @params ||= if content.nil?
-                    {}
-                  else
-                    SimpleConfig.new(content, @opts).params
-                  end
-    end
-  end
-
-  class PConfigFile < PConfig
-    name "parse_config_file"
-    desc "Use the parse_config_file InSpec resource to test arbitrary configuration files. It works identically to parse_config. Instead of using a command output, this resource works with files."
-    example <<~EXAMPLE
-      describe parse_config_file('/path/to/file') do
-        its('setting') { should eq 1 }
-      end
-    EXAMPLE
-
-    def initialize(path, opts = nil)
-      super(nil, opts)
-      parse_file(path)
-    end
-
-    def to_s
-      "Parse Config File #{@conf_path}"
-    end
-  end
-end

data/lib/inspec/resources/parse_config_file.rb

@@ -1,2 +0,0 @@
-# This is just here to make the dynamic loader happy.
-require "inspec/resources/parse_config"

data/lib/inspec/resources/passwd.rb

@@ -1,73 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-# The file format consists of
-# - username
-# - password
-# - userid
-# - groupid
-# - user id info
-# - home directory
-# - command
-
-require "inspec/utils/parser"
-require "inspec/utils/filter"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class Passwd < Inspec.resource(1)
-    name "passwd"
-    supports platform: "unix"
-    desc "Use the passwd InSpec audit resource to test the contents of /etc/passwd, which contains the following information for users that may log into the system and/or as users that own running processes."
-    example <<~EXAMPLE
-      describe passwd do
-        its('users') { should_not include 'forbidden_user' }
-      end
-
-      describe passwd.uids(0) do
-        its('users') { should cmp 'root' }
-      end
-
-      describe passwd.shells(/nologin/) do
-        # find all users with a nologin shell
-        its('users') { should_not include 'my_login_user' }
-      end
-    EXAMPLE
-
-    include PasswdParser
-    include FileReader
-
-    attr_reader :params
-    attr_reader :content
-    attr_reader :lines
-
-    def initialize(path = nil, opts = nil)
-      opts ||= {}
-      @path = path || "/etc/passwd"
-      @content = opts[:content] || read_file_content(@path, allow_empty: true)
-      @lines = @content.to_s.split("\n")
-      @params = parse_passwd(@content)
-    end
-
-    filter = FilterTable.create
-    filter.register_column(:users, field: "user")
-      .register_column(:passwords, field: "password")
-      .register_column(:uids,      field: "uid")
-      .register_column(:gids,      field: "gid")
-      .register_column(:descs,     field: "desc")
-      .register_column(:homes,     field: "home")
-      .register_column(:shells,    field: "shell")
-
-    # rebuild the passwd line from raw content
-    filter.register_custom_property(:content) do |t, _|
-      t.entries.map do |e|
-        [e.user, e.password, e.uid, e.gid, e.desc, e.home, e.shell].join(":")
-      end.join("\n")
-    end
-
-    filter.install_filter_methods_on_resource(self, :params)
-
-    def to_s
-      "/etc/passwd"
-    end
-  end
-end

data/lib/inspec/resources/pip.rb

@@ -1,132 +0,0 @@
-require "inspec/resources/command"
-require "inspec/utils/simpleconfig"
-
-# Usage:
-# describe pip('Jinja2') do
-#   it { should be_installed }
-# end
-
-module Inspec::Resources
-  class PipPackage < Inspec.resource(1)
-    name "pip"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the pip InSpec audit resource to test packages that are installed using the pip installer."
-    example <<~EXAMPLE
-      describe pip('Jinja2') do
-        it { should be_installed }
-      end
-
-      describe pip('django', '/path/to/virtualenv/bin/pip') do
-        it { should be_installed }
-        its('version') { should eq('1.11.4')}
-      end
-    EXAMPLE
-
-    def initialize(package_name, pip_path = nil)
-      @package_name = package_name
-      @pip_cmd = pip_path || default_pip_path
-
-      return skip_resource "pip not found" if @pip_cmd.nil?
-    end
-
-    def info
-      return @info if defined?(@info)
-
-      @info = {}
-      @info[:type] = "pip"
-      return @info unless cmd_successful?
-
-      params = SimpleConfig.new(
-        cmd.stdout,
-        assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
-        multiple_values: false
-      ).params
-      @info[:name] = params["Name"]
-      @info[:version] = params["Version"]
-      @info[:installed] = true
-      @info
-    end
-
-    def installed?
-      info[:installed] == true
-    end
-
-    def version
-      info[:version]
-    end
-
-    def to_s
-      "Pip Package #{@package_name}"
-    end
-
-    private
-
-    def cmd
-      @__cmd ||= inspec.command("#{@pip_cmd} show #{@package_name}")
-    end
-
-    def cmd_successful?
-      return true if cmd.exit_status == 0
-
-      if cmd.exit_status != 0
-        # If pip on windows is not the latest, it will create a stderr value along with stdout
-        # Example:
-        #   stdout: "Name: Jinja2\r\nVersion: 2.10..."
-        #   stderr: "You are using pip version 9.0.1, however version 9.0.3 is available..."
-        if inspec.os.windows? && !cmd.stdout.empty?
-          return true
-        end
-      end
-
-      false
-    end
-
-    # Paths of Python and Pip on windows
-    # {"Pip" => nil, "Python" => "/path/to/python"}
-    #
-    # @return [Hash] of windows_paths
-    def windows_paths
-      return @__windows_paths if @__windows_paths
-
-      cmd = inspec.command(
-        'New-Object -Type PSObject |
-         Add-Member -MemberType NoteProperty -Name Pip -Value (Invoke-Command -ScriptBlock {where.exe pip}) -PassThru |
-         Add-Member -MemberType NoteProperty -Name Python -Value (Invoke-Command -ScriptBlock {where.exe python}) -PassThru |
-         ConvertTo-Json'
-      )
-
-      @__windows_paths = JSON.parse(cmd.stdout)
-    end
-
-    # Default path of python pip installation
-    #
-    # @return [String] of python pip path
-    def default_pip_path
-      return "pip" unless inspec.os.windows?
-
-      # If python is not found, return with skip_resource
-      return skip_resource "python not found" if windows_paths["Python"].nil?
-
-      # Pip is not on the default path for Windows, therefore we do some logic
-      # to find the binary on Windows
-      begin
-        # use pip if it on system path
-        pipcmd = windows_paths["Pip"]
-        # calculate path on windows
-        if defined?(windows_paths["Python"]) && pipcmd.nil?
-          return nil if windows_paths["Pip"].nil?
-
-          pipdir = windows_paths["Python"].split('\\')
-          # remove python.exe
-          pipdir.pop
-          pipcmd = pipdir.push("Scripts").push("pip.exe").join("/")
-        end
-      rescue JSON::ParserError => _e
-        return nil
-      end
-
-      pipcmd
-    end
-  end
-end

data/lib/inspec/resources/platform.rb

@@ -1,112 +0,0 @@
-require "inspec/resource"
-
-module Inspec::Resources
-  class PlatformResource < Inspec.resource(1)
-    name "platform"
-    desc "Use the platform InSpec resource to test the platform on which the system is running."
-    example <<~EXAMPLE
-      describe platform do
-        its('name') { should eq 'redhat' }
-      end
-
-      describe platform do
-        it { should be_in_family('unix') }
-      end
-    EXAMPLE
-
-    def initialize
-      @platform = inspec.backend.platform
-    end
-
-    # add helper methods for easy access of properties
-    %w{family release arch}.each do |property|
-      define_method(property.to_sym) do
-        @platform[property]
-      end
-    end
-
-    def families
-      @platform.family_hierarchy
-    end
-
-    def name
-      @platform.name
-    end
-
-    def [](key)
-      # convert string to symbol
-      key = key.to_sym if key.is_a? String
-      return name if key == :name
-
-      @platform[key]
-    end
-
-    def platform?(name)
-      @platform.name == name ||
-        @platform.family_hierarchy.include?(name)
-    end
-
-    def in_family?(family)
-      @platform.family_hierarchy.include?(family)
-    end
-
-    def params
-      h = {
-        name: name,
-        families: families,
-        release: release,
-      }
-
-      # Avoid adding Arch for APIs (not applicable)
-      unless in_family?("api")
-        h[:arch] = arch
-      end
-
-      h
-    end
-
-    def supported?(supports)
-      return true if supports.nil? || supports.empty?
-
-      status = true
-      supports.each do |support|
-        support.each do |k, v|
-          status =
-            case k
-            when :os_family, :"os-family", :platform_family, :"platform-family" then
-              in_family?(v)
-            when :os, :platform then
-              platform?(v)
-            when :os_name, :"os-name", :platform_name, :"platform-name" then
-              name == v
-            when :release then
-              check_release(v)
-            else
-              false
-            end
-
-          break if status == false
-        end
-        return true if status == true
-      end
-
-      status
-    end
-
-    def to_s
-      "Platform Detection"
-    end
-
-    private
-
-    def check_release(value)
-      # allow wild card matching
-      if value.include?("*")
-        cleaned = Regexp.escape(value).gsub('\*', ".*?")
-        !(release =~ /#{cleaned}/).nil?
-      else
-        release == value
-      end
-    end
-  end
-end