Merge pull request #6130 from inspec/cw/backport-6100

Backport fix for processes resource on windows when path is empty

lib/inspec/resources/processes.rb

@@ -43,7 +43,7 @@ module Inspec::Resources
 
       all_cmds = ps_axo
       @list = all_cmds.find_all do |hm|
-        hm[:command] =~ grep
+        hm[:command] =~ grep || hm[:process_name] =~ grep
       end
     end
 
@@ -73,6 +73,7 @@ module Inspec::Resources
       .register_column(:time,     field: "time")
       .register_column(:users,    field: "user")
       .register_column(:commands, field: "command")
+      .register_column(:process_name, field: "process_name")
       .install_filter_methods_on_resource(self, :filtered_processes)
 
     private
@@ -87,9 +88,9 @@ module Inspec::Resources
       if os.linux?
         command, regex, field_map = ps_configuration_for_linux
       elsif os.windows?
-        command = '$Proc = Get-Process -IncludeUserName | Where-Object {$_.Path -ne $null } | Select-Object PriorityClass,Id,CPU,PM,VirtualMemorySize,NPM,SessionId,Responding,StartTime,TotalProcessorTime,UserName,Path | ConvertTo-Csv -NoTypeInformation;$Proc.Replace("""","").Replace("`r`n","`n")'
+        command = '$Proc = Get-Process -IncludeUserName | Select-Object PriorityClass,Id,CPU,PM,VirtualMemorySize,NPM,SessionId,Responding,StartTime,TotalProcessorTime,UserName,Path,ProcessName | ConvertTo-Csv -NoTypeInformation;$Proc.Replace("""","").Replace("`r`n","`n")'
         # Wanted to use /(?:^|,)([^,]*)/; works on rubular.com not sure why here?
-        regex = /^(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+),(.+)$/
+        regex = /^(.*),(.*),(.*),(.*),(.*),(.*),(.*),(.*),(.*),(.*),(.*),(.*),(.*)$/
         field_map = {
           pid: 2,
           cpu: 3,
@@ -102,6 +103,7 @@ module Inspec::Resources
           time: 10,
           user: 11,
           command: 12,
+          process_name: 13,
         }
       else
         command = "ps axo pid,pcpu,pmem,vsz,rss,tty,stat,start,time,user,command"
@@ -193,7 +195,7 @@ module Inspec::Resources
 
         # build a hash of process data that we'll turn into a struct for FilterTable
         process_data = {}
-        %i{label pid cpu mem vsz rss tty stat start time user command}.each do |param|
+        %i{label pid cpu mem vsz rss tty stat start time user command process_name}.each do |param|
           # not all operating systems support all fields, so skip the field if we don't have it
           process_data[param] = line[field_map[param]] if field_map.key?(param)
         end

test/fixtures/cmd/get-process_processes

@@ -1,3 +1,4 @@
-PriorityClass,Id,CPU,PM,VirtualMemorySize,NPM,SessionId,Responding,StartTime,TotalProcessorTime,UserName,Path
-Normal,2456,0.296875,4808704,118202368,14576,1,True,5/31/2017 9:13:17 AM,00:00:00.2968750,WINVAGR-QQQNHPN\Administrator,C:\Windows\system32\mmc.exe
-High,396,0.15625,1323008,53710848,7776,1,True,5/31/2017 9:12:56 AM,00:00:00.1562500,NT AUTHORITY\SYSTEM,C:\Windows\system32\winlogon.exe
+PriorityClass,Id,CPU,PM,VirtualMemorySize,NPM,SessionId,Responding,StartTime,TotalProcessorTime,UserName,Path,ProcessName
+Normal,2456,0.296875,4808704,118202368,14576,1,True,5/31/2017 9:13:17 AM,00:00:00.2968750,WINVAGR-QQQNHPN\Administrator,C:\Windows\system32\mmc.exe,,
+High,396,0.15625,1323008,53710848,7776,1,True,5/31/2017 9:12:56 AM,00:00:00.1562500,NT AUTHORITY\SYSTEM,C:\Windows\system32\winlogon.exe,winlogon
+,1360,3505.90625,270106624,644595712,88624,0,True,5/11/2022 5:17:04 PM,00:58:25.9062500,,,MsMpEng

test/helpers/mock_loader.rb

@@ -464,7 +464,7 @@ class MockLoader
       # modprobe for kernel_module
       "modprobe --showconfig" => cmd.call("modprobe-config"),
       # get-process cmdlet for processes resource
-      '$Proc = Get-Process -IncludeUserName | Where-Object {$_.Path -ne $null } | Select-Object PriorityClass,Id,CPU,PM,VirtualMemorySize,NPM,SessionId,Responding,StartTime,TotalProcessorTime,UserName,Path | ConvertTo-Csv -NoTypeInformation;$Proc.Replace("""","").Replace("`r`n","`n")' => cmd.call("get-process_processes"),
+      '$Proc = Get-Process -IncludeUserName | Select-Object PriorityClass,Id,CPU,PM,VirtualMemorySize,NPM,SessionId,Responding,StartTime,TotalProcessorTime,UserName,Path,ProcessName | ConvertTo-Csv -NoTypeInformation;$Proc.Replace("""","").Replace("`r`n","`n")' => cmd.call("get-process_processes"),
       # host resource: TCP/UDP reachability check on linux
       %{sh -c 'type "nc"'} => empty.call,
       %{sh -c 'type "ncat"'} => empty.call,

test/unit/resources/processes_test.rb

@@ -29,6 +29,7 @@ describe "Inspec::Resources::Processes" do
       time: "0:00.05",
       user: "root",
       command: "login -fp apop",
+      process_name: nil,
     })
   end
 
@@ -48,6 +49,7 @@ describe "Inspec::Resources::Processes" do
       time: "00:00:00",
       user: "opscode-pgsql",
       command: "postgres: bifrost bifrost 127.0.0.1(43699) idle",
+      process_name: nil,
     })
   end
 
@@ -68,6 +70,7 @@ describe "Inspec::Resources::Processes" do
       time: "00:00:00",
       user: "opscode-pgsql",
       command: "postgres: bifrost bifrost 127.0.0.1(43699) idle",
+      process_name: nil,
     })
   end
 
@@ -87,6 +90,7 @@ describe "Inspec::Resources::Processes" do
       time: "00:01:01",
       user: "root",
       command: "/usr/local/apache2/bin/httpd -k start",
+      process_name: nil,
     })
   end
 
@@ -96,7 +100,7 @@ describe "Inspec::Resources::Processes" do
     _(process.user).must_equal "opscode-pgsql"
     _(process[:user]).must_equal "opscode-pgsql"
     _(process["user"]).must_equal "opscode-pgsql"
-    _(process[-1]).must_equal "postgres: bifrost bifrost 127.0.0.1(43699) idle"
+    _(process[-2]).must_equal "postgres: bifrost bifrost 127.0.0.1(43699) idle"
     _(process[1]).must_equal 5127
   end
 
@@ -139,6 +143,7 @@ describe "Inspec::Resources::Processes" do
       time: "00:00:00",
       user: "ntp",
       command: "/usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 112:117",
+      process_name: nil,
     })
   end
 
@@ -158,6 +163,7 @@ describe "Inspec::Resources::Processes" do
       time: "0:00",
       user: "joe",
       command: "/some/other/coolprogram",
+      process_name: nil,
     })
   end
 
@@ -177,6 +183,7 @@ describe "Inspec::Resources::Processes" do
       time: "3:50",
       user: "frank",
       command: "/a/bigger/program",
+      process_name: nil,
     })
   end
 
@@ -196,6 +203,7 @@ describe "Inspec::Resources::Processes" do
       time: "39:00",
       user: "tim",
       command: "/the/biggest/program",
+      process_name: nil,
     })
   end
 
@@ -214,6 +222,11 @@ describe "Inspec::Resources::Processes" do
     _(resource.exists?).must_equal true
   end
 
+  it "process without path should exist" do
+    resource = MockLoader.new(:windows).load_resource("processes", "MsMpEng")
+    _(resource.exists?).must_equal true
+  end
+
   it "process should_not exist" do
     resource = MockLoader.new(:windows).load_resource("processes", "unicorn.exe")
     _(resource.exists?).must_equal false