mirror of
https://github.com/inspec/inspec
synced 2024-12-02 17:40:00 +00:00
Merge pull request #380 from chef/sr/service-override
add service overrides for picking specific service managers, add runit_service
This commit is contained in:
commit
b30720f926
9 changed files with 368 additions and 66 deletions
|
@ -1,6 +1,7 @@
|
||||||
# encoding: utf-8
|
# encoding: utf-8
|
||||||
# author: Christoph Hartmann
|
# author: Christoph Hartmann
|
||||||
# author: Dominik Richter
|
# author: Dominik Richter
|
||||||
|
# author: Stephan Renatus
|
||||||
# license: All rights reserved
|
# license: All rights reserved
|
||||||
|
|
||||||
# Usage:
|
# Usage:
|
||||||
|
@ -30,14 +31,19 @@ class Service < Inspec.resource(1)
|
||||||
end
|
end
|
||||||
"
|
"
|
||||||
|
|
||||||
def initialize(service_name)
|
attr_reader :service_ctl
|
||||||
|
|
||||||
|
def initialize(service_name, service_ctl = nil)
|
||||||
@service_name = service_name
|
@service_name = service_name
|
||||||
@service_mgmt = nil
|
@service_mgmt = nil
|
||||||
|
@service_ctl ||= service_ctl
|
||||||
@cache = nil
|
@cache = nil
|
||||||
select_package_manager
|
@service_mgmt = select_service_mgmt
|
||||||
|
|
||||||
|
return skip_resource 'The `service` resource is not supported on your OS yet.' if @service_mgmt.nil?
|
||||||
end
|
end
|
||||||
|
|
||||||
def select_package_manager # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
|
def select_service_mgmt # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
|
||||||
family = inspec.os[:family]
|
family = inspec.os[:family]
|
||||||
|
|
||||||
case family
|
case family
|
||||||
|
@ -52,45 +58,42 @@ class Service < Inspec.resource(1)
|
||||||
when 'ubuntu'
|
when 'ubuntu'
|
||||||
version = inspec.os[:release].to_f
|
version = inspec.os[:release].to_f
|
||||||
if version < 15.04
|
if version < 15.04
|
||||||
@service_mgmt = Upstart.new(inspec)
|
Upstart.new(inspec, service_ctl)
|
||||||
else
|
else
|
||||||
@service_mgmt = Systemd.new(inspec)
|
Systemd.new(inspec, service_ctl)
|
||||||
end
|
end
|
||||||
when 'debian'
|
when 'debian'
|
||||||
version = inspec.os[:release].to_i
|
version = inspec.os[:release].to_i
|
||||||
if version > 7
|
if version > 7
|
||||||
@service_mgmt = Systemd.new(inspec)
|
Systemd.new(inspec, service_ctl)
|
||||||
else
|
else
|
||||||
@service_mgmt = SysV.new(inspec)
|
SysV.new(inspec, service_ctl || '/usr/sbin/service')
|
||||||
end
|
end
|
||||||
when 'redhat', 'fedora', 'centos'
|
when 'redhat', 'fedora', 'centos'
|
||||||
version = inspec.os[:release].to_i
|
version = inspec.os[:release].to_i
|
||||||
if (%w{ redhat centos }.include?(family) && version >= 7) || (family == 'fedora' && version >= 15)
|
if (%w{ redhat centos }.include?(family) && version >= 7) || (family == 'fedora' && version >= 15)
|
||||||
@service_mgmt = Systemd.new(inspec)
|
Systemd.new(inspec, service_ctl)
|
||||||
else
|
else
|
||||||
@service_mgmt = SysV.new(inspec)
|
SysV.new(inspec, service_ctl || '/sbin/service')
|
||||||
end
|
end
|
||||||
when 'wrlinux'
|
when 'wrlinux'
|
||||||
@service_mgmt = SysV.new(inspec)
|
SysV.new(inspec, service_ctl)
|
||||||
when 'darwin'
|
when 'darwin'
|
||||||
@service_mgmt = LaunchCtl.new(inspec)
|
LaunchCtl.new(inspec, service_ctl)
|
||||||
when 'windows'
|
when 'windows'
|
||||||
@service_mgmt = WindowsSrv.new(inspec)
|
WindowsSrv.new(inspec)
|
||||||
when 'freebsd'
|
when 'freebsd'
|
||||||
@service_mgmt = BSDInit.new(inspec)
|
BSDInit.new(inspec, service_ctl)
|
||||||
when 'arch', 'opensuse'
|
when 'arch', 'opensuse'
|
||||||
@service_mgmt = Systemd.new(inspec)
|
Systemd.new(inspec, service_ctl)
|
||||||
when 'aix'
|
when 'aix'
|
||||||
@service_mgmt = SrcMstr.new(inspec)
|
SrcMstr.new(inspec)
|
||||||
end
|
end
|
||||||
|
|
||||||
return skip_resource 'The `service` resource is not supported on your OS yet.' if @service_mgmt.nil?
|
|
||||||
end
|
end
|
||||||
|
|
||||||
def info
|
def info
|
||||||
return @cache if !@cache.nil?
|
|
||||||
return nil if @service_mgmt.nil?
|
return nil if @service_mgmt.nil?
|
||||||
@cache = @service_mgmt.info(@service_name)
|
@cache ||= @service_mgmt.info(@service_name)
|
||||||
end
|
end
|
||||||
|
|
||||||
# verifies the service is enabled
|
# verifies the service is enabled
|
||||||
|
@ -117,17 +120,23 @@ class Service < Inspec.resource(1)
|
||||||
end
|
end
|
||||||
|
|
||||||
class ServiceManager
|
class ServiceManager
|
||||||
attr_reader :inspec
|
attr_reader :inspec, :service_ctl
|
||||||
def initialize(inspec)
|
def initialize(inspec, service_ctl = nil)
|
||||||
@inspec = inspec
|
@inspec = inspec
|
||||||
|
@service_ctl ||= service_ctl
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
# @see: http://www.freedesktop.org/software/systemd/man/systemctl.html
|
# @see: http://www.freedesktop.org/software/systemd/man/systemctl.html
|
||||||
# @see: http://www.freedesktop.org/software/systemd/man/systemd-system.conf.html
|
# @see: http://www.freedesktop.org/software/systemd/man/systemd-system.conf.html
|
||||||
class Systemd < ServiceManager
|
class Systemd < ServiceManager
|
||||||
|
def initialize(inspec, service_ctl = nil)
|
||||||
|
@service_ctl ||= 'systemctl'
|
||||||
|
super
|
||||||
|
end
|
||||||
|
|
||||||
def info(service_name)
|
def info(service_name)
|
||||||
cmd = inspec.command("systemctl show --all #{service_name}")
|
cmd = inspec.command("#{service_ctl} show --all #{service_name}")
|
||||||
return nil if cmd.exit_status.to_i != 0
|
return nil if cmd.exit_status.to_i != 0
|
||||||
|
|
||||||
# parse data
|
# parse data
|
||||||
|
@ -138,13 +147,13 @@ class Systemd < ServiceManager
|
||||||
).params
|
).params
|
||||||
|
|
||||||
# LoadState values eg. loaded, not-found
|
# LoadState values eg. loaded, not-found
|
||||||
params['LoadState'] == 'loaded' ? (installed = true) : (installed = false)
|
installed = params['LoadState'] == 'loaded'
|
||||||
# test via 'systemctl is-active service'
|
# test via 'systemctl is-active service'
|
||||||
# SubState values running
|
# SubState values running
|
||||||
params['SubState'] == 'running' ? (running = true) : (running = false)
|
running = params['SubState'] == 'running'
|
||||||
# test via systemctl --quiet is-enabled
|
# test via systemctl --quiet is-enabled
|
||||||
# ActiveState values eg.g inactive, active
|
# ActiveState values eg.g inactive, active
|
||||||
params['UnitFileState'] == 'enabled' ? (enabled = true) : (enabled = false)
|
enabled = params['UnitFileState'] == 'enabled'
|
||||||
|
|
||||||
{
|
{
|
||||||
name: params['Id'],
|
name: params['Id'],
|
||||||
|
@ -190,25 +199,26 @@ class SrcMstr < ServiceManager
|
||||||
|
|
||||||
# #rubocop:disable Style/TrailingComma
|
# #rubocop:disable Style/TrailingComma
|
||||||
def enabled_rc_tcpip?
|
def enabled_rc_tcpip?
|
||||||
if inspec.command(
|
inspec.command(
|
||||||
"grep -v ^# /etc/rc.tcpip | grep 'start ' | grep -Eq '(/{0,1}| )#{@name} '",
|
"grep -v ^# /etc/rc.tcpip | grep 'start ' | grep -Eq '(/{0,1}| )#{name} '",
|
||||||
).exit_status == 0
|
).exit_status == 0
|
||||||
true
|
|
||||||
else
|
|
||||||
false
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
|
|
||||||
def enabled_inittab?
|
def enabled_inittab?
|
||||||
inspec.command("lsitab #{@name}").exit_status.to_i == 0 ? true : false
|
inspec.command("lsitab #{name}").exit_status == 0
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
# @see: http://upstart.ubuntu.com
|
# @see: http://upstart.ubuntu.com
|
||||||
class Upstart < ServiceManager
|
class Upstart < ServiceManager
|
||||||
|
def initialize(service_name, service_ctl = nil)
|
||||||
|
@service_ctl ||= 'initctl'
|
||||||
|
super
|
||||||
|
end
|
||||||
|
|
||||||
def info(service_name)
|
def info(service_name)
|
||||||
# get the status of upstart service
|
# get the status of upstart service
|
||||||
status = inspec.command("initctl status #{service_name}")
|
status = inspec.command("#{service_ctl} status #{service_name}")
|
||||||
|
|
||||||
# fallback for systemv services, those are not handled via `initctl`
|
# fallback for systemv services, those are not handled via `initctl`
|
||||||
return SysV.new(inspec).info(service_name) if status.exit_status.to_i != 0
|
return SysV.new(inspec).info(service_name) if status.exit_status.to_i != 0
|
||||||
|
@ -235,7 +245,7 @@ class Upstart < ServiceManager
|
||||||
# $ initctl show-config $job | grep -q "^ start on" && echo enabled || echo disabled
|
# $ initctl show-config $job | grep -q "^ start on" && echo enabled || echo disabled
|
||||||
# Ubuntu 10.04 show-config is not supported
|
# Ubuntu 10.04 show-config is not supported
|
||||||
# @see http://manpages.ubuntu.com/manpages/maverick/man8/initctl.8.html
|
# @see http://manpages.ubuntu.com/manpages/maverick/man8/initctl.8.html
|
||||||
config = inspec.command("initctl show-config #{service_name}")
|
config = inspec.command("#{service_ctl} show-config #{service_name}")
|
||||||
enabled = !config.stdout[/^\s*start on/].nil?
|
enabled = !config.stdout[/^\s*start on/].nil?
|
||||||
|
|
||||||
# implement fallback for Ubuntu 10.04
|
# implement fallback for Ubuntu 10.04
|
||||||
|
@ -251,6 +261,11 @@ class Upstart < ServiceManager
|
||||||
end
|
end
|
||||||
|
|
||||||
class SysV < ServiceManager
|
class SysV < ServiceManager
|
||||||
|
def initialize(service_name, service_ctl = nil)
|
||||||
|
@service_ctl ||= 'service'
|
||||||
|
super
|
||||||
|
end
|
||||||
|
|
||||||
def info(service_name)
|
def info(service_name)
|
||||||
# check if service is installed
|
# check if service is installed
|
||||||
# read all available services via ls /etc/init.d/
|
# read all available services via ls /etc/init.d/
|
||||||
|
@ -270,19 +285,14 @@ class SysV < ServiceManager
|
||||||
enabled_services = enabled_services_cmd.stdout.split("\n").select { |line|
|
enabled_services = enabled_services_cmd.stdout.split("\n").select { |line|
|
||||||
/(^.*#{service_name}.*)/.match(line)
|
/(^.*#{service_name}.*)/.match(line)
|
||||||
}
|
}
|
||||||
enabled_services.empty? ? enabled = false : enabled = true
|
enabled = !enabled_services.empty?
|
||||||
|
|
||||||
# check if service is really running
|
# check if service is really running
|
||||||
# service throws an exit code if the service is not installed or
|
# service throws an exit code if the service is not installed or
|
||||||
# not enabled
|
# not enabled
|
||||||
|
|
||||||
# on debian service is located /usr/sbin/service, on centos it is located here /sbin/service
|
cmd = inspec.command("#{service_ctl} #{service_name} status")
|
||||||
service_cmd = 'service'
|
running = cmd.exit_status == 0
|
||||||
service_cmd = '/usr/sbin/service' if inspec.os[:family] == 'debian'
|
|
||||||
service_cmd = '/sbin/service' if inspec.os[:family] == 'centos'
|
|
||||||
|
|
||||||
cmd = inspec.command("#{service_cmd} #{service_name} status")
|
|
||||||
cmd.exit_status == 0 ? (running = true) : (running = false)
|
|
||||||
{
|
{
|
||||||
name: service_name,
|
name: service_name,
|
||||||
description: nil,
|
description: nil,
|
||||||
|
@ -297,6 +307,11 @@ end
|
||||||
# @see: https://www.freebsd.org/doc/en/articles/linux-users/startup.html
|
# @see: https://www.freebsd.org/doc/en/articles/linux-users/startup.html
|
||||||
# @see: https://www.freebsd.org/cgi/man.cgi?query=rc.conf&sektion=5
|
# @see: https://www.freebsd.org/cgi/man.cgi?query=rc.conf&sektion=5
|
||||||
class BSDInit < ServiceManager
|
class BSDInit < ServiceManager
|
||||||
|
def initialize(service_name, service_ctl = nil)
|
||||||
|
@service_ctl ||= 'service'
|
||||||
|
super
|
||||||
|
end
|
||||||
|
|
||||||
def info(service_name)
|
def info(service_name)
|
||||||
# check if service is enabled
|
# check if service is enabled
|
||||||
# services are enabled in /etc/rc.conf and /etc/defaults/rc.conf
|
# services are enabled in /etc/rc.conf and /etc/defaults/rc.conf
|
||||||
|
@ -304,7 +319,7 @@ class BSDInit < ServiceManager
|
||||||
# service SERVICE status returns the following result if not activated:
|
# service SERVICE status returns the following result if not activated:
|
||||||
# Cannot 'status' sshd. Set sshd_enable to YES in /etc/rc.conf or use 'onestatus' instead of 'status'.
|
# Cannot 'status' sshd. Set sshd_enable to YES in /etc/rc.conf or use 'onestatus' instead of 'status'.
|
||||||
# gather all enabled services
|
# gather all enabled services
|
||||||
cmd = inspec.command('service -e')
|
cmd = inspec.command("#{service_ctl} -e")
|
||||||
return nil if cmd.exit_status != 0
|
return nil if cmd.exit_status != 0
|
||||||
|
|
||||||
# search for the service
|
# search for the service
|
||||||
|
@ -314,8 +329,8 @@ class BSDInit < ServiceManager
|
||||||
|
|
||||||
# check if the service is running
|
# check if the service is running
|
||||||
# if the service is not available or not running, we always get an error code
|
# if the service is not available or not running, we always get an error code
|
||||||
cmd = inspec.command("service #{service_name} onestatus")
|
cmd = inspec.command("#{service_ctl} #{service_name} onestatus")
|
||||||
cmd.exit_status == 0 ? (running = true) : (running = false)
|
running = cmd.exit_status == 0
|
||||||
|
|
||||||
{
|
{
|
||||||
name: service_name,
|
name: service_name,
|
||||||
|
@ -328,12 +343,43 @@ class BSDInit < ServiceManager
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
class Runit < ServiceManager
|
||||||
|
def initialize(service_name, service_ctl = nil)
|
||||||
|
@service_ctl ||= 'sv'
|
||||||
|
super
|
||||||
|
end
|
||||||
|
|
||||||
|
def info(service_name)
|
||||||
|
# get the status of runit service
|
||||||
|
cmd = inspec.command("#{service_ctl} status #{service_name}")
|
||||||
|
# return nil unless cmd.exit_status == 0 # NOTE(sr) why do we do this?
|
||||||
|
|
||||||
|
installed = cmd.exit_status == 0
|
||||||
|
running = installed && (cmd.stdout =~ /^run:/)
|
||||||
|
enabled = installed && (running || (cmd.stdout =~ /normally up/) || (cmd.stdout =~ /want up/))
|
||||||
|
|
||||||
|
{
|
||||||
|
name: service_name,
|
||||||
|
description: nil,
|
||||||
|
installed: installed,
|
||||||
|
running: running,
|
||||||
|
enabled: enabled,
|
||||||
|
type: 'runit',
|
||||||
|
}
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
# MacOS / Darwin
|
# MacOS / Darwin
|
||||||
# new launctl on macos 10.10
|
# new launctl on macos 10.10
|
||||||
class LaunchCtl < ServiceManager
|
class LaunchCtl < ServiceManager
|
||||||
|
def initialize(service_name, service_ctl = nil)
|
||||||
|
@service_ctl ||= 'launchctl'
|
||||||
|
super
|
||||||
|
end
|
||||||
|
|
||||||
def info(service_name)
|
def info(service_name)
|
||||||
# get the status of upstart service
|
# get the status of upstart service
|
||||||
cmd = inspec.command('launchctl list')
|
cmd = inspec.command("#{service_ctl} list")
|
||||||
return nil if cmd.exit_status != 0
|
return nil if cmd.exit_status != 0
|
||||||
|
|
||||||
# search for the service
|
# search for the service
|
||||||
|
@ -342,11 +388,11 @@ class LaunchCtl < ServiceManager
|
||||||
|
|
||||||
# extract values from service
|
# extract values from service
|
||||||
parsed_srv = /^([0-9]+)\s*(\w*)\s*(\S*)/.match(srv[0])
|
parsed_srv = /^([0-9]+)\s*(\w*)\s*(\S*)/.match(srv[0])
|
||||||
!parsed_srv.nil? ? (enabled = true) : (enabled = false)
|
enabled = !parsed_srv.nil?
|
||||||
|
|
||||||
# check if the service is running
|
# check if the service is running
|
||||||
pid = parsed_srv[0]
|
pid = parsed_srv[0]
|
||||||
!pid.nil? ? (running = true) : (running = false)
|
running = !pid.nil?
|
||||||
|
|
||||||
# extract service label
|
# extract service label
|
||||||
srv = parsed_srv[3] || service_name
|
srv = parsed_srv[3] || service_name
|
||||||
|
@ -423,22 +469,145 @@ class WindowsSrv < ServiceManager
|
||||||
|
|
||||||
# detect if service is enabled
|
# detect if service is enabled
|
||||||
def service_enabled?(service)
|
def service_enabled?(service)
|
||||||
if !service['WMI'].nil? &&
|
!service['WMI'].nil? &&
|
||||||
!service['WMI']['StartMode'].nil? &&
|
!service['WMI']['StartMode'].nil? &&
|
||||||
service['WMI']['StartMode'] == 'Auto'
|
service['WMI']['StartMode'] == 'Auto'
|
||||||
true
|
|
||||||
else
|
|
||||||
false
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
|
|
||||||
# detect if service is running
|
# detect if service is running
|
||||||
def service_running?(service)
|
def service_running?(service)
|
||||||
if !service['Service']['Status'].nil? &&
|
!service['Service']['Status'].nil? && service['Service']['Status'] == 4
|
||||||
service['Service']['Status'] == 4
|
end
|
||||||
true
|
end
|
||||||
else
|
|
||||||
false
|
class SystemdService < Service
|
||||||
end
|
name 'systemd_service'
|
||||||
|
desc 'Use the systemd_service InSpec audit resource to test if the named service (controlled by systemd) is installed, running and/or enabled.'
|
||||||
|
example "
|
||||||
|
# to override service mgmt auto-detection
|
||||||
|
describe systemd_service('service_name') do
|
||||||
|
it { should be_installed }
|
||||||
|
it { should be_enabled }
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
# to set a non-standard systemctl path
|
||||||
|
describe systemd_service('service_name', '/path/to/systemctl') do
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
"
|
||||||
|
|
||||||
|
def select_service_mgmt
|
||||||
|
Systemd.new(inspec, service_ctl)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
class UpstartService < Service
|
||||||
|
name 'upstart_service'
|
||||||
|
desc 'Use the upstart_service InSpec audit resource to test if the named service (controlled by upstart) is installed, running and/or enabled.'
|
||||||
|
example "
|
||||||
|
# to override service mgmt auto-detection
|
||||||
|
describe upstart_service('service_name') do
|
||||||
|
it { should be_installed }
|
||||||
|
it { should be_enabled }
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
# to set a non-standard initctl path
|
||||||
|
describe upstart_service('service_name', '/path/to/initctl') do
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
"
|
||||||
|
|
||||||
|
def select_service_mgmt
|
||||||
|
Upstart.new(inspec, service_ctl)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
class SysVService < Service
|
||||||
|
name 'sysv_service'
|
||||||
|
desc 'Use the sysv_service InSpec audit resource to test if the named service (controlled by SysV) is installed, running and/or enabled.'
|
||||||
|
example "
|
||||||
|
# to override service mgmt auto-detection
|
||||||
|
describe sysv_service('service_name') do
|
||||||
|
it { should be_installed }
|
||||||
|
it { should be_enabled }
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
# to set a non-standard service path
|
||||||
|
describe sysv_service('service_name', '/path/to/service') do
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
"
|
||||||
|
|
||||||
|
def select_service_mgmt
|
||||||
|
SysV.new(inspec, service_ctl)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
class BSDService < Service
|
||||||
|
name 'bsd_service'
|
||||||
|
desc 'Use the bsd_service InSpec audit resource to test if the named service (controlled by BSD init) is installed, running and/or enabled.'
|
||||||
|
example "
|
||||||
|
# to override service mgmt auto-detection
|
||||||
|
describe bsd_service('service_name') do
|
||||||
|
it { should be_installed }
|
||||||
|
it { should be_enabled }
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
# to set a non-standard service path
|
||||||
|
describe bsd_service('service_name', '/path/to/service') do
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
"
|
||||||
|
|
||||||
|
def select_service_mgmt
|
||||||
|
BSDInit.new(inspec, service_ctl)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
class LaunchdService < Service
|
||||||
|
name 'launchd_service'
|
||||||
|
desc 'Use the launchd_service InSpec audit resource to test if the named service (controlled by launchd) is installed, running and/or enabled.'
|
||||||
|
example "
|
||||||
|
# to override service mgmt auto-detection
|
||||||
|
describe launchd_service('service_name') do
|
||||||
|
it { should be_installed }
|
||||||
|
it { should be_enabled }
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
# to set a non-standard launchctl path
|
||||||
|
describe launchd_service('service_name', '/path/to/launchctl') do
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
"
|
||||||
|
|
||||||
|
def select_service_mgmt
|
||||||
|
LaunchCtl.new(inspec, service_ctl)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
class RunitService < Service
|
||||||
|
name 'runit_service'
|
||||||
|
desc 'Use the runit_service InSpec audit resource to test if the named service (controlled by runit) is installed, running and/or enabled.'
|
||||||
|
example "
|
||||||
|
# to override service mgmt auto-detection
|
||||||
|
describe runit_service('service_name') do
|
||||||
|
it { should be_installed }
|
||||||
|
it { should be_enabled }
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
# to set a non-standard sv path
|
||||||
|
describe runit_service('service_name', '/path/to/sv') do
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
"
|
||||||
|
|
||||||
|
def select_service_mgmt
|
||||||
|
Runit.new(inspec, service_ctl)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -151,6 +151,7 @@ class MockLoader
|
||||||
'initctl show-config ssh' => cmd.call('initctl-show-config-ssh'),
|
'initctl show-config ssh' => cmd.call('initctl-show-config-ssh'),
|
||||||
# show ssh service Centos 7
|
# show ssh service Centos 7
|
||||||
'systemctl show --all sshd' => cmd.call('systemctl-show-all-sshd'),
|
'systemctl show --all sshd' => cmd.call('systemctl-show-all-sshd'),
|
||||||
|
'/path/to/systemctl show --all sshd' => cmd.call('systemctl-show-all-sshd'),
|
||||||
# services on macos
|
# services on macos
|
||||||
'launchctl list' => cmd.call('launchctl-list'),
|
'launchctl list' => cmd.call('launchctl-list'),
|
||||||
# services on freebsd 10
|
# services on freebsd 10
|
||||||
|
|
|
@ -2,3 +2,4 @@ source 'https://supermarket.chef.io'
|
||||||
|
|
||||||
cookbook 'apt'
|
cookbook 'apt'
|
||||||
cookbook 'os_prepare', path: './cookbooks/os_prepare'
|
cookbook 'os_prepare', path: './cookbooks/os_prepare'
|
||||||
|
cookbook 'runit', github: 'hw-cookbooks/runit'
|
||||||
|
|
|
@ -6,3 +6,4 @@ description 'This cookbook prepares the test operating systems'
|
||||||
version '1.0.0'
|
version '1.0.0'
|
||||||
depends 'apt'
|
depends 'apt'
|
||||||
depends 'yum'
|
depends 'yum'
|
||||||
|
depends 'runit'
|
||||||
|
|
|
@ -0,0 +1,34 @@
|
||||||
|
# encoding: utf-8
|
||||||
|
# author: Stephan Renatus
|
||||||
|
|
||||||
|
include_recipe 'runit::default'
|
||||||
|
|
||||||
|
# put ctl in alt location
|
||||||
|
directory '/opt/chef/embedded/sbin' do
|
||||||
|
recursive true
|
||||||
|
action :create
|
||||||
|
end
|
||||||
|
|
||||||
|
link '/opt/chef/embedded/sbin/sv' do
|
||||||
|
to '/sbin/sv' # default location
|
||||||
|
end
|
||||||
|
|
||||||
|
runit_service 'running-runit-service' do
|
||||||
|
default_logger true
|
||||||
|
run_template_name 'default-svlog'
|
||||||
|
end
|
||||||
|
|
||||||
|
runit_service 'not-enabled-runit-service' do
|
||||||
|
default_logger true
|
||||||
|
run_template_name 'default-svlog'
|
||||||
|
start_down true
|
||||||
|
action :enable
|
||||||
|
end
|
||||||
|
|
||||||
|
runit_service 'not-running-runit-service' do
|
||||||
|
default_logger true
|
||||||
|
run_template_name 'default-svlog'
|
||||||
|
action :create
|
||||||
|
end
|
||||||
|
|
||||||
|
execute 'sv down not-running-runit-service'
|
|
@ -4,9 +4,13 @@
|
||||||
#
|
#
|
||||||
# prepares services
|
# prepares services
|
||||||
|
|
||||||
# install ntp as a service on ubuntu
|
|
||||||
case node['platform']
|
case node['platform']
|
||||||
when 'ubuntu'
|
when 'ubuntu'
|
||||||
include_recipe('apt')
|
# install ntp as a service
|
||||||
|
include_recipe 'apt::default'
|
||||||
package 'ntp'
|
package 'ntp'
|
||||||
|
|
||||||
|
when 'centos'
|
||||||
|
# install runit for alternative service mgmt
|
||||||
|
include_recipe 'os_prepare::_runit_service_centos'
|
||||||
end
|
end
|
||||||
|
|
|
@ -0,0 +1,3 @@
|
||||||
|
#!/bin/sh
|
||||||
|
exec > /dev/null
|
||||||
|
exec yes
|
|
@ -42,3 +42,37 @@ if os[:family] == 'ubuntu'
|
||||||
it { should be_running }
|
it { should be_running }
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
# extra tests for alt. runit on centos with runit_service
|
||||||
|
if os[:family] == 'centos'
|
||||||
|
describe runit_service('running-runit-service') do
|
||||||
|
it { should be_enabled }
|
||||||
|
it { should be_installed }
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
describe runit_service('not-running-runit-service') do
|
||||||
|
it { should be_enabled }
|
||||||
|
it { should be_installed }
|
||||||
|
it { should_not be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
describe runit_service('not-enabled-runit-service') do
|
||||||
|
it { should_not be_enabled }
|
||||||
|
it { should be_installed }
|
||||||
|
it { should_not be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
# alt. ctl location
|
||||||
|
describe runit_service('running-runit-service', '/opt/chef/embedded/sbin/sv') do
|
||||||
|
it { should be_enabled }
|
||||||
|
it { should be_installed }
|
||||||
|
it { should be_running }
|
||||||
|
end
|
||||||
|
|
||||||
|
describe runit_service('unknown') do
|
||||||
|
it { should_not be_enabled }
|
||||||
|
it { should_not be_installed }
|
||||||
|
it { should_not be_running }
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
|
@ -27,6 +27,15 @@ describe 'Inspec::Resources::Service' do
|
||||||
_(resource.running?).must_equal true
|
_(resource.running?).must_equal true
|
||||||
end
|
end
|
||||||
|
|
||||||
|
it 'verify ubuntu package parsing with default upstart_service' do
|
||||||
|
resource = MockLoader.new(:ubuntu1404).load_resource('upstart_service', 'ssh')
|
||||||
|
srv = { name: 'ssh', description: nil, installed: true, running: true, enabled: true, type: 'upstart' }
|
||||||
|
_(resource.info).must_equal srv
|
||||||
|
_(resource.installed?).must_equal true
|
||||||
|
_(resource.enabled?).must_equal true
|
||||||
|
_(resource.running?).must_equal true
|
||||||
|
end
|
||||||
|
|
||||||
# ubuntu 15.04 with systemd
|
# ubuntu 15.04 with systemd
|
||||||
it 'verify ubuntu package parsing' do
|
it 'verify ubuntu package parsing' do
|
||||||
resource = MockLoader.new(:ubuntu1504).load_resource('service', 'sshd')
|
resource = MockLoader.new(:ubuntu1504).load_resource('service', 'sshd')
|
||||||
|
@ -37,7 +46,16 @@ describe 'Inspec::Resources::Service' do
|
||||||
_(resource.running?).must_equal true
|
_(resource.running?).must_equal true
|
||||||
end
|
end
|
||||||
|
|
||||||
# centos 6 with systemv
|
it 'verify ubuntu package parsing with default systemd_service' do
|
||||||
|
resource = MockLoader.new(:ubuntu1504).load_resource('systemd_service', 'sshd')
|
||||||
|
srv = { name: 'sshd.service', description: 'OpenSSH server daemon', installed: true, running: true, enabled: true, type: 'systemd' }
|
||||||
|
_(resource.info).must_equal srv
|
||||||
|
_(resource.installed?).must_equal true
|
||||||
|
_(resource.enabled?).must_equal true
|
||||||
|
_(resource.running?).must_equal true
|
||||||
|
end
|
||||||
|
|
||||||
|
# centos 6 with sysv
|
||||||
it 'verify centos 6 package parsing' do
|
it 'verify centos 6 package parsing' do
|
||||||
resource = MockLoader.new(:centos6).load_resource('service', 'sshd')
|
resource = MockLoader.new(:centos6).load_resource('service', 'sshd')
|
||||||
srv = { name: 'sshd', description: nil, installed: true, running: true, enabled: true, type: 'sysv' }
|
srv = { name: 'sshd', description: nil, installed: true, running: true, enabled: true, type: 'sysv' }
|
||||||
|
@ -47,6 +65,15 @@ describe 'Inspec::Resources::Service' do
|
||||||
_(resource.running?).must_equal true
|
_(resource.running?).must_equal true
|
||||||
end
|
end
|
||||||
|
|
||||||
|
it 'verify centos 6 package parsing with default sysv_service' do
|
||||||
|
resource = MockLoader.new(:centos6).load_resource('sysv_service', 'sshd')
|
||||||
|
srv = { name: 'sshd', description: nil, installed: true, running: true, enabled: true, type: 'sysv' }
|
||||||
|
_(resource.info).must_equal srv
|
||||||
|
_(resource.installed?).must_equal true
|
||||||
|
_(resource.enabled?).must_equal true
|
||||||
|
_(resource.running?).must_equal true
|
||||||
|
end
|
||||||
|
|
||||||
# centos 7 with systemd
|
# centos 7 with systemd
|
||||||
it 'verify centos 7 package parsing' do
|
it 'verify centos 7 package parsing' do
|
||||||
resource = MockLoader.new(:centos7).load_resource('service', 'sshd')
|
resource = MockLoader.new(:centos7).load_resource('service', 'sshd')
|
||||||
|
@ -57,6 +84,15 @@ describe 'Inspec::Resources::Service' do
|
||||||
_(resource.running?).must_equal true
|
_(resource.running?).must_equal true
|
||||||
end
|
end
|
||||||
|
|
||||||
|
it 'verify centos 7 package parsing with systemd_service and service_ctl override' do
|
||||||
|
resource = MockLoader.new(:centos7).load_resource('systemd_service', 'sshd', '/path/to/systemctl')
|
||||||
|
srv = { name: 'sshd.service', description: 'OpenSSH server daemon', installed: true, running: true, enabled: true, type: 'systemd' }
|
||||||
|
_(resource.info).must_equal srv
|
||||||
|
_(resource.installed?).must_equal true
|
||||||
|
_(resource.enabled?).must_equal true
|
||||||
|
_(resource.running?).must_equal true
|
||||||
|
end
|
||||||
|
|
||||||
# freebsd
|
# freebsd
|
||||||
it 'verify freebsd10 package parsing' do
|
it 'verify freebsd10 package parsing' do
|
||||||
resource = MockLoader.new(:freebsd10).load_resource('service', 'sendmail')
|
resource = MockLoader.new(:freebsd10).load_resource('service', 'sendmail')
|
||||||
|
@ -67,6 +103,15 @@ describe 'Inspec::Resources::Service' do
|
||||||
_(resource.running?).must_equal true
|
_(resource.running?).must_equal true
|
||||||
end
|
end
|
||||||
|
|
||||||
|
it 'verify freebsd10 package parsing with default bsd_service' do
|
||||||
|
resource = MockLoader.new(:freebsd10).load_resource('bsd_service', 'sendmail')
|
||||||
|
srv = { name: 'sendmail', description: nil, installed: true, running: true, enabled: true, type: 'bsd-init' }
|
||||||
|
_(resource.info).must_equal srv
|
||||||
|
_(resource.installed?).must_equal true
|
||||||
|
_(resource.enabled?).must_equal true
|
||||||
|
_(resource.running?).must_equal true
|
||||||
|
end
|
||||||
|
|
||||||
# arch linux with systemd
|
# arch linux with systemd
|
||||||
it 'verify arch linux package parsing' do
|
it 'verify arch linux package parsing' do
|
||||||
resource = MockLoader.new(:arch).load_resource('service', 'sshd')
|
resource = MockLoader.new(:arch).load_resource('service', 'sshd')
|
||||||
|
@ -88,7 +133,7 @@ describe 'Inspec::Resources::Service' do
|
||||||
end
|
end
|
||||||
|
|
||||||
# debian 8 with systemd
|
# debian 8 with systemd
|
||||||
it 'verify arch linux package parsing' do
|
it 'verify debian 8 package parsing' do
|
||||||
resource = MockLoader.new(:debian8).load_resource('service', 'sshd')
|
resource = MockLoader.new(:debian8).load_resource('service', 'sshd')
|
||||||
srv = { name: 'sshd.service', description: 'OpenSSH server daemon', installed: true, running: true, enabled: true, type: 'systemd' }
|
srv = { name: 'sshd.service', description: 'OpenSSH server daemon', installed: true, running: true, enabled: true, type: 'systemd' }
|
||||||
_(resource.info).must_equal srv
|
_(resource.info).must_equal srv
|
||||||
|
@ -98,7 +143,7 @@ describe 'Inspec::Resources::Service' do
|
||||||
end
|
end
|
||||||
|
|
||||||
# macos test
|
# macos test
|
||||||
it 'verify arch linux package parsing' do
|
it 'verify mac osx package parsing' do
|
||||||
resource = MockLoader.new(:osx104).load_resource('service', 'ssh')
|
resource = MockLoader.new(:osx104).load_resource('service', 'ssh')
|
||||||
srv = { name: 'org.openbsd.ssh-agent', description: nil, installed: true, running: true, enabled: true, type: 'darwin' }
|
srv = { name: 'org.openbsd.ssh-agent', description: nil, installed: true, running: true, enabled: true, type: 'darwin' }
|
||||||
_(resource.info).must_equal srv
|
_(resource.info).must_equal srv
|
||||||
|
@ -107,6 +152,15 @@ describe 'Inspec::Resources::Service' do
|
||||||
_(resource.running?).must_equal true
|
_(resource.running?).must_equal true
|
||||||
end
|
end
|
||||||
|
|
||||||
|
it 'verify mac osx package parsing with default launchd_service' do
|
||||||
|
resource = MockLoader.new(:osx104).load_resource('launchd_service', 'ssh')
|
||||||
|
srv = { name: 'org.openbsd.ssh-agent', description: nil, installed: true, running: true, enabled: true, type: 'darwin' }
|
||||||
|
_(resource.info).must_equal srv
|
||||||
|
_(resource.installed?).must_equal true
|
||||||
|
_(resource.enabled?).must_equal true
|
||||||
|
_(resource.running?).must_equal true
|
||||||
|
end
|
||||||
|
|
||||||
# wrlinux
|
# wrlinux
|
||||||
it 'verify wrlinux package parsing' do
|
it 'verify wrlinux package parsing' do
|
||||||
resource = MockLoader.new(:wrlinux).load_resource('service', 'sshd')
|
resource = MockLoader.new(:wrlinux).load_resource('service', 'sshd')
|
||||||
|
@ -117,6 +171,7 @@ describe 'Inspec::Resources::Service' do
|
||||||
_(resource.running?).must_equal true
|
_(resource.running?).must_equal true
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
# unknown OS
|
# unknown OS
|
||||||
it 'verify package handling on unsupported os' do
|
it 'verify package handling on unsupported os' do
|
||||||
resource = MockLoader.new(:undefined).load_resource('service', 'dhcp')
|
resource = MockLoader.new(:undefined).load_resource('service', 'dhcp')
|
||||||
|
|
Loading…
Reference in a new issue