* adding control statement to add rule in front of string as long as it doesn't already contain rule.
Correcting resource name in firewalld from etc_hosts_deny
adding tests for both branches of the statement created in firewalld
Signed-off-by: Vern Burton <me@vernburton.com>
* moving to unless with a start_with
Signed-off-by: Vern Burton <me@vernburton.com>
* adding documentation that states that it is not needed to add `rule` string
Signed-off-by: Vern Burton <me@vernburton.com>
* adding SQL 2012 SP1 for mssql_session testing
Signed-off-by: Vern Burton <me@vernburton.com>
* updating SHA to match new commands with ports in them
Signed-off-by: Vern Burton <me@vernburton.com>
* adding port, and a default value and moving from skip_resource to resource_fail
Signed-off-by: Vern Burton <me@vernburton.com>
* adding new sha for custom host
Signed-off-by: Vern Burton <me@vernburton.com>
* adding tests for hostname and migrating test that passed port in host to a dedicated port test
Signed-off-by: Vern Burton <me@vernburton.com>
* adding integration test
Signed-off-by: Vern Burton <me@vernburton.com>
* removing services as appveyor does not have integration testing running so it would be a waste of time to enable it
Signed-off-by: Vern Burton <me@vernburton.com>
* mock instance command
Signed-off-by: Vern Burton <me@vernburton.com>
* making instance readable
Signed-off-by: Vern Burton <me@vernburton.com>
* adding instance test
Signed-off-by: Vern Burton <me@vernburton.com>
* moving to ResourceSkipped as ResourceFailed is targeted for a major release
Signed-off-by: Vern Burton <me@vernburton.com>
* Testing train downcase platform names.
* Added NameCleaned tests and fixed some formatting.
* Clean up tests with helper method.
* Update to new gemfile and platform resource.
Signed-off-by: Jared Quick <jquick@chef.io>
* Add platform resource and platform supports.
Signed-off-by: Jared Quick <jquick@chef.io>
* Cache platform and inspec checks and implement inspec_version.
Signed-off-by: Jared Quick <jquick@chef.io>
* Deprecate current inspec support in favor of inspec_version.
Signed-off-by: Jared Quick <jquick@chef.io>
* Update resource/profile skip messages.
Signed-off-by: Jared Quick <jquick@chef.io>
* Update load_resource to use platform instead of os.
Signed-off-by: Jared Quick <jquick@chef.io>
* Update platform example.
Signed-off-by: Jared Quick <jquick@chef.io>
* Update apache_conf test to check for ServerAlias values.
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add ServerAlias key and values to mock apache conf which includes
trailing whitespace.
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Updated test to reflect all ServerAlias values being put into a single
array item. This is expected as we do not override the key_values
default setting of '1' when passing the raw configuration to
SimpleConfig.
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Update the regular expression to include a conditional with positive
lookahead that checks if the line ends with one or more spaces. If the
lookahead succeeds we non-greedily capture, and when it fails we
greedily capture.
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add mode method to test the value of Bonding Mode
Signed-off-by: Eammon Hanlon <eammon.hanlon@microsoft.com>
* Add test for bonding mode in bond unit test
Signed-off-by: Eammon Hanlon <eammon.hanlon@microsoft.com>
* Add documentation on mode matcher for bond resource
Signed-off-by: Eammon Hanlon <eammon.hanlon@microsoft.com>
* Update example for 'Test parameters for bond0'
Signed-off-by: Eammon Hanlon <eammon.hanlon@microsoft.com>
* Add handling for OWCA login via `compliance login`
OpsWorks Chef Automate currently returns a 200 for the
`/compliance/version` endpoint and redirects to the Chef Manage page.
This adds support to `inspec compliance login` to accept this as valid
behavior and continue with the login.
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Add test case for 200 response but no Chef Manage
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Add debug info and split `determine_server_type`
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Appease RuboCop
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Remove forced returns from `determine_server_type`
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Add `false` code path for non-200/non-401 response
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Reword debug messages
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
Traditionally those would translated DEFAULT_ATTRIBUTE. but that was wrong, it should have been nil or false or whatever the user supplied.
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
* Add support for Darwin Directory Service groups
This allows users to verify groups added by Chef on OS X.
The current method that `UnixGroup` uses is to check the contents of
`/etc/group`, but OS X adds groups to Directory Service and not
`/etc/group`. This modifies the `group` resource on Darwin to use
`dscacheutil` to get group info.
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Clean up `select_group_manager`
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Clean up DarwinGroup `groups` method
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Enhance `package` resource error handling
This does the following:
- Modifies `info` to return an empty hash instead of `nil`
- Adds a failure case if package name is not specified
- Adds a skip case if no package manager can be found
- Changes `skip_resource` to use the `ResourceSkipped` exception
- Raises an error if JSON parsing fails for Windows/MacOS/Darwin
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Make RuboCop happy
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Change missing argument behavior
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Remove unnecessary boolean check
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Constructor unit tests
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Constructor tests pass, all others gutted
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Basic 'where' test in place, no criteria
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Wired up filter table to backend list users
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Unit testing for has_mfa_enabled and has_console_password
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Simple AWS client implementation for Users
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Rework resource parameters and validation; copy in code from #121
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Add constructor tests
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Add search/recall tests
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Recall unit tests pass
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Failing unit tests for username and has_console_password
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* has_console_password works in unit tests
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* has_mfa_enabled failing unit tests
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* has_mfa_enabled passes unit tests
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Failing unit tests for Access Keys
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* CLean up bad rebase commit
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Access keys property works, as an uncooked AWS response
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* De-linting
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Integration tests work
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Remove provider support libraries
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Integration tests pass for users resource
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* De-lint
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Remove aws connection load from user
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Adapt aws_iam_user to rely on AwsResourceMixin
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* add a emulated /etc/cron.d/crondotd file to the mocking system.
* test that we handle incoming paths correctly by rendering to_s.
* We take in both users and a path, so lets call that destination.
* To make the test pass we'll determine if we are dealing with a path or
a user and return the correct string.
* we will need the ability to determine if we are dealing with a path when either calling the crontab command or reading the file directly, so break that out into a path? method.
* remove author field.
* test contents of our crondotd file.
* we have to explicitly make @destination a String to use include?.
* when we get a path we use inspec.file to get conents, otherwise we run the crontab command.
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add documentation for example usage with file path.
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Make path? and path_or_user private methods
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add missing username filed to crondotd mock file
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Pass argument as a hash when testing file paths
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Expected results should include usernames when testing file paths
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add special string `@yearly` test to crondotd mock file
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add user to existing cron tests
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Rubocop says I need spaces after/before curly brackets
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add user to crondotd file tests and add @yearly test
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Modify initialize to take options hash and be backwards compatible.
Change initialize default argument to create a hash by default, though
it is still possible to pass in a 'user' string argument.
@user gets set with the argument value unless its a hash, in which case
it tries to set the value of the user key, otherwise it becomes nil.
@file gets set with the value of the path key, unless it doesn't exist
in which case it becomes nil.
All hash keys are symbolized to ensure consistent access.
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Check if @path is nil to determine if we run crontab command or parse
file.
path? was removed as we're not overloading a @destination variable
anymore.
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* if @user is nil assume current user otherwise crontab for @user
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Change to complete if rather than ternary.
We have three possible cases, current user, other user, or file path.
This accounts for all of them.
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add user to the crontab FilterTable
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Remove path? and path_or_user
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Move crontab parsing to two methods, parse_user_crontab and
parse_system_crontab
Because a command in a crontab file could have spaces we must parse user
and system crontabs differently.
When we parse user crontabs the user field will either be nil, or the requested user.
Both user and path parsers handle special strings (@yearly, @weekly,
etc). And also account for position of user in these files (or adds it
in user case)
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Update examples with user: and path:
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add spaces after : in example docs
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Disable rubocop ClassLength check
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Moved rubocop ClassLength metric next to class instead of above the
module.
Remove unnecessary braces.
Add is_system_crontab? and is_user_crontab helper methods and use them.
Add tests to see if error conditions are raised when the resource is
invoked with missing parameters (user, or path), and on a unsupported
os.
Change initialize to group all hash functions together and raise errors
when user and path is unset. Also raise errors on unsupported operating
systems.
Change order of ternary and use is_system_crontab? rather than
@path.nil?
Signed-off-by: Miah Johnson <miah@chia-pet.org>
* Add debug for caching and fix cli merge bug.
Signed-off-by: Jared Quick <jquick@chef.io>
* Update options merge to take cli options over json.
Signed-off-by: Jared Quick <jquick@chef.io>
* test appveyor with ruby#File
Signed-off-by: Jared Quick <jquick@chef.io>
* Update inspec train to version 0.31.1
Signed-off-by: Jared Quick <jquick@chef.io>
* Allow `inspec check` to ignore `only_if`
When using `inspec check` a mock Train backend is created. This means
that the following would raise an error because `os.name` is `nil`
```
only_if { os.name.include?('anything') }
```
Since `inspec check` isn't concerned with the evaluation of `only_if`
this skips those checks if the block given raises an error.
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Remove unnecessary `e` in rescue
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Modify implementation to use `check_mode`
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Move `check_mode` concept to the Profile scope
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Fix lint after rubocop upgrade
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Add comment for mocked ControlEvalContext options
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Enable caching for command and file calls to train
* Moved transport conn to connection and refactored tests
* Update caching flag to use train caching.
* Move caching flag to cli option.
* Add backed cache default from thor.
* Add hard disable for cache option and remove all cache from debug shell.
* Add comment to caching settings conditional.
* Force file cache on when caching enabled.
* Update gemspec for train 0.30.0.
Signed-off-by: Jared Quick <jquick@chef.io>
* Update security policy export to use pid instead of random.
Signed-off-by: Jared Quick <jquick@chef.io>
* Update helper for the new train.
Signed-off-by: Jared Quick <jquick@chef.io>
* Standardize requires in unit tests
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Standardize requires in resources
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Move AWS connection hook into non-resource library area
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Add an AWS resource mixin, pushing constructor out to it
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Push resource param name recognition into mixin
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Push exists predicate up to mixin
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Rename base.rb to be resource_mixin for clarity
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Separate the backend from its factory, and push it out into a class mixin
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Push BackendFactory up into the resource mixin
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* De-linting
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Remove aws_conn require from LMF and CloudWatch Alarm filters
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Use resource mixin for Cloudwatch Alarm
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Rework LMF to use the resource mixin
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Rubocop.
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Remove SDK load from connection.rb; that happens in aws.rb now
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Mixin should default to allowing empty resource params
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Update LMF to enforce params being required
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
When supplying a docker image that contains a registry with a port number,
such as `localhost:5000/chef/inspec:1.46.3`, the docker_image resource
was unable to locate the image in question due to incorrect parsing
of the repository and tag.
Signed-off-by: Adam Leff <adam@leff.co>
When the JSON resource (and those that subclass off of it) were modified
to properly throw exceptions in the event of failure, this caused the
`params` method to return nil instead of what it used to be, an empty
hash.
This is fine in the case of a describe block, but it's not okay when used
outside of a describe, as it will cause users trying to pluck from the
hash to throw a dreaded-and-unhelpful NilClass error.
This change pre-populates the params to be an empty hash, and if the
read/parse steps fail, it will still be one.
Signed-off-by: Adam Leff <adam@leff.co>
* Add a unique export for security policy resource.
Signed-off-by: Jared Quick <jquick@chef.io>
* Remove skip resource on empty policy file.
Signed-off-by: Jared Quick <jquick@chef.io>
* Allow skipping/failing resources in FilterTable
`FilterTable` is commonly used in the class body of a resource and is
evaluated during an `instance_eval`. This means that if you raise an
exception (e.g. SkipResource) it will halt `inspec exec` and
`inspec check`.
This adds an `ExceptionCatcher` class that will postpone evaluation
until test execution.
This allows `inspec check` and `inspec exec` to perform as intended when
skipping/failing a resource in `FilterTable`
Huge thanks to @adamleff for providing the starting code/ideas!
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Comment why `ExceptionCatcher` doesn't raise
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Remove `accessor` from `ExceptionCatcher`
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Return the existing ExceptionCatcher object rather than creating new
Signed-off-by: Adam Leff <adam@leff.co>
The existing method of adding `-X HEAD` to the curl command does not
work properly and can cause timeouts because curl doesn't properly
close the connection. The correct way is to use curl's own `--head`
flag.
Signed-off-by: Adam Leff <adam@leff.co>
* json resource (et. al.): allow inspec check to succeed when using command
When using the `json` resource (or any of the resources that subclass
JsonConfig), `inspec check` would fail if the content was supplied with
the `command` option. This is because the `command` resource is mocked
and an empty string would be returned for `stdout`. That content would
be blindly passed to the `parse` method would which raise an exception
and cause `inspec check` to fail.
This change refactors JsonConfig to be a bit cleaner and use some helper
methods. Additionally, we use the new Exceptions to properly raise errors
which are naturally caught by Inspec::Profile, etc.
Signed-off-by: Adam Leff <adam@leff.co>
* Make `resource_base_name` method private
Signed-off-by: Adam Leff <adam@leff.co>
* Full docs, first draft; integration tests; started on unit tests
* Integration tests pass
* Docs update
* More consistent syntax in examples
* Alter fetch phase to perform fetch, handle results, and unpack into instance vars, more like other resources
* Docs first draft, integration tests, and constructor unit tests for SNS topic
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Skeleton of SNS topic
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Constructor arg validation works
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Passing unit tests for recall
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Subscription Count property, works
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Subscription, not subscriber
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Integration tests pass; also wildard ARNs are not allowed
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Rubocop changes
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Doc updates per kagarmoe
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
'etc_group' resource stores 'gid' as integer but the 'where' method
compares 'gid' as string.
By this fix, the 'where' method always converts the stored data to string
when comparing. And it can also look for groups without members.
Signed-off-by: ERAMOTO Masaya <eramoto.masaya@jp.fujitsu.com>
* Bumping train to 0.29
Train 0.29 includes some bug fixes and a refactor of the File classes
Signed-off-by: Adam Leff <adam@leff.co>
* Correct unit test for undefined platform
Train requires that a hash is supplied when mocking an OS. Because
an OS of "unsupported" rather than "undefined" was chosen in a unit
test, a nil was passed to train and it caused a failure.
Signed-off-by: Adam Leff <adam@leff.co>
* Ensure 0.29.1 or later gets picked up, but 0.30 is also acceptable
Signed-off-by: Adam Leff <adam@leff.co>
* Add failing unit test for deprecation warning on profiles with slashes in their name
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Issue warning during validation if name contains a slash
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Slug profile names generated from target paths to prevent breaking unit tests
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Rubocop whinges
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Update functional test watching for default profile name
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Make deprecation warning more descriptive
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Rubocop whinges
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Set title with original test path if no profile name or title provided
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
* Rubocop whinges
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
When configuring a profile dependency, if the dependent profile had a
hyphen in it, it would not properly match the default version constraint
of `>= 0`. This is because a hyphen indicates the version is a pre-release
version and proper version matching would require the constraint to also
be listed with a pre-release version string.
The proper solution is to use the `+` character instead which indicates
a build number, which is what the hyphen was meant to convey. In the
meantime, this change properly compares version strings as SemVer and
also adds tests.
Signed-off-by: Adam Leff <adam@leff.co>
PR #2216 introduced some new tests that use the old syntax that was
deprecated in #2235. This gets them in line and eliminates the
deprecation warnings.
Signed-off-by: Adam Leff <adam@leff.co>
An nginx config may contain configuration settings that are quoted, such
as a map entry:
"~^\/opcache-api" 1;
The `nginx_conf` resource was failing to properly parse these.
Signed-off-by: Adam Leff <adam@leff.co>
The `toml` gem has a very strict version dependency on an old version
of parslet. This change switches us to use `tomlrb` instead which has
no direct dependencies. This will allow us to bump up to a later version
of parslet that has better error handling and insight into parser errors.
Signed-off-by: Adam Leff <adam@leff.co>
* Add non-halting exception support to resources
This adds two `Inspec::Exceptions` that can be used within resources to
either skip or fail a test without halting execution.
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* mount resource: fix for Device-/Sharenames and Mountpoints including whitespaces
Device-/Sharenames and Mountpoints on Linux may include whitespaces (\040), e.g. /etc/fstab entry like:
```//fileserver.corp.internal/Research\040&\040Development /mnt/Research\040&\040Development cifs OTHER_OPTS```
... results in a mount line like:
```//fileserver.corp.internal/Research & Development on /mnt/Research & Development type cifs (OTHER_OPTS)```
The Linux mount command replaces \040 with whitspace automatically, so this should be tributed.
I used a control like this:
```
describe mount('/mnt/Research & Development') do
it { should be_mounted }
its('device') { should eq '//fileserver.corp.internal/Research & Development' }
end
```
Before:
```
× whitespaces-1: Mount with whitespace within sharename and mountpoint. (1 failed)
✔ Mount /mnt/Research & Development should be mounted
× Mount /mnt/Research & Development device should eq "//fileserver.corp.internal/Research & Development"
expected: "//fileserver.corp.internal/Research & Development"
got: "//fileserver.corp.internal/Research"
(compared using ==)
```
After:
```
✔ whitespaces-01: Mount with whitespace within sharename and mountpoint.
✔ Mount /mnt/Research & Development should be mounted
✔ Mount /mnt/Research & Development device should eq "//fileserver.corp.internal/Research & Development"
```
Signed-off-by: Markus Grobelin <grobi@koppzu.de>
* mounts_with_whitespaces: make lint happy
Signed-off-by: Markus Grobelin <grobi@koppzu.de>
* mount resource: added parentheses as suggested by https://github.com/chef/inspec/pull/2257/files
Signed-off-by: Markus Grobelin <grobi@koppzu.de>
* mount resource: fix for Device-/Sharenames and Mountpoints including whitespaces
Signed-off-by: Markus Grobelin <grobi@koppzu.de>
* Rename EC2-instance resources
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Add interim updates
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* testing for issue 82
Signed-off-by: Simon Varlow <simon.varlow@d2l.com>
* completed integration for EC2 roles
Signed-off-by: Simon Varlow <simon.varlow@d2l.com>
* adding in the beginning of the unit test for issue 82
Signed-off-by: Simon Varlow <simon.varlow@d2l.com>
* Fix unit tests
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Add has_roles? examples
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Remove redundant gsub
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* corrected OpenStruct format
Signed-off-by: Simon Varlow <simon.varlow@d2l.com>
* setting up variable for InstanceProfile
Signed-off-by: Simon Varlow <simon.varlow@d2l.com>
* Updated the unit test so all variables are at the top
Signed-off-by: Simon Varlow <simon.varlow@d2l.com>
* Fixed Rubocop issues that were detected
Signed-off-by: Simon Varlow <simon.varlow@d2l.com>
* Updating README.md to include changes to aws_ec2
Signed-off-by: Simon Varlow <simon.varlow@d2l.com>
* Add failing IT for has_roles?
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Add negative IT and fix uncovered issue
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Fix Rubocop issue
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Fix integration test
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Fix Rubocop issues and unit tests
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Pin AWS dependency to '~> 2'
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Initial Commit
Signed-off-by: sfreeman <Steffanie.Freeman@d2l.com>
* aws_iam_user uses lazy loading
Signed-off-by: sfreeman <Steffanie.Freeman@d2l.com>
* Disassociates convert call from list_users
Signed-off-by: sfreeman <Steffanie.Freeman@d2l.com>
* A real-world working AwsIamUsers (#71)
* Add aws_iam_users
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Adding Filter table and Collect User Details to aws_iam_users.rb
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Adding Filter table and Collect User Details to aws_iam_users.rb
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Adding Filter table and Collect User Details to aws_iam_users.rb
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Get an aws_iam_users integration test to pass
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Fix RuboCop issues and tests
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Improving code based on PR feedback
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* AWS IAM Users unit tests work with new lazy loading feature
Signed-off-by: sfreeman <Steffanie.Freeman@d2l.com>
* Fixes tests
Signed-off-by: aduric <adnan.duric@d2l.com>
* Users should only hold the returned user references, transfering responsibility to each user to fetch any details
Signed-off-by: aduric <adnan.duric@d2l.com>
* Create user details provider class
Signed-off-by: sfreeman <Steffanie.Freeman@d2l.com>
* Using details provider factory to delegate creation of detail providers, and updates tests
Signed-off-by: aduric <adnan.duric@d2l.com>
* Rubocop fixes
Signed-off-by: aduric <adnan.duric@d2l.com>
* Rename user details provider factory to initializer, and remove unnecessary instance variables
Signed-off-by: sfreeman <Steffanie.Freeman@d2l.com>
* Merge `login` and `login_automate` commands
This provides a single interface for logging into either Chef Automate
or Chef Compliance servers. Server type is evaluated at run time via
HTTP responses from designated endpoints.
This also moves the login logic from `Compliance::ComplianceCLI` to a
separate set of modules in `Compliance::API`. This removes logic from
Thor and allows for more in depth Unit testing.
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Remove empty line below class definition
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Add message to `raise CannotDetermineServerType`
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Refactor `token_info` assignment
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Remove unnecessary rubocop disable
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Modify `Login` module namespacing
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Remove mentions of login_automate and --usertoken
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Modify `determine_server_type` to return a symbol
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Add support for `login_automate` and `--usertoken`
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Fix encoding typo
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Address PR feedback
This does the following:
- Moves `CannotDetermineServerType` error to `.login`
- Changes methods that store configuration to return the configuration
- Moves user output to one location in `.login`
- Makes other small improvements
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Added CRAN resource to check R modules
control 'cran-1' do
impact 1.0
desc '
Ensure R module DBI is installed.
'
describe cpan('DBI') do
it { should be_installed }
its('version') { should cmp >= '3.0' }
end
end
Signed-off-by: Markus Grobelin <grobi@koppzu.de>
* cran resource: made lint happy, added negative unit test, removed unused arg perl_lib_path
Signed-off-by: Markus Grobelin <grobi@koppzu.de>
* Added CPAN resource to check Perl modules
control 'cpan-1' do
impact 1.0
desc '
Ensure Perl modules DBI and DBD::Pg are installed.
'
describe cpan('DBI') do
it { should be_installed }
end
describe cpan('DBD::Pg') do
it { should be_installed }
its('version') { should cmp >= '3.0' }
end
end
Signed-off-by: Markus Grobelin <grobi@koppzu.de>
* cpan resource: fixed unit test for non-installed module
Signed-off-by: Markus Grobelin <grobi@koppzu.de>
* new resource: elasticsearch resource, test cluster/node state
This is a new resource for testing an Elasticsearch cluster. It operates
by fetching the `_nodes` endpoint from a given Elasticsearch node and
collects data about each node in a cluster, even if there's only a
single node.
This work is based on inspiration from an initial PR #1956 submitted by
@rx294.
Signed-off-by: Rony Xavier <rx294@nyu.edu>
Signed-off-by: Aaron Lippold <lippold@gmail.com>
Signed-off-by: Adam Leff <adam@leff.co>
* Reduce mock data on non-default tests
Signed-off-by: Adam Leff <adam@leff.co>
* Adds alias for 'ListDirectory' permission
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Works with Ruby array of permissions as long as possible
Converts to PowerShell array just before use.
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Abstracts user-provided permissions to router method
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Adds FullControl as a specifiable permission
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Adds specific permission 'modify'
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Fixes#1743
Limits Windows' broad "read" permission to if it can read all of the
above, instead of just the first:
- File contents
- File attributes
- File extended attributes
- File permissions
This better aligns with how Windows names the permissions.
'read' -> Read instead of 'read' -> ReadData
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* 'Execute' Windows ACL has alias of 'Traverse'
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Adds 'Delete' permission
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Adds `should allow('perm').by_user('me')` matcher
Provides hooks for later use with Windows ACL matching
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Adds remaining Windows ACL hooks
Skips ReadAndExecute on intentionally since it just aliases the combo of
2 permissions into one new one.
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* [Rubocop] Reduces ABC / Cyclomatic complexity
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Reduces global scope with `allows()` -> `be_allowed()`
RSpec inferred matchers work nicely here. This changes the `by_user()`
and `by()` chained matchers to just be an options hash on the underlying
`allowed?()` method.
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Fixes integration tests with rename `allows()` -> `be_allowed()`
Signed-off-by: David Alexander <opensource@thelonelyghost.com>
* Fix `only_if` behavior when used outside controls
This renames `@skip_profile` to `@skip_file` and modifies the scope of
`only_if` (used outside of a control) to only apply to the control file
that contains it instead of the entire profile.
This does this by exposing `@skip_file` from the control context so that
it can be set back to `false` between loading control files in the
profile context.
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Modify `get_checks` to accept a rule index
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Modify `only_if` to work regardless of location
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Disable Cyclomatic/Perceived Complexity in Rubocop
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Add comment for `skip_file` in `load_control_file`
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* Support PAX-formatted tar files, standardize file lists
When a tar file is generated in PAX format, the files have an additional
relative path prefix added to them. For example, instead of:
inspec.yml
... the file is listed as:
./inspec.yml
And the source reader plugin looks only for a "inspec.yml" file to
determine the profile format.
This change addresses this issue by normalizing the file paths in the
TarReader and accounting for the additional "./" prefix that may exist
whenever the tar file is walked looking for a file to read its content.
Signed-off-by: Adam Leff <adam@leff.co>
* Remove pax from unit test, will move to functional
Signed-off-by: Adam Leff <adam@leff.co>
* Add function test for the pax header tar file
Signed-off-by: Adam Leff <adam@leff.co>
* Uses netstat to detect open ports on AIX
Signed-off-by: Keith Walters <keith.walters@cattywamp.us>
* Adds unit tests for AIX port resource
Signed-off-by: Keith Walters <keith.walters@cattywamp.us>
* Move raise condition for host into enabled method
This is related to #1205. This will fix the ssl resource for now until
we redo the exceptions. Still looking around the code and need to build
some unit tests for the ssl resource.
My fix here is to move the raise condition till later in the flow,
specifically the enabled? method. This lets the raise get caught
accordingly without killing the other tests.
Signed-off-by: Jared Quick <jquick@chef.io>
* Remove authors from ssl resource test
Signed-off-by: Jared Quick <jquick@chef.io>
This change enhances the processes resource to support the busybox
ps command which is common on Alpine, for example. The way we
map ps fields to the structs needed by FilterTable have also been
refactored to be more flexible so we can support multiple formats
in the future.
Also, the processes resource now allows the grep argument to be optional
thus allowing a user to query all resources without passing in a
match-all regex.
Signed-off-by: Adam Leff <adam@leff.co>
As detected in #2036, it is not possible to extract values from
a YAML file if the key is a symbol. This change refactors ObjectTraverser
to support symbol keys before attempting to stringify them.
Signed-off-by: Adam Leff <adam@leff.co>
* Add nil check for sshd config file
This fixes#1778. There was a issue where if the user did not have read
permissions on /etc/ssh/sshd_config it would error out on the empty?
check. The fix here is to also look for nil on the file content. Along
with this I refactored the inspec file empty? check as it does not exist
and was also erroring during my testing.
Signed-off-by: Jared Quick <jquick@chef.io>
* Add emptyfile test object and refactor tests
Signed-off-by: Jared Quick <jquick@chef.io>
Currently, the http resource always executes locally, even when scanning
a remote machine with `--target` which leads to undesireable behavior.
This change adds the ability to remotely execute tests with curl. This
behavior is currently opt-in with the `enable_remote_worker` flag, but
will become the default behavior in InSpec 2.0. Deprecation warnings
are emitted if the user is scanning a remote target but has not opted
in to the new behavior.
Signed-off-by: Adam Leff <adam@leff.co>
* Added output for port/protocol for host resource.
Signed-off-by: Jared Quick <jquick@chef.io>
* refactor with explicit return
This fixes#2085. Port and protocol are now shown in output of the host
resource if defined.
Signed-off-by: Jared Quick <jquick@chef.io>
* refactor with string building return
Signed-off-by: Jared Quick <jquick@chef.io>
* New Resource - firewalld
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* New Resource - firewalld
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* New Resource - firewalld
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* New Resource - firewalld
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* Modifications to new resourec - firewalld
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* Modifications to new resource - firewalld
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* Modifications to new resource firewalld
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Modifications to new resource - firewalld
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Changing firewalld_command method to prepend the command with 'firewall-cmd' to reduce code reuse.
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Modifications made
* installed? method now tells by checking if firewall-cmd is a command on the system
* The firewalld_command method now strips the stdout of the return
* added another test for testing multiple active zones
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Fixing rake lint issue
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Fixing match and returning boolean for seeing if firewalld is running
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Fixing lint issues
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Empty commit to rerun. Accidentally updated branch.
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Rerunning test, accidentally updated branch. needs sign off commit
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Add hotfix resource for Windows
Signed-off-by: Matt Ray <matthewhray@gmail.com>
* Renamed hotfix to windows_hotfix
Added additional unit test checking for KB that is not present on a box
Signed-off-by: Matt Ray <matthewhray@gmail.com>
* Integration test to spot-check for hotfixes
Queries the Windows operating system via Powershell for a list of all
installed hotfixes and spot-checks every 10th one with the
windows_hotfix resource. Checking hundreds is time-consuming. Also
checks to ensure a non-installed hotfix is not present.
Signed-off-by: Matt Ray <matthewhray@gmail.com>
This modifies `Inspec::DirProvider` to allow special characters in the
file glob by escaping those characters via `Shellwords.shellescape`.
This fixes#2111 (`inspec check` on path with special characters)
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* forgiving default attributes
When default attributes arent specified provide one that is much more forgiving.
See this https://github.com/chef/inspec/issues/2176
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
This modifies the enabled check for the `service` resource to use the
service's config file instead of `initctl show-config`.
`initctl show-config` does not accurately show the state of a service if
that service's config file is modified while the service is running.
This fixes#1834.
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
The logic in `Inspec::Attribute` prohibited the use of `false` (FalseClass) as
a valid attribute. If the attribute value supplied was `false`, then it would fall
back to the default value.
This change properly allows the use of `false` as a value, adds the initial tests
for Inspec::Attribute, and also uses better attr_writer semantics for writing/storing
the value.
Signed-off-by: Adam Leff <adam@leff.co>
Users cannot query for registry keys that have periods in them because of
how rspec-its works. This change enables Array-style syntax for the
registry_key resource so users can use that as a workaround.
Signed-off-by: Adam Leff <adam@leff.co>
* Added auditd resource and documentation.
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* Added unit tests for auditd resource and updated auditd_rules_test to match new entries in auditctl
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* Removed all legacy code for audit < 2.3. Removed parens to create consistency.
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* Updated method names and removed unnecessary content based on review
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* Add wildcard/multiple server support to nginx_conf
Signed-off-by: Jerry Aldrich <jerryaldrichiii@gmail.com>
* separate the merge function for maps in nginx_conf
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
* Support profile versions for automate profiles storage
Signed-off-by: Alex Pop <apop@chef.io>
* Add unit tests for inspec-compliance bundle
Signed-off-by: Alex Pop <apop@chef.io>
* Refactor target_url method, fix tests, fix rubocop errors
Signed-off-by: Adam Leff <adam@leff.co>
* Ignore linked container names when parsing docker containers
If a container is linked to another container, the normal `docker ps` output
does not include this information. However, when pulling the `.Names` field
with `docker ps --format`, the linked container is listed in the name. This
is confusing for users trying to use InSpec to audit a container.
This change strips any linked container names from the actual container name.
Signed-off-by: Adam Leff <adam@leff.co>
* Linked container names aren't guaranteed to be last depending on how they were linked
Signed-off-by: Adam Leff <adam@leff.co>
* Adding support for fstab
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* New Resource - etc_fstab
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* New Resource - etc_fstab
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* Modifications to new resource - etc_fstab
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* Modifications to new resource - etc_fstab
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* Modifications to new resource - etc_fstab
Signed-off-by: dromazos <dromazmj@dukes.jmu.edu>
* Modifications to docs of new resource etc_fstab
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* Modifications to new resource etc_fstab
Signed-off-by: dromazmj <dromazmj@dukes.jmu.edu>
* wip: extend nginx_conf for http+servers+locations
... well `http` entries really, but we couldnt just call it `https`.
the goal is to `nginx_conf.http` / `nginx_conf.servers` / `nginx_conf.locations` and then also have these calls cascaded down to simplify the access to these fields. the current pattern is rather tedious since we need to check for nil everywhere.
* add test for new nginx accessors
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
* add docs for nginx-conf
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
* fix all incorrect NGINX spellings in docs
* prevent edge-cases where nginx params are nil
for location, http, and servers
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
* more descriptive to_s for nginx servers
as suggested by @adamleff, thank you!
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
* add more descriptive to_s for nginx location
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
* Modify linux regular expression to handle process names with spaces
Signed-off-by: Chad Scott <cscott@chadikins.com>
* Add mocks, tests, etc.
Signed-off-by: Chad Scott <cscott@chadikins.com>
* Add support for XML files
Signed-off-by: Morley, Jonathan <jmorley@cvent.com>
* Use REXML instead of nokogiri
Signed-off-by: Morley, Jonathan <jmorley@cvent.com>
* port resource: support ss instead of netstat
`netstat` is officially deprecated and is replaced with `ss`. This PR
changes the port resource to use `ss` if it's available on the target
system.
Signed-off-by: Adam Leff <adam@leff.co>
* Disable Metrics/ClassLength cop on the LinuxPorts class
Signed-off-by: Adam Leff <adam@leff.co>
* Update pip resource for #516 allow user to set path to pip executable
Signed-off-by: Anthony Shaw <anthonyshaw@apache.org>
* support virtualenv path, pip file exec and better logic
Signed-off-by: Anthony Shaw <anthonyshaw@apache.org>
* add tests for the change to the pip path and resource
Signed-off-by: Anthony Shaw <anthonyshaw@apache.org>
* tests are case sensitive, although command line is not
Signed-off-by: Anthony Shaw <anthonyshaw@apache.org>
* use a path verification method instead of a class method
Signed-off-by: Anthony Shaw <anthonyshaw@apache.org>
* use guard clauses instead of conditionals
Signed-off-by: Anthony Shaw <anthonyshaw@apache.org>
* change the control flow to return nil when commands are not available
Signed-off-by: Anthony Shaw <anthonyshaw@apache.org>
* fix the return values when custom pip path is not valid
Signed-off-by: Anthony Shaw <anthonyshaw@apache.org>
* Refactor pip path detection to fix unit tests
Signed-off-by: Adam Leff <adam@leff.co>
* Support mixed-case group entries
The `group` resource downcased the input parameter unless the target
was a Windows node. However, it's completely legitimate for a Unix-y
node to have mixed case group and passwd entries.
This change does have the potential to break people that did not carefully
match their case when searching for a group, but we're currently blocking
people from using the group resource properly if they have mixed-case
entries.
Signed-off-by: Adam Leff <adam@leff.co>
* Fix unit tests
Signed-off-by: Adam Leff <adam@leff.co>
* Added line to fix bug when no key in file rule and updated test to validate bug fix
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* Updated to consider corner case
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* Added aide_conf resource and subsequent files
* Updated to match on all selection lines
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* Changed to use CommentParser and fixed typo
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* Fix typo in test file
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* Updated to address PR feedback
Signed-off-by: Jennifer Burns <jburns@mitre.org>
* check the proper field for dpkg installation state fixes#2006
Signed-off-by: Mathieu Sauve-Frankel <msf@kisoku.net>
* Properly handle held packages on dpkg-flavored OS
InSpec was looking at the wrong field in `dpkg -s` output to determine
whether a package was installed or not. An installed, held package was
incorrectly reported as uninstalled.
This adds the proper unit tests and also adds a `be_held` matcher.
Thanks to @kisoku for the initial work in #2007.
Signed-off-by: Adam Leff <adam@leff.co>
With last weeks tag fix, `ourorg/container` ended up having its `repo` reported as `container`.
With this it'll be `ourorg/container` again.
Signed-off-by: Stephan Renatus <srenatus@chef.io>
* Add aws_iam_users
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Adding Filter table and Collect User Details to aws_iam_users.rb
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Adding Filter table and Collect User Details to aws_iam_users.rb
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Adding Filter table and Collect User Details to aws_iam_users.rb
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Get an aws_iam_users integration test to pass
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Fix RuboCop issues and tests
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Improving code based on PR feedback
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* New matcher 'be_in'
Fixes#2018
Signed-off-by: Rony Xavier <rx294@nyu.edu>
* small fixes to wording.
Signed-off-by: Aaron Lippold <lippold@gmail.com>
* Added code to use be_in for with the following use case:
describe nginx do
its(module_list) { should be_in AUTHORIZED_MODULE_LIST }
end
Fixes#2018
Signed-off-by: Rony Xavier <rx294@nyu.edu>
* Updates to the matcher
Fixes#2018
Signed-off-by: Rony Xavier <rx294@nyu.edu>
* Added tests for the be_in matcher
Signed-off-by: Rony Xavier <rx294@nyu.edu>
* Requested updates completed
Signed-off-by: Rony Xavier <rx294@nyu.edu>
The fix is already provided here: https://github.com/chef/inspec/pull/2040
This PR only adds a unit test to catch it
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
* bugfix: empty file strings from archive readers
Empty files in archives are sometimes possible (we just ran into this with TGZ), but is never a valid file to extract. So remove it and discount it altogether. Changed structure to support testing of these global calls.
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
* lint and rebuild
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
If a profile has a data files directory that looks like this:
```
files/platforms/one/data.json
files/platforms/two/data.json
files/platforms/three/data.json
```
... the source reader will return the directories in the list of files but with
nil contents. This causes an issue when Inspec::Profile tries to create a sha256
checksum of the profile contents only to try to cast nil to a string when
building the null-delimited profile contents string.
Files that are empty will have an empty string as its contents, so it's safe to
assume that file entries with nil contents are actually a directory and have no
affect on the profile's checksum. Therefore, this change will eliminate any file
entries in responses from the source readers where the contents are nil.
Signed-off-by: Adam Leff <adam@leff.co>
* Change host resource to use getent ahosts on Linux
In InSpec 1.31, we changed the `host` resource to use `dig` instead of `getent
hosts` for name resolution because `getent hosts` does not return all entries
(only the first v6 entry if it exists, then the first v4 entry) and we wanted to
keep the Darwin and Linux implementation as close as possible. Unfortunately,
this affected users' ability to do resolution checks for entried stored in their
/etc/hosts file.
This change goes back to using `getent` for Linux and changes to `getent ahosts`
which returns both v4 and v6 records. Additionally, the Darwin provider's dig
implementation was reordered to return v4 addresses before v6 addresses to be
consistent with how `getent ahosts` returns records.
Signed-off-by: Adam Leff <adam@leff.co>
* Update unit tests for resolve_with_getent with proper output
Signed-off-by: Adam Leff <adam@leff.co>
The logic used to determine whether a viable netcat binary exists is wrong and
prevents Linux hosts from doing TCP reachability checks.
Signed-off-by: Adam Leff <adam@leff.co>
CoreOS is considered a member of the Linux family, and the `host` resource tries
to use `nc` on Linux hosts to test TCP reachability. Unfortunately, `nc` is not
available on CoreOS, but `ncat` is.
This change attempts to use `nc` first, then `ncat` if it's available.
Signed-off-by: Adam Leff <adam@leff.co>
* Run linter on unit tests
Signed-off-by: sfreeman <Steffanie.Freeman@d2l.com>
* Bring remaining unit tests up to spec with rubocop
Signed-off-by: sfreeman <Steffanie.Freeman@d2l.com>
* Fix host resolution on Darwin, use dig wherever possible
The `host` and `dig` commands do not return non-zero if a query returns NXDOMAIN
or NOERROR, but the DarwinHostProvider was expecting it when deciding whether to
fall back to IPv4 if a IPv6 query failed. Therefore, the `host` resource would
not function properly when resolving hostnames on Darwin. The logic has been
changed to use `dig` short output and query for both v6 and v4 addresses.
Additionally, the LinuxHostProvider has been modified to prefer `dig` if it's
available to keep behavior similar between Darwin and Linux whenever possible.
This has the added benefit of providing v6 and v4 resolution if possible where
`getent hosts` only returns v6 if v6 records exist.
Signed-off-by: Adam Leff <adam@leff.co>
* Fix up methods, add command mock, do string matching in ruby instead of command
Fixes#1643Fixes#1673
Signed-off-by: Aaron Lippold <lippold@gmail.com>
* fixed a small courner case in the error detection - error: vs error
fixed resource to use 'shellwords' module to escape the query
requested chances in method architecture for testing
added unit tests
Fixes: #1814
Signed-off-by: Aaron Lippold <lippold@gmail.com>
* updated resource and tests with requested review changes
Signed-off-by: Aaron Lippold <lippold@gmail.com>
* removed unneeded call to `escaped_query` in the `create_sql_cmd`.
Signed-off-by: Aaron Lippold <lippold@gmail.com>
* removed license info
Signed-off-by: Aaron Lippold <lippold@gmail.com>
* Remove any "All Rights Reserved" references
InSpec is licensed and released under the Apache 2.0 license. This
change removes all reference to legacy code files that still had
any Copyright or License lines referring to "All Rights Reserved".
Signed-off-by: Adam Leff <adam@leff.co>
* fix functional tests
Signed-off-by: Christoph Hartmann <chris@lollyrock.com>
The resource itself only offers contents and params right now. It resolved
all include calls it can find and creates the aggregated config object.
This is limited in functionality. One last (set of) PR(s) is needed to
add an interface that makes querying this config file easier. It is due
to the file's inherent complexity that I want to explore which methods
are needed to be effective. In the meantime, this resource offers accessors
to the underlying data that are stable.
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
For cleanliness and ease of testing, I've moved the logic that
parses the server version from the compliance config to a
separate method.
Signed-off-by: Adam Leff <adam@leff.co>
Net::HTTP does not gracefully handle HTTP options/headers
that have nil values. This updates Fetchers::Url to verify
that all headers we attempt to configure have non-nil,
non-empty values.
This originally surfaced via the audit cookbook with the
chef-automate fetcher in use without the data_collector
token being set.
Signed-off-by: Adam Leff <adam@leff.co>
* Adding toml resource
This adds a `toml` resource that inherits from the json resource and
behaves the same way as the JSON and YAML resources.
Signed-off-by: Nolan Davidson <ndavidson@chef.io>
* s/package/service/ on service unit test descriptions
Signed-off-by: Kristian Vlaardingerbroek <kvlaardingerbroek@schubergphilis.com>
* Add support for CoreOS to the service resource
Signed-off-by: Kristian Vlaardingerbroek <kvlaardingerbroek@schubergphilis.com>
* Remove some apparently unused test setup to remove some warnings.
* Initialize some instance variables before use to silence warnings.
* Remove an unused variable to remove a warning.
* Remove some indirection.
* Silence logger during tests.
* Check if an instance variable was defined before referencing to remove a warning.
* Define duplicated constant once in root rakefile.
* Initialize an instance variable to remove a warning.
* Remove PROJECT_DIR to reduce coupling.
Signed-off-by: Pete Higgins <pete@peterhiggins.org>
The is_automate_server_pre_080? and is_automate_server_080_and_later?
methods needed some fixing. The Compliance configuration could have
a "version" key that was not nil but was an empty hash, indicating
that it came from a pre-0.8.x Automate server. What we really need
to look for is config['version']['version'] being nil?.
Signed-off-by: Adam Leff <adam@leff.co>
* Adding resource aws_iam_root_user
Signed-off-by: Miles Tjandrawidjaja <miles@tjandrawidjaja.com>
* Adding to_s method to class aws_iam_root_user
Signed-off-by: Miles Tjandrawidjaja <miles@tjandrawidjaja.com>
* Cleaner to_s result for aws_iam_root_user
Signed-off-by: Miles Tjandrawidjaja <miles@tjandrawidjaja.com>
* Add query for password_reuse_prevention to iam_password_policy
Signed-off-by: Miles Tjandrawidjaja <miles@tjandrawidjaja.com>
* Use mock over stub, and more concise language for tests in aws_iam_password_policy
Signed-off-by: Miles Tjandrawidjaja <miles@tjandrawidjaja.com>
* Rename method prevent_password_reuse to prevents_password_reuse
Signed-off-by: Miles Tjandrawidjaja <miles@tjandrawidjaja.com>
* Add access_keys method to aws_iam_user
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Fix unit test that accessed AWS
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Incorporate PR feedback
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Fix unit tests
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Update tests based on PR feedback
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
* Rebase to master
Signed-off-by: Chris Redekop <chris.redekop@d2l.com>
`must_equal nil` will fail in MiniTest 6. Changing those to `must_be_nil`
quiets down all the warnings we currently see and preps us for Minitest 6.
Signed-off-by: Adam Leff <adam@leff.co>
* Add TCP reachability support on Linux for host resource
This enhances the `host` resource on Linux targets by using netcat
(if installed) to perform TCP reachability checks.
Signed-off-by: Adam Leff <adam@leff.co>
* documentation updates
Signed-off-by: Adam Leff <adam@leff.co>
* Appease rubocop
Signed-off-by: Adam Leff <adam@leff.co>
The Compliance::API.version method could potentially return
a hash containing no "version" key but would return an empty
hash upon any expected failure. Downstream callers of the
Compliance::API.version method were looking for a "version"
key to always be present when, in some cases, it would not be.
This change ensures that if a version is not available, there
is no "version" key in the hash, and downstream callers of this
method have been changed to check for nil instead of empty.
Signed-off-by: Adam Leff <adam@leff.co>
* add bitbucket repo url handling
Signed-off-by: Mike Stevenson <Mike.Stevenson@us.logicalis.com>
* backout changes to .gitignore
* adding unit tests for bitbucket url transformers
Signed-off-by: Mike Stevenson <Mike.Stevenson@us.logicalis.com>
* fixing some indents
Signed-off-by: Mike Stevenson <Mike.Stevenson@us.logicalis.com>
* fix some indents
Signed-off-by: Mike Stevenson <Mike.Stevenson@us.logicalis.com>
Unsupported operating systems AND the mockloader when using inspec analysis tools may lead to powershell being called with the command being `nil`, because the resource skips during the initialize phase. Instead, propagate an empty string so that `command` has a valid input and then skip the resource.
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
When attempting to parse the profile out of the target URL, we
were not raising an exception if we failed to do so. Such a situation
could arise if a user's inspec config.json is incorrect either due to
manual editing or failure to re-login after an upgrade past Automate
0.8.0.
This change provides a clear exception if this occurs and also adds
tests for the compliance_profile_name method.
Signed-off-by: Adam Leff <adam@leff.co>
The gem resource used to determine if a gem is installed based on the exit
status of the `gem` command, however that command will return zero
if the package was found or not. This patch checks to ensure that the
`gem list` command actually includes the gem name or is empty to
determine if the gem is in fact installed.
If the gem command returns something other than a `0` exit code, then
it'll skip the resource.
Signed-off-by: Keith Walters <keith.walters@cattywamp.us>
This adds supports for connecting to MS SQL instances using Window
authentication rather than SQL authentication. By leaving either the
user or password parameters blank causes the sqlcmd to leave off the -U
and -P params. This will cause sqlcmd to authenticate as the current
Windows user.
Signed-off-by: Nolan Davidson <ndavidson@chef.io>
Inspired by #1640, this change cleans up the logic used when
reading in secrets files, provides clearer warnings when the
secrets files can't be parsed, and adds tests for those methods.
Signed-off-by: Adam Leff <adam@leff.co>
Switched the oracle_session resource to take an option hash and allow
for configuring hostname, DB_SID, and sqlplus binary path.
Added unit tests.
Signed-off-by: Nolan Davidson <ndavidson@chef.io>
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
check for unset password expiry
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
pr changes
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
Instead of my favorite shortcut of `os.inspec` just finally add it as a global keyword.
Preparation for https://github.com/chef/inspec/issues/1396
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
This is always bothersome when debugging code and drilling down objects, since it will just a return a two-layer anonymous class with no help at all.
Instead print a nice name and even give a bit of information on pretty-printing (which pry does naturally)
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
Unindent has been misbehaving for control `desc`riptions by completely removing newlines. This is now fixed and the unindentation mechanism improved to behave as expected.
Removing empty lines at the beginning and end of string remains unchanged.
Tabs are not treated as multi-space indentations; supporting them as 8-space chars would require additional effort (please comment if this is important to you)
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
I.e. instead of printing them as:
```
desc "hello\nworld"
```
it would instead do:
```
desc "hello
world"
```
Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
RubyGems on windows comes with a batch file that wraps the `gem` command
so it executes correctly. This change uses that batch file for windows
for our `gem` resource, and also properly handles when we receive no output
from the command.
Signed-off-by: Adam Leff <adam@leff.co>
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
wire up mock resource twice
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
cleaning up as per pr feedback
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
style fixes
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
fix indent in test
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
remove unneeded line
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
use minitest mock instead of object
Signed-off-by: Viktor Yakovlyev <Viktor.Y@D2L.com>
* Enable customization of supermarket_url
It looks like this was originally supposed to work, but at some point
the default value was put in the method body rather than in the method
parameters.
This change allows you to configure the supermarket_url in test kitchen
like so:
```
verifier:
inspec_tests:
- name: linux-hardening
supermarket: som3guy/apache-disa-stig
supermarket_url: https://my.supermarket.com
```
Signed-off-by: Ryan Larson <ryan.mango.larson@gmail.com>
If a repo did not exist, running matchers against it (such as `exist`)
were failing due to a bug in `#to_s` when fetching the repo name. The
`info` method would return nil and we'd still try to treat it as a hash.
This change ensures that info is always a hash, possibly empty if the
repo doesn't exist, and uses the repo name provided by the user rather
than shortening it to be consistent with our other resources which don't
manipulate the user input in the formatter.
Also added a method_missing to allow users to interrogate repo options,
such as baseurl or gpgcheck.
Signed-off-by: Adam Leff <adam@leff.co>
Per PR feedback, `Inspec::ProfileVendor` is created to centralize
the logic and data of vendoring profile dependencies. The `BaseCLI`
class and the `Habitat::Profile` class have been modified to use it
Signed-off-by: Adam Leff <adam@leff.co>
This change adds support in Habitat-packaged profiles for
profiles that depend on other profiles. When `inspec habitat
profile create` or `inspec habitat profile upload` is run,
it will see if the profile's dependencies have been vendored
yet, and if not, it will vendor them before creating the
habitat artifact.
For the git and URL fetchers, more explicit creation of the
target directories for the vendored profiles is done. This
is implicitly done via normal CLI interactions a user may
go through, but in our case, we want to ensure those directories
are there before the fetchers try to write out content.
By adding this support, we also fix a bug experienced in Habitat
where a profile that was packaged before an `inspec exec` was run
for the profile would cause a failure in Habitat. This is caused
by `inspec exec` doing a vendor of the dependencies if necessary
and generating the inspec.lock file. In Habitat, the package dir
is not writable by the hab user and InSpec would fail to run due
to an inability to write out an inspec.lock.
Signed-off-by: Adam Leff <adam@leff.co>
Netstat will sometimes output an IPv6 address that is not
formatted correctly; the address is either truncated or uses
or implies the `::` shorthand notation twice. This yields an
invalid IPv6 address and causes IPAddr.new to choke.
This change guards against invalid IP addresses and ensures they
do not end up in the port resource's entries list.
Signed-off-by: Adam Leff <adam@leff.co>
* add tag object
Signed-off-by: Christoph Hartmann <chris@lollyrock.com>
* add tests for to_hash function in tag
Signed-off-by: Christoph Hartmann <chris@lollyrock.com>
When SimpleConfig parses a config file that has sections, such as a mysqld
config file, the values within that section are returned via a Hash. However,
we do not provide an easy way to write tests for those deep hash values:
```
describe mysql_conf('/tmp/my.cnf') do
its('mysqld.expire_logs_days') { should cmp 10 }
end
MySQL Configuration
∅ undefined method `expire_logs_days' for #<Hash:0x007fe463795a00>
```
This change provides a method-based accessor for Hashes that are built via
SimpleConfig.
```
describe mysql_conf('/tmp/my.cnf') do
its('mysqld.expire_logs_days') { should cmp 10 }
end
MySQL Configuration
✔ mysqld.expire_logs_days should cmp == 10
```
Fixes#1541 by changing the way the attributes are fetched.
Signed-off-by: Adam Leff <adam@leff.co>
When attempting to access array values via the `json` resource:
```
describe json('/tmp/test.json') do
its(['array',0]) { should eq "zero" }
end
```
... the resulting data would be an array of the size of the original array
with all the values replaced with nils:
```
expected: "zero"
got: [nil, nil, nil]
```
This was due to a bug in the ObjectTraverser mixin that mapped array values
back through `extract_value` rather than properly handling the passed-in
key(s). This worked fine for the specific data format created by the `csv`
resource but did not work `json` or any other resource that subclassed the
`JsonConfig` resource.
This change fixes the logic when dealing with an array when it's encountered,
and fixes up the `csv` resource with its own `value` method.
This change also adds tests for ObjectTraverser.
Signed-off-by: Adam Leff <adam@leff.co>
Currently, if the inspec.yml for a profile is invalid (such as including
an improperly-defined multi-line string), InSpec will throw an exception
from the YAML parser that does not given a clear indication that the
issue was encountered while parsing the inspec.yml file.
This change introduces a better exception message to clue the user into
where the problem actually lies.
Signed-off-by: Adam Leff <adam@leff.co>
On Linux, netstat may show a tcp6/udp6 protocol line but include a
v4 address. This happens with AF_INET6 sockets that can accept
both v4 and v6 traffic. The port check was not properly handling
this situation and trying to pass a v4 address to URI bracketed as
if it was a v6 address.
Signed-off-by: Adam Leff <adam@leff.co>
Two new commands have been created:
* inspec habitat profile create /path/to/profile
* inspec habitat profile upload /path/to/profile
The `create` command creates a Habitat artifact that contains the contents
of the Habitat profile found at the provided path. This will be used later
in some Habitat + InSpec integrations.
The `upload` command does the same create process but then uploads the
resulting artifact to the Habitat Depot.
Signed-off-by: Adam Leff <adam@leff.co>
The following new resources have been added; however, they
presently only support FreeBSD and similar.
* `zfs_dataset`: tests if a named ZFS dataset is present
and/or has certain properties.
* `zfs_pool`: tests if a named ZFS pool is present and/or
has certain properties.
Additionally, the `mount` resource has been reworked to
include support for FreeBSD; while the existing class
was renamed to LinuxMountParser.
Unit-tests were added for all of the above.
Signed-off-by: Joseph Benden <joe@benden.us>
When running InSpec with multiple profiles, and two or more of the profiles
are read in using the "Flat" SourceReader (i.e. they are not actual profiles
with a metadata file like inspec.yml, but rather just a folder containing
.rb files with controls and tests in them), InSpec would throw a NilClass
error when building the necessary objects for the formatter.
The cause was in `#profile_contains_example` in the formatter code which
checks to see if the profile name is the same as the profile_id in the given
example. However, if both of those were nil, it would potentially match the
wrong Flat-read profile.
This change fixes this in two ways: refusing to match if the profile name
or example profile ID is nil, and adding a default name to a profile if
it doesn't have a title or name. This will solve the matching issue and also
clean up the formatter output so users can more easily tell what tests
are from which profile/path.
Signed-off-by: Adam Leff <adam@leff.co>
The crontab resource parses a particular user's crontab file into
individual entries and allows the user to assert information about
each entry as needed.
Signed-off-by: Adam Leff <adam@leff.co>
This pull request adds a packages resource so that we can check for pattern matches against all the packages on a system. This initially implements only dpkg support for debian-based platforms so we can cover this use case:
```ruby
describe packages(/^xserver-xorg.*/) do
its("list") { should be_empty }
end
```
This uses FilterTable so we can supply additional queries, too.
```ruby
describe packages(/vi.+/).where { status != 'installed' } do
its('statuses') { should be_empty }
end
```
Users can specify the name as a string or a regular expression. If it is a string, we will escape it and convert it to a regular expression to use in matching against the full returned list of packages. If it is a regular expression, we take that as is and use it to filter the results.
While some package management systems such as `dpkg` can take a shell glob argument to filter their results, we eschew this and require a regular expression to match multiple package names because we will need this to work across other platforms in the future. This means that the following:
```ruby
packages("vim")
```
Will return *all* the "vim" packages on the system. The `packages` resource will take `"vim"`, turn it into `/vim/`, and greedily match anything with "vim" in the name. To match only a single package named `vim`, it needs to be an anchored regular expression.
```ruby
packages(/^vim$/)
```
Signed-off-by: Joshua Timberman <joshua@chef.io>
Use entries instead of list
Added a few more tests and non installed package in output
Signed-off-by: Alex Pop <apop@chef.io>
fix lint
Signed-off-by: Alex Pop <apop@chef.io>
Signed-off-by: Joshua Timberman <joshua@chef.io>
Previous, require_controls was including all controls from the named
profile, despite the documented behavior being that it only includes
controls explicitly pulled in by the user. The cause was two-fold:
1) A previous refactor meant that we weren't removing the rule from the
correct context, and
2) We weren't descending down the dependency tree when filtering rules.
This commit fixes the require_controls DSL method and adds a test to
help prevent future regressions.
Signed-off-by: Steven Danna <steve@chef.io>
If a URL based source does not match the shasum recorded in the
lockfile, it likely means a new version has been pushed to the remote
source. In this case, we fail to help ensure that when using a lockfile
we always run the same code as when the lockfile was created.
Signed-off-by: Steven Danna <steve@chef.io>
All resources from deps are added into the control_eval_context used by
the current profile. However, if there is a name conflict, the last
loaded resource wins. The new `require_resource` dsl method allows the
user to do the following:
require_resource(profile: 'profile_name',
resource: 'other',
as: 'renamed')
describe renamed do
...
end
Signed-off-by: Steven Danna <steve@chef.io>
The recent changes to provide isolated views of the available resources
was not extended to Rspec::ExampleGroups. This ensures that
ExampleGroups have access to the same resources as the enclosing
Inspec::Rule.
Signed-off-by: Steven Danna <steve@chef.io>
This adds a new git fetcher. In doing so, it also refactors how the
fetchers work a bit to better support fetchers that need to resolve
user-provided sources to fully specified sources appropriate for a
lockfile.
Signed-off-by: Steven Danna <steve@chef.io>
Previously, libraries were loaded by instance_eval'ing them against
the same execution context used for control files. All resources were
registered against a single global registry when the `name` dsl method
was invoked. To obtain seperation of resources, we would mutate the
instance variable holding the globale registry and then change it back
at the end.
Now, we instance_eval library files inside an anonymous class. This
class has its own version of `Inspec.resource` that returns another
class with the resource DSL method and the profile-specific resource
registry.
The goal of these changes is to ensure that the libraries from
dependencies are loaded even if their controls are never included. To
facilitate this, we break up the loading into seperate steps, and move
the loading code into the Profile which has acceess to the dependency
information.
Signed-off-by: Steven Danna <steve@chef.io>
Previously, all resources were loaded into a single resource registry.
Now, each profile context has a resource registry, when a profile's
library is loaded into the profile context, we update the
profile-context-specific resource registry. This local registry is
then used to populate the execution context that the rules are
evaluated in.
Signed-off-by: Steven Danna <steve@chef.io>
A few minor issues were causing 3 functional test failures on OS X.
These were not program errors but where rather the result of the
profiles under test assuming a linux environment.
Since many of the developers who will work on this project in the future
will be running OS X, let's ensure they can run the functional tests
easily.
Signed-off-by: Steven Danna <steve@chef.io>
The goal of this change is to provide an isolated view of the available
profiles when the user calls the include_controls or require_controls
APIs. Namely,
- A profile should only be able to reference profiles that are part of
its transitive dependency tree. That is, if the dependency tree for a
profile looks like the following:
A
|- B --> C
|
|- D --> E
Then profile B should only be able to see profile C and fail if it
tries to reference A, D, or E.
- The same profile should be include-able at different versions from
different parts of the tree without conflict. That is, if the
dependency tree for a profile looks like the following:
A
|- B --> C@1.0
|
|- D --> C@2.0
Then profile B should see the 1.0 version of C and profile D should
see the 2.0 profile C with respect to the included controls.
To achieve these goals we:
- Ensure that we construct ProfileContext objects with respect to the
correct dependencies in Inspec::DSL.
- Provide a method of accessing all transitively defined rules on a
ProfileContext without pushing all of the rules onto the same global
namespace.
This does not yet handle attributes or libraries.
This extends the dependency feature to include support for url-based
dependencies. It takes some deviations from the current support for
URLs that we'll likely want to make more consistent.
By default, we store downloaded archives in the cache rather than the
unpacked archive. However, to facilitate debugging, we will prefer the
unpacked archive if we find it in the cache.
Signed-off-by: Steven Danna <steve@chef.io>
This adds a new subcommand:
inspec env [SHELL]
which outputs a shell-appropriate completion script that the user can
source into their shell:
eval "$(inspec env SHELL)"
Currently, we provide completions for ZSH and Bash. The completion
scripts are generated from the data Thor collects.
If the user doesn't provide SHELL we attempt to detect what the user's
shell may be using a number of methods.
Signed-off-by: Steven Danna <steve@chef.io>
This allows the user to write:
describe port(22) do
it { should be_listening }
end
as well as
describe port('22') do
it { should be_listening }
end
without hitting an error.
Fixes#867
Signed-off-by: Steven Danna <steve@chef.io>
this happens when the profile is run (exec) and also interpreted (via profile.params). It will load 2 profile context calls (both via Runner) which in turn gets 2 rounds of interpreter+runner executions. This is an issue with auto-generated IDs, due to their random component, which changes in this case
Full rewrite of all formatters. Create a minimal JSON, a full JSON, and a fallback RSpec formatter. The latter is only needed for corner cases and should not really be used. The former 2 are for (1) running `inspec json` followed by `inspec exec` (`--format json`) and (2) running just `inspec exec --format fulljson`.
Instead of just removing all tests because of OS support, supports now acts by adding all tests to the execution context, but doesnt actually execute them. Instead tests are set to skip before they get to the actual execution context
instead of keeping them as flat variables, prefix all internals with `__` to create consistency. Also add accessors on the class-level to expose these values in all rules. This way we keep all variable-names in one location and get some safety on access.
In some instances, when running inspec shell, you dont get any resources inside of it. i.e. `inspec shell` and then `os` will lead to
```ruby
NameError: undefined local variable or method `os' for
from (pry):1:in `add_content'
```
This is because of instance_eval loading withing the given source/line
information and not attaching to the profile context which actually has
all the resources. Fix it by making sure that inspec shell always
attaches to the profile context with resources by providing nil for
source and line information.
```
describe.one do
describe command("uname -r").stdout do
it { should_not match /x86_64/ }
end
describe test_sth_for_x64_processors do
...
end
end
```
This helps reduce any folder structures, weather on disk or in archives, to their relative root paths; i.e. ignore all file-prefixes that are given and go directly to the underlying files, relative to the common folders that contain it
Bugfix: there were services that would get matched because of the way the regex was constructed, i.e. if the user inserted `.` or `*` or anything regexy. Even if the service only had part of the name you were interested in, it would match (e.g. `sshd` would find `my_sshdaemon`).
Apart from this, runlevels are now detected for SystemV. This is exposed in `#info`
Basically make sure everyone understands these are only subcommands. we might consider adding plugins for options or existing commands instead of new subcommands. this just ensures everyone knows what registry is for
I.e.: Prevent users from writing `supports: linux` and similar. These are deprecated and will be removed. Also improve the warning to indicate what the user should do instead. Finally add tests to make sure we get all these.
NB I've just added default duplicates to one instance (i.e., there's
only one `systemd_service`), since there's no os-specific magic in them.
Also these tests only verify that the default choice is equivalent to
`service` on the tested distribution.
Before introducing InSpec profiles in https://github.com/chef/inspec/pull/252 we had `metadata.rb` keep all information. This included an undisclosed field called `supports`. However, this field was never actually used in practice. So for legacy profiles, this means that `supports` was ignored. In order to keep old profiles running in exactly the way they were before, ignore this field when reading from metadata.rb
For reading the profiles metadata, we're using the train mock backend
through Inspec::Runner. The new `supports` feature never agrees with the
mock backend.
Now, it we figure out if this is a mock class and then just say that it
supports whatever we're asking for.
Tl;dr: there's probably a more beautiful solution to this.
Added a test case, but it fails -- while the command line interface
works fine.
Package release info (e.g. '19.el7') is often required to determine if
a system has been properly patched.
Lines like the following from rpm are messing up the version returned
by the package resource:
"...\nVersion : 1.8.6p3 Vendor: Red Hat, Inc.\n..."
Correcting this with a new conditional check.
Currently, #readable?, #writeable?, and #executable? will incorrectly
return true if the file does not exist.
In addition, I took the opportunity to refactor the File resource to
make it easier to write unit tests and supplied a full unit test
suite for this resource.
processes('bash').user does not actually make much sense for a resource
that is a list -- different entries can belong to different users.
Analogous for processes('bash').state.
The attributes 'users' and 'states' expose the unique values
corresponding to that property of entries in the process list.
Fixes#295.
before, the resource would throw an exception when include_files
returned nil (i.e., [].flatten!)
added basic unit tests capturing the include_files behaviour
