class Inspec::Resources::Selinux

Public Class Methods

new(selinux_path = "/etc/selinux/config") click to toggle source
# File lib/inspec/resources/selinux.rb, line 85
def initialize(selinux_path = "/etc/selinux/config")
  @path = selinux_path
  cmd = inspec.command("sestatus")

  if cmd.exit_status != 0
    # `sestatus` command not found error message comes in stdout so handling both here
    out = cmd.stdout + "\n" + cmd.stderr
    return skip_resource "Skipping resource: #{out}"
  end

  result = cmd.stdout.delete(" ").gsub(/\n/, ",").gsub(/\r/, "").downcase
  @data = Hash[result.scan(/([^:]+):([^,]+)[,$]/)]
end

Public Instance Methods

booleans() click to toggle source
# File lib/inspec/resources/selinux.rb, line 123
def booleans
  SelinuxBooleanFilter.new(parse_booleans)
end
disabled?() click to toggle source
# File lib/inspec/resources/selinux.rb, line 103
def disabled?
  @data["selinuxstatus"] == "disabled"
end
enforcing?() click to toggle source
# File lib/inspec/resources/selinux.rb, line 107
def enforcing?
  @data["currentmode"] == "enforcing"
end
installed?() click to toggle source
# File lib/inspec/resources/selinux.rb, line 99
def installed?
  inspec.file(@path).exist?
end
modules() click to toggle source
# File lib/inspec/resources/selinux.rb, line 119
def modules
  SelinuxModuleFilter.new(parse_modules)
end
permissive?() click to toggle source
# File lib/inspec/resources/selinux.rb, line 111
def permissive?
  @data["currentmode"] == "permissive"
end
policy() click to toggle source
# File lib/inspec/resources/selinux.rb, line 115
def policy
  @data["loadedpolicyname"]
end
to_s() click to toggle source
# File lib/inspec/resources/selinux.rb, line 127
def to_s
  "SELinux"
end

Private Instance Methods

parse_booleans() click to toggle source
# File lib/inspec/resources/selinux.rb, line 144
def parse_booleans
  raw_booleans = inspec.command("semanage boolean -l -n").stdout
  r_booleans = []
  raw_booleans.each_line do |entry|
    data = entry.scan(/([^(,)]+)/).flatten.map(&:strip)
    r_booleans.push({ name: data[0], state: data[1], default: data[2] })
  end
  r_booleans
end
parse_modules() click to toggle source
# File lib/inspec/resources/selinux.rb, line 133
def parse_modules
  raw_modules = inspec.command("semodule -lfull").stdout
  r_modules = []
  raw_modules.each_line do |entry|
    data = entry.split.map(&:strip)
    state = data.length == 4 ? data[3] : "enabled"
    r_modules.push({ name: data[1], status: "installed", state: state, priority: data[0] })
  end
  r_modules
end