Update auditd_conf resource

[jburns12]

This resource needs to be updated to match on specific flags per audit line.

[jburns12]

Updates to resource can be found here:
https://github.com/aaronlippold/inspec/tree/al/auditd_rules_updates

I did my best to update the resource to add functionality without taking anything away so that the resource can still be used in the same way by those that have code that previously used this resource.

Examples of usage of updated resource as follows:

For syscall audit rule

sys_call = "chown"

if os.arch == 'x86_64'
  describe auditd_rules.syscall("#{sys_call}") do
    its('action') { should eq ['always'] }
    its('list') { should eq ['exit']}
    its('fields_no_keys.flatten') { should match_array CHOWN_AUDIT_FIELDS_64 }
  end
else
  describe auditd_rules.syscall("#{sys_call}") do
    its('action') { should eq ['always'] }
    its('list') { should eq ['exit'] }
    its('fields_no_keys.flatten') { should match_array CHOWN_AUDIT_FIELDS_32 }
  end
end

For setsebool command:

  describe auditd_rules.file('/usr/sbin/setsebool') do
    its('action') { should eq ['always'] }
    its('list') { should eq ['exit'] }
    its('fields_no_keys.flatten') { should match_array SETSEBOOL_AUDIT_FIELDS }
  end

I can make a pull request for this resource and see how they feel about it if this style works for you @aaronlippold

[jburns12]

Update: I also found that we can roll back a couple of changes I made and use this instead for commands like setsebool:

describe auditd_rules2.syscall('all').path('/usr/sbin/setsebool') do
  its('action') { should eq ['always'] }
  its('list') { should eq ['exit'] }
  its('fields_no_keys.flatten') { should match_array SETSEBOOL_AUDIT_FIELDS }
end

This might actually be preferable since it means less changes to the resource and better conveys that all sys calls to that particular command will be audited.

[aaronlippold]

describe auditd_rules.file('/usr/sbin/setsebool') do
    its('action') { should eq ['always'] }
    its('list') { should eq ['exit'] }
    its('fields') { should cmp  'a' }
    its('fields') { should cmp  'b' }
    its('key') { should cmp  'mykey' }
  end

[jburns12]

Adjusted to do active and passive testing. For setsebool command rule:

-a always, exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged

The inspec statements would be (active pulling from auditctl command and then passive from audit.rules file):

describe auditd_rules.file('/usr/sbin/setsebool') do
  its('action') { should eq ['always'] }
  its('list') { should eq ['exit'] }
  its('fields_nokey.flatten') { should match_array SETSEBOOL_AUDIT_FIELDS }
  its('key') { should cmp 'privileged' }
end

describe auditd_rules_conf.file('/usr/sbin/setsebool') do
  its('action') { should eq ['always'] }
  its('list') { should eq ['exit'] }
  its('fields_nokey.flatten') { should match_array SETSEBOOL_AUDIT_FIELDS_CONF }
  its('key') { should cmp 'privileged' }
end

[jburns12]

And for a sys call rule:

-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod

The inspec statements would be:

if os.arch == 'x86_64'
    describe auditd_rules.syscall("#{sys_call}") do
      its('action') { should eq ['always'] }
      its('list') { should eq ['exit']}
      its('fields_nokey.flatten') { should match_array CHOWN_AUDIT_FIELDS_64 }
      its('key) { should cmp 'perm_mod' }
    end
    describe auditd_rules_conf.syscall("#{sys_call}") do
      its('action') { should eq ['always'] }
      its('list') { should eq ['exit']}
      its('fields_nokey.flatten') { should match_array CHOWN_AUDIT_FIELDS_64_CONF }
      its('key) { should cmp 'perm_mod' }
    end
  else
    describe auditd_rules.syscall("#{sys_call}") do
      its('action') { should eq ['always'] }
      its('list') { should eq ['exit']}
      its('fields_nokey.flatten') { should match_array CHOWN_AUDIT_FIELDS_32 }
      its('key) { should cmp 'perm_mod' }
    end
    describe auditd_rules_conf.syscall("#{sys_call}") do
      its('action') { should eq ['always'] }
      its('list') { should eq ['exit']}
      its('fields_nokey.flatten') { should match_array CHOWN_AUDIT_FIELDS_32_CONF }
      its('key) { should cmp 'perm_mod' }
    end
  end

It seems lengthy, but it's because of the if/else depending on the architecture.

[aaronlippold]

We could always just set the CHOWN_AUDIT_FIELDS_32_CONF and CHOWN_AUDIT_FIELDS_64 on the outside:

chown_audit_fields = (inspec.os.arch == 'x86_64') ? CHOWN_AUDIT_FIELDS_64 : CHOWN_AUDIT_FIELDS_32
chow_audit_fields_conf =  (inspec.os.arch == 'x86_64') ? CHOWN_AUDIT_FIELDS_64 : CHOWN_AUDIT_FIELDS_32

describe auditd_rules.syscall("#{sys_call}") do
      its('action') { should eq ['always'] }
      its('list') { should eq ['exit']}
      its('fields_nokey.flatten') { should match_array chown_audit_fields }
      its('key) { should cmp 'perm_mod' }
    end
    describe auditd_rules_conf.syscall("#{sys_call}") do
      its('action') { should eq ['always'] }
      its('list') { should eq ['exit']}
      its('fields_nokey.flatten') { should match_array chown_audit_fields_conf }
      its('key) { should cmp 'perm_mod' }
    end

[jburns12]

Sure that makes sense. I'll switch to that format.

[aaronlippold]

assuming this returns a bool of true or false : (inspec.os.arch == 'x86_64')

It may need to be: (inspec.os.arch == 'x86_64').to_bol

etc.

[jburns12]

That worked great...

sys_call = "chown"

chown_audit_fields = (inspec.os.arch == 'x86_64') ? CHOWN_AUDIT_FIELDS_64 : CHOWN_AUDIT_FIELDS_32
chown_audit_fields_conf = (inspec.os.arch == 'x86_64') ? CHOWN_AUDIT_FIELDS_64_CONF : CHOWN_AUDIT_FIELDS_32_CONF

describe auditd_rules2.syscall("#{sys_call}") do
  its('action') { should eq ['always'] }
  its('list') { should eq ['exit']}
  its('fields_nokey.flatten') { should match_array chown_audit_fields }
  its('key) { should cmp 'perm_mod' }
end
describe auditd_rules2.syscall("#{sys_call}") do
  its('action') { should eq ['always'] }
  its('list') { should eq ['exit']}
  its('fields_nokey.flatten') { should match_array chown_audit_fields_conf }
  its('key) { should cmp 'perm_mod' }
end

If this all seems reasonable at this point then I can do a PR before next Monday's meeting with the Inspec folk.