return empty array for known privileges

[chris-rock]

This PR prevents cases, where a specific privilege has not been configured. The include matcher will throw an error if used on nil elements.

(users.where { username =~ /.*/}.uids.entries + groups.where { name =~ /.*/}.gids.entries).each do |entry|
    describe security_policy do
      its("SeTcbPrivilege") { should_not include entry }
    end
  end

Therefore it turns:

inspec> (users.where { username =~ /.*/}.uids.entries + groups.where { name =~ /.*/}.gids.entries).each do |entry|
inspec>   describe security_policy do    
inspec>     its("SeTcbPrivilege") { should_not include entry }      
inspec>   end      
inspec> end    

  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-21-1759981009-4135989804-1844563890-500"
     expected nil not to include "S-1-5-21-1759981009-4135989804-1844563890-500", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-21-1759981009-4135989804-1844563890-501"
     expected nil not to include "S-1-5-21-1759981009-4135989804-1844563890-501", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-21-1759981009-4135989804-1844563890-1001"
     expected nil not to include "S-1-5-21-1759981009-4135989804-1844563890-1001", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-579"
     expected nil not to include "S-1-5-32-579", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-544"
     expected nil not to include "S-1-5-32-544", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-551"
     expected nil not to include "S-1-5-32-551", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-574"
     expected nil not to include "S-1-5-32-574", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-569"
     expected nil not to include "S-1-5-32-569", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-562"
     expected nil not to include "S-1-5-32-562", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-573"
     expected nil not to include "S-1-5-32-573", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-546"
     expected nil not to include "S-1-5-32-546", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-578"
     expected nil not to include "S-1-5-32-578", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-568"
     expected nil not to include "S-1-5-32-568", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-556"
     expected nil not to include "S-1-5-32-556", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-559"
     expected nil not to include "S-1-5-32-559", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-558"
     expected nil not to include "S-1-5-32-558", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-547"
     expected nil not to include "S-1-5-32-547", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-550"
     expected nil not to include "S-1-5-32-550", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-576"
     expected nil not to include "S-1-5-32-576", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-577"
     expected nil not to include "S-1-5-32-577", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-575"
     expected nil not to include "S-1-5-32-575", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-555"
     expected nil not to include "S-1-5-32-555", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-580"
     expected nil not to include "S-1-5-32-580", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-552"
     expected nil not to include "S-1-5-32-552", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-32-545"
     expected nil not to include "S-1-5-32-545", but it does not respond to `include?`
  Security Policy
     ✖  SeTcbPrivilege should not include "S-1-5-21-1759981009-4135989804-1844563890-1000"
     expected nil not to include "S-1-5-21-1759981009-4135989804-1844563890-1000", but it does not respond to `include?`

into

inspec> (users.where { username =~ /.*/}.uids.entries + groups.where { name =~ /.*/}.gids.entries).each do |entry|
inspec>   describe security_policy do    
inspec>     its("SeTcbPrivilege") { should_not include entry }      
inspec>   end      
inspec> end    

  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-21-1759981009-4135989804-1844563890-500"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-21-1759981009-4135989804-1844563890-501"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-21-1759981009-4135989804-1844563890-1001"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-579"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-544"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-551"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-574"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-569"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-562"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-573"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-546"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-578"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-568"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-556"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-559"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-558"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-547"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-550"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-576"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-577"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-575"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-555"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-580"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-552"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-32-545"
  Security Policy
     ✔  SeTcbPrivilege should not include "S-1-5-21-1759981009-4135989804-1844563890-1000"

[arlimus]

Kudos Chris, thank you for fixing this