Initial control isolation support #973

stevendanna · 2016-08-24T11:19:58Z

The goal of this change is to provide an isolated view of the available
profiles when the user calls the include_controls or require_controls
APIs. Namely,

A profile should only be able to reference profiles that are part of
its transitive dependency tree. That is, if the dependency tree for a
profile looks like the following:

A
|- B --> C
|
|- D --> E

Then profile B should only be able to see profile C and fail if it
tries to reference A, D, or E.
The same profile should be include-able at different versions from
different parts of the tree without conflict. That is, if the
dependency tree for a profile looks like the following:

A
|- B --> C@1.0
|
|- D --> C@2.0

Then profile B should see the 1.0 version of C and profile D should
see the 2.0 profile C with respect to the included controls.

To achieve these goals we:

Ensure that we construct ProfileContext objects with respect to the
correct dependencies in Inspec::DSL.
Provide a method of accessing all transitively defined rules on a
ProfileContext without pushing all of the rules onto the same global
namespace.

This does not yet handle attributes or libraries.

stevendanna · 2016-08-24T11:49:55Z

Partially fixes #958 by ensuring that the profile context that we load during include_control and require control uses the dependencies for the given profile, not for the parent profiles.

chris-rock · 2016-08-25T11:55:25Z

lib/inspec/profile_context.rb

+    def all_rules
+      ret = @rules.values
+      ret += @subcontexts.map(&:all_rules).flatten
+      ret


ah nice :-)

chris-rock · 2016-08-25T12:31:20Z

This is a great improvement @stevendanna Thanks 💯

The goal of this change is to provide an isolated view of the available profiles when the user calls the include_controls or require_controls APIs. Namely, - A profile should only be able to reference profiles that are part of its transitive dependency tree. That is, if the dependency tree for a profile looks like the following: A |- B --> C | |- D --> E Then profile B should only be able to see profile C and fail if it tries to reference A, D, or E. - The same profile should be include-able at different versions from different parts of the tree without conflict. That is, if the dependency tree for a profile looks like the following: A |- B --> C@1.0 | |- D --> C@2.0 Then profile B should see the 1.0 version of C and profile D should see the 2.0 profile C with respect to the included controls. To achieve these goals we: - Ensure that we construct ProfileContext objects with respect to the correct dependencies in Inspec::DSL. - Provide a method of accessing all transitively defined rules on a ProfileContext without pushing all of the rules onto the same global namespace. This does not yet handle attributes or libraries.

chris-rock · 2016-08-25T12:54:43Z

There is a known issue https://github.com/chef-cookbooks/compat_resource, therefore we ignore the errors in our kitchen tests

chris-rock · 2016-08-26T08:37:51Z

related to #888