systctl-33 doesn't see nx flag

[rjhornsby]

sysctl-33 appears to have been broken by commit 085b428.

The change from assignment_re to assignment_regex appears to have made it stop recognizing the presence of the nx flag, causing the test to fail.

  ×  sysctl-33: CPU No execution Flag or Kernel ExecShield (1 failed)
     ×  /proc/cpuinfo Flags should include NX
     expected [] to include "nx"
     ✔  Kernel Parameter kernel.exec-shield value should eq 1

This is what the flags string looks like on a sample CentOS 6 host:

$ grep nx /proc/cpuinfo
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx rdtscp lm constant_tsc up rep_good xtopology nonstop_tsc pni pclmulqdq monitor ssse3 cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx rdrand lahf_lm abm

Edit: For clarity, this might be a change that's related to the inspec version? We're currently on chefdk 1.2.22, which ships with inspec 1.11.0.

[artem-sidorenko]

@rjhornsby thanks for the bug report!

@alexpop @chris-rock its because of PR GH-64, can you please have a look?

[rjhornsby]

Confirmed that this is somehow related to the inspec version. Upgraded my local chefdk to 1.4.3 (inspec 1.25.1) and the test passed.

Side note: Not sure how I feel about the solution "upgrade your chefdk!", since upgrading indicates that GH-64 is a breaking change for some older versions of inspec. To be fair to @alexpop, the current inspec documentation doesn't seem to even mention assignment_re - it only talks about assignment_regex. That suggests the inspec authors (quietly?) deprecated/dropped assignment_re at some point since inspec 1.11.0.

[rjhornsby]

Looks like inspec has indeed deprecated assignment_re

[artem-sidorenko]

@rjhornsby how it looks like this issue can be closed?

[rjhornsby]

@artem-sidorenko after thinking about it for a day, yeah I think it can be closed. The solution is to upgrade inspec to a version that supports assignment_regex.