linux-baseline os-06 can not be skipped

[kyleaschmitt]

OS-06 can't be skipped, because skip_control only skips what's in "describe", from what I understand. Anyway, if you try and skip OS-06, it still runs the find on the target server, just the result doesn't show up in the report.

Also, given it's a reasonable test to do (checking for setuid root), could we add a -xdev (do not descend into other file systems). Not many servers have their common binaries on a separate mount than /, but do have many very large mounts of local or network drives. A find that descends across mounts can take a very long time to run, even to the point where it can disrupt service (especially on glusterfs bricks).

[atomic111]

@kyleaschmitt thanks for the idea. this can be a good option to add the xdev and to speed up the test. we should add this.

@artem-sidorenko objection?

[artem-sidorenko]

@chris-rock is this a bug in inspec? (test execution if it should be skipped)

@atomic111 I have a mixed feeling about that. On the one hand it would speed up this test and maybe solve many issues we saw/got reported. On the other hand, I saw scripts and similar helper binaries in /var or even /home (I totally agree, this should not be this way, but unfortunately reality is different) . This both filesystems are often different mount points and almost always they are mounted without nosuid. In this case xdev would ignore suid bit there. In some situations it might be an advantage for attacker. I'm not sure about my view here. @chris-rock what is your view on this?

[chris-rock]

@kyleaschmitt is right, only_if only skips the describe block. Since we are using ruby, ruby is executing the control block in order to parse it properly. What we can do tho handle this is to move the logic of find into a custom InSpec resource. That will only be executed if only_if applies.

[artem-sidorenko]

@chris-rock out of interest, when at some point inspec would not use rspec anymore, this thing can get probably changed, so control blocks get evaluated only of describe block should be executed, right?

[chris-rock]

@artem-sidorenko no, this has to do with ruby. If you have the following:

control 'os-06' do
   impact 1.0
   title 'Check for SUID/ SGID blacklist'
   desc 'Find blacklisted SUID and SGID files to ensure that no rogue SUID and SGID files have been introduced into the system'
 
   output = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' ! -path \'/var/lib/lxd/containers/*\' -print 2>/dev/null | grep -v \'^find:\'')
   diff = output.stdout.split(/\r?\n/) & blacklist
   describe diff do
     it { should be_empty }
   describe suid_check(blacklist) do
     its('diff') { should be_empty }
   end
 end

Ruby needs to execute the block to know that title and impact. Once you evaluate the context in ruby, it will be executed. Whenever you have something that is not quick to evaluate, you should use and inspec resource.

[artem-sidorenko]

@chris-rock Yes, its clear. I missed the point that command was outside of describe. Thanks!