Add resource type linux_audit_system

[aschmidt75]

Allow checking the configuration of linux audit system via /sbin/auditctl. Suitable for server hardening.

be_running

To make sure that the audit system is running.

describe linux_audit_system do
  it { should be_running }
end

be_enabled

To make sure that the audit system is enabled (mode '1').

describe linux_audit_system do
  it { should be_enabled }
end

have_audit_rule

To check that auditd has a given auditing rule. Argument can be a string for equality comparison or a regular expression.

describe linux_audit_system do
  it { should have_audit_rule '-w /etc/audit/ -p wa' }
  it { should have_audit_rule '-w /var/lib/ -p wa' }
  it { should have_audit_rule /\/var\/lib\// }
  it { should_not have_audit_rule /\/var\/log\// }
end

[mizzy]

Thanks!

I think have_audit_rule is not needed. It can be substituted like this.

describe linux_audit_system do
  its(:rules) { should include '-w /etc/audit/ -p wa' }
  its(:rules) { should include '-w /var/lib/ -p wa' }
  its(:rules) { should include %r!/var/lib/! }
  its(:rules) { should_not include %r!/var/log! }
end

We should use standard RSpec matchers as much as we can.

And tests failed in Ruby 1.8.7. Please fix this.
https://travis-ci.org/mizzy/serverspec/builds/74105963

[aschmidt75]

Thanks for the hints, implemented it as suggested, 1.8.7 is ok now.

rules

To check that auditd has a given auditing rule. Argument can be a string for equality comparison or a regular expression.

describe linux_audit_system do
  its(:rules) { should include '-w /etc/audit/ -p wa' }
  its(:rules) { should include '-w /var/lib/ -p wa' }
  its(:rules) { should include %r!/var/lib/! }
  its(:rules) { should_not include %r!/var/log! }
end

[mizzy]

This should be a public method.

[mizzy]

LGTM!

[mizzy]

Released as v2.21.0.

[aschmidt75]

Great, thanks for merging! I'm going to provide docs within the next days.