Cross-platform resources

These thirteen resource types dispatch on the probed platform, so a control built from them runs anywhere. Where behaviour differs by platform, the difference is noted on the attribute.

file

Path-addressed. Stats the path through the transport.

permissions accepts 0644, == 0600, <= 0644, >= 0700, <, >, and !=. A bare value means equality.

The content_match block:

check "shadow-perms" "file" {
  path        = "/etc/shadow"
  exists      = true
  owner       = "root"
  permissions = "<= 0640"

  content_match {
    pattern = "^root:[^!*]"
    negate  = true
  }
}

directory

Path-addressed. The same ownership and permission vocabulary as file, without content matching.

folder_contents

Path-addressed. Scans regular files directly inside a directory, not recursively, and evaluates content_match rules across them. A rule passes when any file satisfies it, which is what drop-in configuration directories such as /etc/ssh/sshd_config.d/ or /etc/sysctl.d/ need.

command

The address is the command line itself. This is the one resource subject to the allowed_commands gates on both the operator and profile sides.

check "kernel" "command" {
  cmd         = "uname -r"
  exit_status = 0

  stdout_match {
    pattern = "^6\\."
  }
}

The matched stream is attached to the check as observed evidence, recorded once rather than repeated per assertion. When both streams are asserted on, stdout takes the check-level slot. That stored output is not filtered, so a command that prints a secret puts that secret in the report.

process

Name-addressed. Unix filters ps aux by the name, and Windows has its own path.

service

Name-addressed. Unix uses systemctl is-active with a service ... status fallback, and Windows has its own path.

package

Name-addressed, dispatching on the target’s package manager.

The operator form matters. version = "8.9" substring-matches and would accept 18.9.1, while version = "== 8.9" compares segments properly. The accepted operators are ==, !=, <, <=, >, and >=.

user

Name-addressed. Unix reads getent passwd, and Windows has its own path.

port

Port-addressed. Unix probes ss -lnp with a netstat -lnp fallback.

kernel_param

Parameter-addressed, read via sysctl -n. On Windows it refuses with an explanatory assertion rather than a silent pass.

http

URL-addressed. Requests are made from the refpoint host, not from the scan target. This answers whether the endpoint is healthy as seen from here, not whether the target can reach it. Response bodies are read up to 1 MiB and redirects are followed at most three times.

A header assertion records the verdict, not the value: absent, matched, or present, did not match. Response headers carry session tokens and reports are commonly published, so the value never reaches the report. Body matches likewise store a pass or a fail, never the body.

json

Path-addressed. Reads the JSON file through the transport, so remote targets work, and asserts on nodes selected with a small jq-shaped syntax. Nothing has to be installed on the target and jq does not need to be in allowed_commands.

A selector is .a.b, .a[0], ."quoted-key", or . for the whole document. Iteration such as .a[] is not supported. Each query block can carry any of these assertions, and all of them must hold:

check "health" "json" {
  path = "/var/lib/app/health.json"

  query ".status" {
    equals = "healthy"
  }

  query ".components" {
    type   = "array"
    length = 8
  }

  query ".components[0].status" {
    equals = "healthy"
  }
}

A failing equals reports the mismatch, not the value, unless show_value is set. The file is read as a whole and parsed once, so several query blocks cost one read.

x509_certificate

Path-addressed. Reads the certificate file through the transport, so remote targets work, which is the difference from http.