go.mondoo.com/cnquery@v0.0.0-20231005093811-59568235f6ea/mql/testdata/arch.toml

[mql]
providers = ["core", "os"]

[mondoo.""]
version = "unstable"
build = "development"

[command."uname -s"]
stdout = "Linux"

[command."uname -m"]
stdout = "x86_64"

[command."uname -r"]
stdout = "5.10.104-linuxkit"

[command."find -L \"/etc\" -xdev"]
stdout = """/etc/arch-release
/etc/ssh/sshd_config
"""

[command."find -L \"/etc/pam.d\" -xdev -type f"]
stdout = """/etc/pam.d/sshd
"""

[file."/etc/pam.d/sshd"]
content = """#%PAM-1.0
#auth     required  pam_securetty.so     #disable remote root
auth      include   system-remote-login
account   include   system-remote-login
"""

[file."/etc/arch-release"]
content = ""

[command."pacman -Q"]
stdout = """acl 2.3.1-2
archlinux-keyring 20220831-1
argon2 20190702-4
attr 2.5.1-2
audit 3.0.8-1
base 3-1
bash 5.1.016-1
brotli 1.0.9-8
bzip2 1.0.8-4
ca-certificates 20210603-1
ca-certificates-mozilla 3.82-1
ca-certificates-utils 20210603-1
coreutils 9.1-1
cryptsetup 2.5.0-1
curl 7.85.0-1
dbus 1.14.0-1
device-mapper 2.03.16-2
dnssec-anchors 20190629-3
e2fsprogs 1.46.5-4
expat 2.4.8-1
file 5.42-2
filesystem 2021.12.07-1
findutils 4.9.0-1
gawk 5.1.1-1
gcc-libs 12.2.0-1
gdbm 1.23-1
gettext 0.21-2
glib2 2.72.3-3
glibc 2.36-3
gmp 6.2.1-2
gnupg 2.2.39-1
gnutls 3.7.7-3
gpgme 1.18.0-1
grep 3.7-1
gzip 1.12-1
hwdata 0.361-1
iana-etc 20220715-1
icu 71.1-1
iproute2 5.19.0-1
iptables 1:1.8.8-2
iputils 20211215-1
json-c 0.16-1
kbd 2.5.1-1
keyutils 1.6.3-1
kmod 30-1
krb5 1.19.3-3
ldns 1.8.3-1
less 1:590-1
libarchive 3.6.1-2
libassuan 2.5.5-1
libbpf 0.8.1-1
libcap 2.65-1
libcap-ng 0.8.3-1
libedit 20210910_3.1-1
libelf 0.187-2
libevent 2.1.12-2
libffi 3.4.2-5
libgcrypt 1.10.1-1
libgpg-error 1.45-2
libidn2 2.3.3-1
libksba 1.6.0-1
libldap 2.6.3-1
libmnl 1.0.5-1
libnetfilter_conntrack 1.0.9-1
libnfnetlink 1.0.2-1
libnftnl 1.2.3-1
libnghttp2 1.49.0-1
libnl 3.7.0-1
libp11-kit 0.24.1-1
libpcap 1.10.1-2
libpsl 0.21.1-1
libsasl 2.1.28-1
libseccomp 2.5.4-1
libsecret 0.20.5-2
libssh2 1.10.0-1
libsysprof-capture 3.44.0-2
libtasn1 4.19.0-1
libtirpc 1.3.3-1
libunistring 1.0-1
libverto 0.3.2-4
libxcrypt 4.4.28-2
libxml2 2.10.2-2
licenses 20220125-1
linux-api-headers 5.18.15-1
lz4 1:1.9.4-1
mpfr 4.1.0.p13-3
ncurses 6.3-3
nettle 3.8.1-1
npth 1.6-3
openssh 9.0p1-1
openssl 1.1.1.q-1
p11-kit 0.24.1-1
pacman 6.0.1-7
pacman-mirrorlist 20220828-1
pam 1.5.2-1
pambase 20211210-1
pciutils 3.8.0-2
pcre 8.45-2
pcre2 10.40-1
pinentry 1.2.0-1
popt 1.18-3
procps-ng 3.3.17-1
psmisc 23.5-1
readline 8.1.002-1
sed 4.8-1
shadow 4.11.1-1
sqlite 3.39.2-2
systemd 251.4-1
systemd-libs 251.4-1
systemd-sysvcompat 251.4-1
tar 1.34-1
tpm2-tss 3.2.0-1
tzdata 2022c-1
util-linux 2.38.1-1
util-linux-libs 2.38.1-1
xz 5.2.6-1
zlib 1:1.2.12-2
zstd 1.5.2-7
"""

[file."/etc/ssh/sshd_config"]
content = """
# #
# Ansible managed
#

# This is the ssh client system-wide configuration file.
# See sshd_config(5) for more information on any settings used. Comments will be added only to clarify why a configuration was chosen.


# Basic configuration
# ===================

# Either disable or only allow root login via certificates.
PermitRootLogin no

# Define which port sshd should listen to. Default to `22`.
Port 22

# Address family should always be limited to the active network configuration.
AddressFamily inet

# Define which addresses sshd should listen to. Default to `0.0.0.0`, ie make sure you put your desired address in here, since otherwise sshd will listen to everyone.
ListenAddress 0.0.0.0

# List HostKeys here.
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Specifies the host key algorithms that the server offers.
#
# HostKeyAlgorithms
#

# Security configuration
# ======================

# Set the protocol version to 2 for security reasons. Disables legacy support.
Protocol 2

# Make sure sshd checks file modes and ownership before accepting logins. This prevents accidental misconfiguration.
StrictModes yes

# Logging, obsoletes QuietMode and FascistLogging
SyslogFacility AUTH
LogLevel VERBOSE

# Cryptography
# ------------

# **Ciphers** -- If your clients don't support CTR (eg older versions), cbc will be added
# CBC: is true if you want to connect with OpenSSL-base libraries
# eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
#

Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

# **Hash algorithms** -- Make sure not to use SHA1 for hashing, unless it is really necessary.
# Weak HMAC is sometimes required if older package versions are used
# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
#

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256

# Alternative setting, if OpenSSH version is below v5.9
#MACs hmac-ripemd160

# **Key Exchange Algorithms** -- Make sure not to use SHA1 for kex, unless it is really necessary
# Weak kex is sometimes required if older package versions are used
# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case.
# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf

KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256

# Authentication
# --------------

# Secure Login directives.

LoginGraceTime 30s
MaxAuthTries 2
MaxSessions 10
MaxStartups 10:30:60

# Enable public key authentication
PubkeyAuthentication yes

# Never use host-based authentication. It can be exploited.
IgnoreRhosts yes
IgnoreUserKnownHosts yes
HostbasedAuthentication no

# Enable PAM to enforce system wide rules
UsePAM yes

# Set AuthenticationMethods per default to publickey
# AuthenticationMethods was introduced in OpenSSH 6.2 - https://www.openssh.com/txt/release-6.2
AuthenticationMethods publickey

# Disable password-based authentication, it can allow for potentially easier brute-force attacks.
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no

# Only enable Kerberos authentication if it is configured.
KerberosAuthentication no
KerberosOrLocalPasswd no
KerberosTicketCleanup yes
#KerberosGetAFSToken no

# Only enable GSSAPI authentication if it is configured.
GSSAPIAuthentication no
GSSAPICleanupCredentials yes

# In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here. For key-based authentication this is not necessary, since all keys must be explicitely enabled.






# Network
# -------

# Disable TCP keep alive since it is spoofable. Use ClientAlive messages instead, they use the encrypted channel
TCPKeepAlive no

# Manage `ClientAlive..` signals via interval and maximum count. This will periodically check up to a `..CountMax` number of times within `..Interval` timeframe, and abort the connection once these fail.
ClientAliveInterval 300
ClientAliveCountMax 3

# Disable tunneling
PermitTunnel no

# Disable forwarding tcp connections.
# no real advantage without denied shell access
AllowTcpForwarding no

# Disable agent forwarding, since local agent could be accessed through forwarded connection.
# no real advantage without denied shell access
AllowAgentForwarding no

# Do not allow remote port forwardings to bind to non-loopback addresses.
GatewayPorts no

# Disable X11 forwarding, since local X11 display could be accessed through forwarded connection.
X11Forwarding no
X11UseLocalhost yes

# User environment configuration
# ==============================

PermitUserEnvironment no


# Misc. configuration
# ===================

Compression no

UseDNS no

PrintMotd no

PrintLastLog no

Banner none


# Reject keys that are explicitly blacklisted
RevokedKeys /etc/ssh/revoked_keys

"""


[file."/etc/login.defs"]
content = """FAIL_DELAY		3
LOG_UNKFAIL_ENAB	no
LOG_OK_LOGINS		no
SYSLOG_SU_ENAB		yes
SYSLOG_SG_ENAB		yes
CONSOLE		/etc/securetty
SU_NAME		su
MAIL_DIR	/var/spool/mail
HUSHLOGIN_FILE	.hushlogin
ENV_SUPATH	PATH=/usr/local/sbin:/usr/local/bin:/usr/bin
ENV_PATH	PATH=/usr/local/sbin:/usr/local/bin:/usr/bin
TTYGROUP	tty
TTYPERM		0600
ERASECHAR	0177
KILLCHAR	025
UMASK		077
PASS_MAX_DAYS	99999
PASS_MIN_DAYS	0
PASS_WARN_AGE	7
UID_MIN			 1000
UID_MAX			60000
SYS_UID_MIN		  500
SYS_UID_MAX		  999
GID_MIN			 1000
GID_MAX			60000
SYS_GID_MIN		  500
SYS_GID_MAX		  999
LOGIN_RETRIES		5
LOGIN_TIMEOUT		60
CHFN_RESTRICT		rwh
DEFAULT_HOME	yes
USERGROUPS_ENAB yes
MOTD_FILE
ENCRYPT_METHOD	SHA512
"""

[command."/sbin/lsmod"]
stdout = """Module                  Size  Used by
xfrm_user              36864  1
xfrm_algo              16384  1 xfrm_user
bpfilter               16384  0
vmw_vsock_virtio_transport    16384  14
vmw_vsock_virtio_transport_common    24576  1 vmw_vsock_virtio_transport
vsock                  36864  18 vmw_vsock_virtio_transport_common,vmw_vsock_virtio_transport
"""

[file."/etc/passwd"]
content = """root:x:0:0::/root:/bin/bash
chris:x:1000:1001::/home/chris:/bin/bash
christopher:x:1000:1001::/home/christopher:/bin/bash
chris:x:1002:1003::/home/chris:/bin/bash
bin:x:1:1::/:/usr/bin/nologin
"""
user = "user/0/root"
permissions = "-rw-r--r--"

[user."user/0/root"]
uid = 0
gid = 0
name = "root"

["file.permissions"."dr-xr-xr-x"]
mode = 555

["file.permissions"."-rw-r--r--"]
mode = 420

[file."/etc/group"]
content = """
cat /etc/group
root:x:0:root
chris:x:1001:
network:x:90:
wheel:x:998:
tty:x:5:
daemon:x:2:bin
"""

[file."/proc"]
permissions = "dr-xr-xr-x"

[file."/proc/1"]
permissions = "dr-xr-xr-x"

[file."/proc/1/cmdline"]
content = """/sbin/init"""

[file."/proc/1/status"]
content = """Name:	systemd
Umask:	0000
State:	S (sleeping)
Tgid:	1
Ngid:	0
Pid:	1
PPid:	0
TracerPid:	0
Uid:	0	0	0	0
Gid:	0	0	0	0
FDSize:	128
Groups:
NStgid:	1
NSpid:	1
NSpgid:	1
NSsid:	1
VmPeak:	  230536 kB
VmSize:	  165000 kB
VmLck:	       0 kB
VmPin:	       0 kB
VmHWM:	   10804 kB
VmRSS:	   10804 kB
RssAnon:	    2584 kB
RssFile:	    8220 kB
RssShmem:	       0 kB
VmData:	   18808 kB
VmStk:	     132 kB
VmExe:	     848 kB
VmLib:	    8576 kB
VmPTE:	      88 kB
VmSwap:	       0 kB
HugetlbPages:	       0 kB
CoreDumping:	0
THP_enabled:	1
Threads:	1
SigQ:	0/128147
SigPnd:	0000000000000000
ShdPnd:	0000000000000000
SigBlk:	7be3c0fe28014a03
SigIgn:	0000000000001000
SigCgt:	00000001800004ec
CapInh:	0000000000000000
CapPrm:	000001ffffffffff
CapEff:	000001ffffffffff
CapBnd:	000001ffffffffff
CapAmb:	0000000000000000
NoNewPrivs:	0
Seccomp:	0
Seccomp_filters:	0
Speculation_Store_Bypass:	thread vulnerable
SpeculationIndirectBranch:	conditional enabled
Cpus_allowed:	00000fff
Cpus_allowed_list:	0-11
Mems_allowed:	00000001
Mems_allowed_list:	0
voluntary_ctxt_switches:	5681
nonvoluntary_ctxt_switches:	116
"""

[file."/proc/sys/net/ipv4/ip_forward"]
content = "1"

[command."mount"]
stdout = """overlay on / type overlay (rw,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev type tmpfs (rw,nosuid,size=65536k,mode=755)
"""

[file."/etc/shadow"]
content = """root:!:14871::::::
chris:*:18421:0:99999:7:::
bin:!!:18360::::::
"""

[command."systemctl --all list-units --type service"]
stdout = """UNIT                                                                                     LOAD      ACTIVE   SUB       DESCRIPTION
  modprobe@drm.service                                                                     loaded    inactive dead      Load Kernel Module drm
  pacman-init.service                                                                      loaded    active   exited    Initializes Pacman keyring
● plymouth-quit-wait.service                                                               not-found inactive dead      plymouth-quit-wait.service
● plymouth-start.service                                                                   not-found inactive dead      plymouth-start.service
● reflector-init.service                                                                   loaded    failed   failed    Initializes mirrors for the VM
  rescue.service                                                                           loaded    inactive dead      Rescue Shell
  shadow.service                                                                           loaded    inactive dead      Verify integrity of password and group files
  sshd.service                                                                             loaded    active   running   OpenSSH Daemon
  sshdgenkeys.service                                                                      loaded    inactive dead      SSH Key Generation
● syslog.service                                                                           not-found inactive dead      syslog.service
"""

[command."ps axo pid,pcpu,pmem,vsz,rss,tty,stat,stime,time,uid,command"]
stdout = """    PID %CPU %MEM    VSZ   RSS TT       STAT STIME     TIME   UID COMMAND
1  0.0  1.1  26904 11128 ?        Ss   15:10 00:00:00     0 /sbin/init
2  0.0  0.0      0     0 ?        S    15:10 00:00:00     0 [kthreadd]
3  0.0  0.0      0     0 ?        I<   15:10 00:00:00     0 [rcu_gp]
4  0.0  0.0      0     0 ?        I<   15:10 00:00:00     0 [rcu_par_gp]
772  0.0  0.4  10736  4980 ?        R    15:12 00:00:00  1000 sshd: vagrant@pts/0
773  0.0  0.4   7476  4080 pts/0    Ss   15:12 00:00:00  1000 -bash
974  0.0  0.3   8716  3100 pts/0    R+   16:24 00:00:00     0 ps axo pid,pcpu,pmem,vsz,rss,tty,stat,stime,time,uid,command
"""

[file."/etc/ntp.conf"]
content="""
# --- GENERAL CONFIGURATION ---
restrict default ignore
restrict 66.187.224.4 mask 255.255.255.255 nomodify notrap noquery
restrict 18.26.4.105 mask 255.255.255.255 nomodify notrap noquery
restrict 128.249.1.10 mask 255.255.255.255 nomodify notrap noquery
# Server config
server 127.127.1.0 # local clock
fudge 127.127.1.0 stratum 10
server 66.187.224.4
server 18.26.4.105
server 128.249.1.10
"""

[file."/etc/audit/auditd.conf"]
content="""
# Some random comment...
local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
log_group = root
"""

[file."/root/pod.yaml"]
content="""
apiVersion: v1
kind: Pod
"""

[file."/home/chris/.ssh/authorized_keys"]
content="""
# Comment
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDYuKamN4JXNYmolm+A9hM+xYanupG1VgbM/k0NwPiIPUdiU82IPbP7bunsngnOatSDyCrKrhL9FV3wuHFFBX0QE9KpS8bcIcT3ySsi3wgYV95P7anb7YhliDDx2w/QB97kCnAKjGFS1yphS6px0i9B29tGVJa22ODs/hebIKUCYKC9/+fnZ+bIqte1HctDP2lDBzMa/7j8BUXSwnTDXtAuEz5eSMIpv1ZdUdaSuO8xFbB0xrBHQJKuqboLPo3NSOCg6uhopO6GucZuNLJnqVLkyEPTKH0nv/8smz/q3v1GOGz8ZS0DIpkretKZmRB1VDhNqsAiOAWUTmg56xO7VZnlEvQRtyG8qyQHjlj6SDGtvxPDY58lz5nhIV9K6L7gHrOIcbSif5ZCt0e4DrKGaYXgH+mwIh2TMC2OCU6Xr6FRVQ9fBhilqMXuFIIezShN0hZb6mUCLkLVOzBBRKuz17S2a8twsuxix7ixqJPsIF3sI88tbxrFkSGSM02dhrmyZbkMr586rktVBB4T+8A28HJr4l9jkU0uk3l3le5bMcXhEuDkJUBnwEXEXfZa8Lw4sg2VuFgw0Ah0kw0/mAorpsFahXstNgrHhy3HoPKDCw/a/sXL4+fE72I1L96Lb7HOxTrdhEGnd65W4mPlTnbGW9YDQqTfZgRlpuffqQuWWYXolw== chris@lollyrock.com
"""

[file."/etc/ssl/cert.pem"]
content="""
# Amazon Root CA 1
-----BEGIN CERTIFICATE-----
MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF
ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTEL
MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj
ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM
9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw
IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6
VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L
93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm
jgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3DQEBCwUA
A4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDI
U5PMCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUs
N+gDS63pYaACbvXy8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vv
o/ufQJVtMVT8QtPHRh8jrdkPSHCa2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU
5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpy
rqXRfboQnoZsG4q5WTP468SQvvG5
-----END CERTIFICATE-----
"""

[file."/dummy.json"]
content="""
{
  "_": null,
  "true": true,
  "1": 1,
  "1.0": 1.0,
  "int-array": [1,2,3],
  "dict": {
    "ee": 3,
    "ej": 4,
    "ek": 5
  },
  "f": [{"ff": 3}],
  "string-array": ["a", "b", "c"],
  "hello": "hello",
  "date": "2016-01-28T23:02:24Z",
  "aoa": [[1, 2], 3]
}
"""

[file."/dummy.array.json"]
content="""
[1,"hi",{"ll": 0},"z"]
"""

[file."/dummy.true.json"]
content="""true"""

[file."/dummy.false.json"]
content="""false"""

[file."/dummy.number.json"]
content="""1.23"""

[file."/dummy.string.json"]
content="""\"hi\""""

[file."/dummy.null.json"]
content="""null"""

[file."/dummy.plist"]
content="""
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>allowdownloadsignedenabled</key>
	<integer>1</integer>
	<key>allowsignedenabled</key>
	<integer>1</integer>
	<key>applications</key>
	<array/>
	<key>exceptions</key>
	<array>
		<dict>
			<key>path</key>
			<string>/usr/libexec/configd</string>
			<key>state</key>
			<integer>3</integer>
		</dict>
		<dict>
			<key>bundleid</key>
			<string>com.apple.EmbeddedOSInstallService</string>
			<key>path</key>
			<string>/System/Library/PrivateFrameworks/EmbeddedOSInstall.framework/Versions/A/XPCServices/EmbeddedOSInstallService.xpc/</string>
			<key>state</key>
			<integer>3</integer>
		</dict>
	</array>
	<key>explicitauths</key>
	<array>
		<dict>
			<key>id</key>
			<string>org.python.python.app</string>
		</dict>
		<dict>
			<key>id</key>
			<string>com.apple.ksh</string>
		</dict>
	</array>
	<key>firewall</key>
	<dict>
		<key>Apple Remote Desktop</key>
		<dict>
			<key>proc</key>
			<string>AppleVNCServer</string>
			<key>state</key>
			<integer>0</integer>
		</dict>
	</dict>
	<key>loggingenabled</key>
	<integer>1</integer>
	<key>version</key>
	<string>1.6</string>
</dict>
</plist>
"""