Implement control blacklisting about kitchen-inspec HOT 5 CLOSED

@james-stocks is there any information on how to include a waiver into my .kichen.yml file?

I go to your link but all I see is information on how to run inspec with a waiver file from my command line, which isn't useful in this context. I search this repo for the word "waiver" and only get the two issues discussing this exact topic.

Edit:

I found a viable workaround. The controls input accepts a regex, so you can craft a regex using negative lookahead that excludes all of the tests you don't want to run. I didn't want to run sshd-44, so my .kitchen.yml verifier section has this:

  inspec_tests:
    - name: ssh
      git: https://github.com/dev-sec/ssh-baseline.git
  controls:
    - /^(?!sshd-44$).*/

You can skip multiple tests with a pipe:

  controls:
    - /^(?!sshd-44$|sshd-45$|sshd-46$).*/

It's a little ugly, but does exactly what I need here.

from kitchen-inspec.

I would also recommend using profile inheritance or the new waivers feature (if appropriate)

from kitchen-inspec.

@james-stocks is there any information on how to include a waiver into my .kichen.yml file?

Hey @RulerOf , sounds like you worked something out but here's an example of using a waiver file in your kitchen config:

verifier:
  name: inspec
  inspec_tests:
    - git: https://github.com/dev-sec/cis-dil-benchmark.git
  input_files:
    - <your waiver file>.yaml

It wasn't super intuitive to me at first, but the inspec documentation for the waiver file format says:

Waiver files are input files with a specific format:
...

though the above works, it can make the list a little confusing to read without committing to some sort of naming/path convention.

Hope that helps!

from kitchen-inspec.

I'm not sure but this could maybe help you, check the Skipping a Control from a Profile section

https://blog.chef.io/understanding-inspec-profile-inheritance/

from kitchen-inspec.

I would also recommend using profile inheritance or the new waivers feature (if appropriate)

Thanks for pointing out the new waiver feature!

from kitchen-inspec.