<commit_before>control 'KVM001' do
  impact 1.0
  title 'KVM images should have the correct modes'
  desc 'Permissions must be 0640 or more restrictive on image files.'
  tag 'controller', 'nova'
  tag remediation: 'ursula <env> site.yml --tags=nova'
  files = Dir.glob("/var/lib/libvirt/images/*")
  files.each do |file|
    describe file("#{file}") do
    its('mode') { should cmp '0640' }
    end
  end
end

control 'KVM002' do
  impact 1.0
  title '/dev/kvm should have the correct mode'
  desc 'Permission on /dev/kvm must be 660 or more restrictive, if this file exists. /dev/kvm must be owned by root and be in the kvm group'
  tag 'controller', 'nova'
  tag remediation: 'ursula <env> site.yml --tags=nova'
  describe file('/dev/kvm') do
    it { should exist }
    its('mode') { should cmp '0660' }
    its('group') { should eq 'kvm' }
  end
end

control 'KVM003' do
  impact 1.0
  title 'libvirt should be configured correctly'
  desc ' Disable listen_tcp.'
  tag 'controller', 'nova'
  tag remediation: 'ursula <env> site.yml --tags=nova'
  describe ini('/etc/libvirt/libvirtd.conf') do
    its('unix_sock_group') { should cmp "libvirt" }
    its('unix_sock_ro_perms') { should cmp "\"0770\"" }
    its('unix_sock_rw_perms') { should cmp "\"0770\"" }
    # The defaults should be fine
    its('listen_tcp') { should be_nil.or cmp "0" }
  end
end

control 'KVM004' do
  impact 1.0
  title 'qemu should be configured correctly'
  desc 'VNC must not listen on a public interface. Virtual machines must not run as root process'
  tag 'controller', 'nova'
  tag remediation: 'ursula <env> site.yml --tags=nova'
  describe ini('/etc/libvirt/qemu.conf') do
      its('user') { should cmp "qemu" }
      its('group') { should cmp "qemu" }
      # The defaults should be fine
      its('vnc_listen') { should be_nil.or cmp "\"127.0.0.1\"" }
      its('dynamic_ownership') { should be_nil.or cmp "1" }
  end
end<commit_msg>Fix checks to match regex<commit_after>control 'KVM001' do
  impact 1.0
  title 'KVM images should have the correct modes'
  desc 'Permissions must be 0640 or more restrictive on image files.'
  tag 'controller', 'nova'
  tag remediation: 'ursula <env> site.yml --tags=nova'
  files = Dir.glob("/var/lib/libvirt/images/*")
  files.each do |file|
    describe file("#{file}") do
    its('mode') { should cmp '0640' }
    end
  end
end

control 'KVM002' do
  impact 1.0
  title '/dev/kvm should have the correct mode'
  desc 'Permission on /dev/kvm must be 660 or more restrictive, if this file exists. /dev/kvm must be owned by root and be in the kvm group'
  tag 'controller', 'nova'
  tag remediation: 'ursula <env> site.yml --tags=nova'
  describe file('/dev/kvm') do
    it { should exist }
    its('mode') { should cmp '0660' }
    its('group') { should eq 'kvm' }
  end
end

control 'KVM003' do
  impact 1.0
  title 'libvirt should be configured correctly'
  desc ' Disable listen_tcp.'
  tag 'controller', 'nova'
  tag remediation: 'ursula <env> site.yml --tags=nova'
  describe ini('/etc/libvirt/libvirtd.conf') do
    its('unix_sock_group') { should match /^['"]libvirt['"]$/ }
    its('unix_sock_ro_perms') { should match /^['"]0770['"]$/ }
    its('unix_sock_rw_perms') { should match /^['"]0770['"]$/ }
    # The defaults should be fine
    its('listen_tcp') { should be_nil.or cmp "0" }
  end
end

control 'KVM004' do
  impact 1.0
  title 'qemu should be configured correctly'
  desc 'VNC must not listen on a public interface. Virtual machines must not run as root process'
  tag 'controller', 'nova'
  tag remediation: 'ursula <env> site.yml --tags=nova'
  describe ini('/etc/libvirt/qemu.conf') do
      its('user') { should match /^['"]qemu['"]$/ }
      its('group') { should match /^['"]qemu['"]$/ }
      # The defaults should be fine
      its('vnc_listen') { should be_nil.or match /^['"]127.0.0.1['"]$/ }
      its('dynamic_ownership') { should be_nil.or cmp "1" }
  end
end
{'fraction_non_alphanumeric': 0.14081632653061224, 'fraction_numerical': 0.026020408163265306, 'mean_word_length': 3.37123745819398, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '296835', 'n_tokens_mistral': 1453, 'n_tokens_neox': 1376, 'n_words': 455}