Project: Chef InSpec (Provisioning / Security & Compliance)
File: oracledb_session.md

+++ title = "oracledb_session resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "oracledb_session" identifier = "inspec/resources/os/oracledbsession.md oracledbsession resource" parent = "inspec/resources/os" +++ Use the `oracledb_session` Chef InSpec audit resource to test SQL commands run against a Oracle database. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. A `oracledb_session` resource block declares the username and PASSWORD to use for the session with an optional service to connect to, and then the command to be run: describe oracledb_session(user: 'username', PASSWORD: 'PASSWORD', service: 'ORCL.localdomain').query('QUERY').row(0).column('result') do its('value') { should eq('') } end where `oracledb_session` declares a username and PASSWORD with permission to run the query (required), and an optional parameters for host (default: `localhost`), system identifier (SID) (default: `nil`), which uses the default SID, and path to the sqlplus binary (default: `sqlplus`). it is possible to run queries as sysdba/sysoper by using `asdbrole option`, see examples SQLcl can be used in place of sqlplus. Use the `sqlclbin` option to set the sqlcl binary path instead of `sqlplusbin`. `query('QUERY')` contains the query to be run `its('value') { should eq('') }` compares the results of the query against the expected result in the test rows the query result as array of hashes row(number) selected row from query result, where number is just a row number in the query result column(name) array with values from selected column The following examples show how to use this Chef InSpec audit resource. sql = oracledb_session(user: 'USERNAME', pass: 'PASSWORD') describe sql.query('SELECT NAME AS VALUE FROM v$database;').row(0).column('value') do its('value') { should cmp 'ORCL' } end sql = oracledbsession(user: 'USERNAME', pass: 'PASSWORD', host: 'ORACLEHOST', sid: 'ORACLESID', sqlplusbin: '/u01/app/oracle/product/12.1.0/dbhome_1/bin/sqlplus') describe sql.query('SELECT NAME FROM v$database;').row(0).column('name') do its('value') { should cmp 'ORCL' } end sql = oracledbsession(user: 'USERNAME', pass: 'PASSWORD', service: 'ORACLESID') describe sql.query('SELECT * FROM my_table;').column('COLUMN') do it { should include 'my_value' } end The check will change user (with su) to specified user and run 'sqlplus / as sysdba' (sysoper, sysasm) sql = oracledbsession(asosuser: 'oracle', asdbrole: 'sysdba', service: 'ORACLESID') describe sql.query('SELECT tablespacename AS name FROM dbatablespaces;').column('name') do it { should include 'TABLE_SPACE' } end NOTE: option `asosuser` available only on unix-like systems and not supported on Windows. Also this option requires that you are running inspec as `root` or with `--sudo` sql = oracledb_session(user: 'USERNAME', pass: 'PASSWORD') describe sql.query('SELECT * FROM my_table;').rows do its('count') { should eq 20 } end sql = oracledbsession(user: 'USERNAME', pass: 'PASSWORD', host: 'my.remote.db', service: 'ORACLESID') sql.query('SELECT * FROM files;').rows.each do |file_row| describe file(file_row['path']) do its('owner') { should eq file_row['owner']} end end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}