feat(osbaseline): support validation for cpu vulnerabilities

Detects if vulnerabilities directory exists. If so checks all the files inside if any.

Signed-off-by: imjoseangel <josea.munoz@gmail.com>

Author: imjoseangel

controls/os_spec.rb

@@ -37,6 +37,8 @@
   description: 'blacklist of suid/sgid program on system'
 )
 
+cpuvulndir = '/sys/devices/system/cpu/vulnerabilities/'
+
 control 'os-01' do
   impact 1.0
   title 'Trusted hosts login'
@@ -236,3 +238,23 @@
     its(:group) { should match(/^root|syslog$/) }
   end
 end
+
+control 'os-12' do
+  impact 1.0
+  title 'Detect vulnerabilities in the cpu-vulnerability-directory'
+  desc 'Check for known cpu vulnerabilities described here: https://www.kernel.org/doc/html/v5.6/admin-guide/hw-vuln/index.html'
+
+  if file(cpuvulndir).exist?
+    describe file(cpuvulndir) do
+      it { should be_directory }
+    end
+
+    loaded_files = command('find ' + cpuvulndir + ' -type f -maxdepth 1').stdout.split(/\n/).map(&:strip).find_all { |vulnfiles| !vulnfiles.empty? }
+
+    loaded_files.each do |vulnfile|
+      describe file(vulnfile) do
+        its('content') { should_not match /vulnerable/ }
+      end
+    end
+  end
+end