GitLab
TMA-GITLAB-1.1.6
Ensure code owners are set for extra sensitive code or configuration
Description
Code owners are trusted users that are responsible for reviewing and managing an important piece of code or configuration. An organization is advised to set code owners for every extremely sensitive code or configuration. Configuring code owners protects data by verifying that trusted users will notice and review every edit, thus preventing unwanted or malicious changes from potentially compromising sensitive code or configurations.
How it is checked
Audit method: Shell command
command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Prerequisite: You must be able to either push to the default branch or create a merge request. 1. Create a CODEOWNERS file in your preferred location. 2. Define some rules in the file following the Code Owners syntax reference. Some suggestions: o Configure All eligible approvers approval rule. o Require Code Owner approval on a protected branch. 3. Commit your changes, and push them up to GitLab.
Properties
- Operating systems
- Any
- Tags
- devsecopsgitlab
- Reference
- CIS GitLab Benchmark v1.0.1 - 1.1.6 Ensure code owners are set for extra sensitive code or configuration
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target gitlab