TMA-GITLAB-2.2.3
Ensure the duties of each build worker are segregated
Description
Separate responsibilities in the build workflow, such as testing, compiling, pushing artifacts, etc., to different build workers so that each worker will have a single duty. Separating duties and allocating them to many workers makes it easier to verify each step in the build process and ensure there is no corruption. It also limits the effect of an attack on a build worker, as such an attack would be less critical if the worker has less access and duties that are subject to harm.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
To ensure separation of duties, you can have runner only running jobs for a specific project or a specific group. For a group: - On the left sidebar, select Search or go to and find your group. - Select Settings > CI/CD. - Expand the Runners section. - Review the Runners related to your specific group. For a project: - On the left sidebar, select Search or go to and find your project. - Select Settings > CI/CD. - Expand the Runners section. - Review the Runners related to your specific project.
How it is fixed
Fix method: Guidance or infrastructure patch
To ensure separation of duties, create runners dedicated to a single group or project. For a group: - On the left sidebar, select Search or go to and find your group. - Select Build > Runners. - Select New group runner. - Select the operating system where GitLab Runner is installed. - In the Tags section, in the Tags field, enter the job tags to specify jobs the runner can run. If there are no job tags for this runner, select Run untagged. - Optional. In the Runner description field, add a runner description that displays in GitLab. - Optional. In the Configuration section, add additional configurations. - Select Create runner. - Follow the on-screen instructions to register the runner from the command line. When prompted by the command line: o For the GitLab instance URL, use the URL for your GitLab instance. For example, if your project is hosted on gitlab.example.com/yourname/yourproject, your GitLab instance URL is https://gitlab.example.com. o For the executor, enter the type of executor. The executor is the environment where the runner executes the job. For a project: - On the left sidebar, select Search or go to and find your project. - Select Settings > CI/CD. - Expand t...
Properties
- Operating systems
- Any
- Tags
- devsecopsgitlab
- Reference
- CIS GitLab Benchmark v1.0.1 - 2.2.3 Ensure the duties of each build worker are segregated