Ensure branch protection rules are enforced for administrators

高レベル 1自動gitlab

説明

Ensure administrators are subject to branch protection rules. Administrators by default are excluded from any branch protection rules. This means these privileged users (both on the repository and organization levels) are not subject to protections meant to prevent untrusted code insertion, including malicious code. This is extremely important since administrator accounts are often targeted for account hijacking due to their privileged role.

チェック方法

監査方法: シェルコマンド

shell

command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

GitLab administrators can disable this privilege for group owners, enforcing the instance-level protection rule: 1. On the left sidebar, at the bottom, select Admin Area. 2. Select Settings > Repository. 3. Expand the Default branch section. 4. Uncheck Allow owners to manage default branch protection per group checkbox. 5. Select Save changes.

プロパティ

オペレーティングシステム: すべて
タグ: branch-protectiondevsecopsgitlab
参照: CIS GitLab Benchmark v1.0.1 - 1.1.14 Ensure branch protection rules are enforced for administrators

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target gitlab