TMAegis
gitlab のその他のルール

TMA-GITLAB-1.1.7

Ensure code owner's review is required when a change affects owned code

中レベル 1自動gitlab

説明

Ensure trusted code owners are required to review and approve any code change proposal made to their respective owned areas in the code base. Configuring code owners ensures that no code, especially code which could prove malicious, will slip into the source code or configuration files of a repository. This allows an organization to mark areas in the code base that are especially sensitive or more prone to an attack. It can also enforce review by specific individuals who are designated as owners to those areas so that they may filter out unauthorized or unwanted changes beforehand.

チェック方法

監査方法: シェルコマンド

shell
command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant
期待される出力
compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Prerequisites: - You must have at least the Maintainer role for the project. - To add a group as an approver in GitLab.com, you must be a member of the group or the group must be public. To add a merge request approval rule: 1. On the left sidebar, select Search or go to and find your project. 2. Select Settings > Merge requests. 3. In the Merge request approvals section, in the Approval rules section, select Add approval rule. 4. Complete the fields: o In Approvals required, a value of 0 makes the rule optional, and any number greater than 0 creates a required rule. Maximum number of required approvals is 100. o From Add approvers, select users or groups that are eligible to approve. GitLab suggests approvers based on previous authors of the files changed by the merge request. 5. Select Add approval rule. You can add multiple approval rules.

プロパティ

オペレーティングシステム
すべて
タグ
devsecopsgitlab
参照
CIS GitLab Benchmark v1.0.1 - 1.1.7 Ensure code owner's review is required when a change affects owned code

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell
tmaegis scan --target gitlab