Ensure branch protection rules are enforced for administrators

高级别 1自动化gitlab

说明

Ensure administrators are subject to branch protection rules. Administrators by default are excluded from any branch protection rules. This means these privileged users (both on the repository and organization levels) are not subject to protections meant to prevent untrusted code insertion, including malicious code. This is extremely important since administrator accounts are often targeted for account hijacking due to their privileged role.

检查方式

审计方法: Shell 命令

shell

command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

GitLab administrators can disable this privilege for group owners, enforcing the instance-level protection rule: 1. On the left sidebar, at the bottom, select Admin Area. 2. Select Settings > Repository. 3. Expand the Default branch section. 4. Uncheck Allow owners to manage default branch protection per group checkbox. 5. Select Save changes.

属性

操作系统: 任意
标签: branch-protectiondevsecopsgitlab
参考: CIS GitLab Benchmark v1.0.1 - 1.1.14 Ensure branch protection rules are enforced for administrators

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target gitlab