TMAegisBeta
更多 gitlab 规则

GitLab

TMA-GITLAB-1.1.7

Ensure code owner's review is required when a change affects owned code

中级别 1自动化gitlab

说明

Ensure trusted code owners are required to review and approve any code change proposal made to their respective owned areas in the code base. Configuring code owners ensures that no code, especially code which could prove malicious, will slip into the source code or configuration files of a repository. This allows an organization to mark areas in the code base that are especially sensitive or more prone to an attack. It can also enforce review by specific individuals who are designated as owners to those areas so that they may filter out unauthorized or unwanted changes beforehand.

检查方式

审计方法: Shell 命令

shell
command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant
预期输出
compliant

修复方式

修复方法: 操作指南或基础设施补丁

Prerequisites: - You must have at least the Maintainer role for the project. - To add a group as an approver in GitLab.com, you must be a member of the group or the group must be public. To add a merge request approval rule: 1. On the left sidebar, select Search or go to and find your project. 2. Select Settings > Merge requests. 3. In the Merge request approvals section, in the Approval rules section, select Add approval rule. 4. Complete the fields: o In Approvals required, a value of 0 makes the rule optional, and any number greater than 0 creates a required rule. Maximum number of required approvals is 100. o From Add approvers, select users or groups that are eligible to approve. GitLab suggests approvers based on previous authors of the files changed by the merge request. 5. Select Add approval rule. You can add multiple approval rules.

属性

操作系统
任意
标签
devsecopsgitlab
参考
CIS GitLab Benchmark v1.0.1 - 1.1.7 Ensure code owner's review is required when a change affects owned code

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell
tmaegis scan --target gitlab