TMAegisBeta
更多 gitlab 規則

GitLab

TMA-GITLAB-1.1.7

Ensure code owner's review is required when a change affects owned code

中等級 1自動化gitlab

說明

Ensure trusted code owners are required to review and approve any code change proposal made to their respective owned areas in the code base. Configuring code owners ensures that no code, especially code which could prove malicious, will slip into the source code or configuration files of a repository. This allows an organization to mark areas in the code base that are especially sensitive or more prone to an attack. It can also enforce review by specific individuals who are designated as owners to those areas so that they may filter out unauthorized or unwanted changes beforehand.

檢查方式

稽核方法: Shell 指令

shell
command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant
預期輸出
compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Prerequisites: - You must have at least the Maintainer role for the project. - To add a group as an approver in GitLab.com, you must be a member of the group or the group must be public. To add a merge request approval rule: 1. On the left sidebar, select Search or go to and find your project. 2. Select Settings > Merge requests. 3. In the Merge request approvals section, in the Approval rules section, select Add approval rule. 4. Complete the fields: o In Approvals required, a value of 0 makes the rule optional, and any number greater than 0 creates a required rule. Maximum number of required approvals is 100. o From Add approvers, select users or groups that are eligible to approve. GitLab suggests approvers based on previous authors of the files changed by the merge request. 5. Select Add approval rule. You can add multiple approval rules.

屬性

作業系統
不限
標籤
devsecopsgitlab
參考資料
CIS GitLab Benchmark v1.0.1 - 1.1.7 Ensure code owner's review is required when a change affects owned code

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell
tmaegis scan --target gitlab