Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: modified too many admins policy from flat number to percentage based #318

Merged
merged 6 commits into from
Jul 8, 2024
Merged

feat: modified too many admins policy from flat number to percentage based #318

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1258aa2
modified too many admins policy from flat number to percentage based
Tal-Legit Jun 27, 2024
2337eab
type
Tal-Legit Jun 30, 2024
b2141c7
Update repository.rego
Tal-Legit Jul 1, 2024
8c6cbe9
Update repository.rego
Tal-Legit Jul 1, 2024
a36bdc3
Merge branch 'main' into feat/admins-per-user
Tal-Legit Jul 8, 2024
2f09278
changed wording
Tal-Legit Jul 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions policies/github/repository.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,8 @@ repository_not_maintained := false {
}
# METADATA
# scope: rule
# title: Repository Should Have Fewer Than Three Admins
# description: Repository admins are highly privileged and could create great damage if they are compromised. It is recommended to limit the number of Repository Admins to the minimum required (recommended maximum 3 admins).
# title: Repository Should Have A Low Admin Count
# description: Repository admins are highly privileged and could create great damage if they are compromised. It is recommended to limit the number of repository admins to the minimum required, and no more than 5% of the userbase (Up to 3 admins are always allowed).
# custom:
# severity: LOW
# remediationSteps:
Expand All @@ -49,7 +49,10 @@ default repository_has_too_many_admins := true

repository_has_too_many_admins := false {
admins := [admin | admin := input.collaborators[_]; admin.permissions.admin]
count(admins) <= 3
adminNum := count(admins)
userNum := count(input.collaborators)
maxAdmins := max([3, ceil(userNum * 0.05)])
adminNum <= maxAdmins
}

# METADATA
Expand Down Expand Up @@ -739,4 +742,4 @@ default secret_scanning_not_enabled := true

secret_scanning_not_enabled := false{
input.security_and_analysis.secret_scanning.status == "enabled"
}
}
9 changes: 6 additions & 3 deletions policies/gitlab/repository.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,8 @@ project_not_maintained := false {

# METADATA
# scope: rule
# title: Project Should Have Fewer Than Three Owners
# description: Projects owners are highly privileged and could create great damage if they are compromised. It is recommended to limit the number of Project Owners to the minimum required (recommended maximum 3 admins).
# title: Project Should Have A Low Owner Count
# description: Projects owners are highly privileged and could create great damage if they are compromised. It is recommended to limit the number of Project Owners to the minimum required, and no more than 5% of the userbase (Up to 3 owners are always allowed).
# custom:
# severity: LOW
# remediationSteps:
Expand All @@ -41,7 +41,10 @@ default project_has_too_many_admins := true

project_has_too_many_admins := false {
admins := [admin | admin := input.members[_]; admin.access_level == 50]
count(admins) <= 3
adminNum := count(admins)
userNum := count(input.members)
maxAdmins := max([3, ceil(userNum * 0.05)])
adminNum <= maxAdmins
}

# METADATA
Expand Down
16 changes: 13 additions & 3 deletions test/repository_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,11 +403,21 @@ func TestGitlabRepositoryTooManyAdmins(t *testing.T) {
}
}

tmpMember := &gitlab2.ProjectMember{
tmpAdminMember := &gitlab2.ProjectMember{
AccessLevel: 50,
}
trueCase := []*gitlab2.ProjectMember{tmpMember, tmpMember, tmpMember, tmpMember}
falseCase := []*gitlab2.ProjectMember{tmpMember, tmpMember}
tmpRegMember := &gitlab2.ProjectMember{
AccessLevel: 20,
}
trueCase := []*gitlab2.ProjectMember{tmpAdminMember, tmpAdminMember, tmpAdminMember, tmpAdminMember}
for i := 0; i < 10; i++ {
trueCase = append(trueCase, tmpRegMember)
}
falseCase := []*gitlab2.ProjectMember{tmpAdminMember, tmpAdminMember, tmpAdminMember, tmpAdminMember}
for i := 0; i < 57; i++ {
falseCase = append(falseCase, tmpRegMember)
}

options := map[bool][]*gitlab2.ProjectMember{
false: falseCase,
true: trueCase,
Expand Down
Loading