Preventing unauthorized interaction between builds
CloudBees no longer supports CloudBees Jenkins Distribution as of February 24, 2021. Please refer to the following step-by-step documentation for Migrating from CloudBees Jenkins Distribution to Jenkins LTS. The increased alignment between CloudBees Jenkins Distribution and Jenkins means users will experience zero impact to Pipeline execution. Existing customers can also contact CloudBees Support to help ensure a smooth transition.
Please see About the CloudBees Jenkins Distribution retirement for more information.
CloudBees Jenkins Distribution customers may see Queue Authentication Warnings displayed in the user interface. These warnings read:
Builds in Jenkins run as the virtual SYSTEM user with full permissions by default. This can be a problem if some users have restricted or no access to some jobs, but can configure others. If that is the case, it is recommended to configure the system and jobs to prevent unauthorized interaction between builds.
CloudBees Jenkins Distribution version 2.176.x and later
CloudBees Jenkins Support version 2.176.x and later
This message is intended to alert administrators to potential escalation-of-privileges vulnerabilities. These vulnerabilities may occur when the system is configured with a permissions scheme that is more complex than a basic scheme like “all authenticated users are administrators” or “only one user is an administrator”.
This message indicates that under the current permissions scheme, the permissions that permit a user to configure and trigger one job may also permit the user to trigger another job, even if the UI would ordinarily prevent such an action. Depending on the configuration in Operations Center and/or on other masters, this may also permit a user to trigger a job on any other master in the same cluster.
Mitigating the issue involves a configuration philosophy that is called master-level isolation. Master-level isolation can be combined with restricted masters or job restrictions to prevent jobs from being triggered across masters.
Master-level isolation works best within CloudBees CI, which supports multi-master environments with SSO and a centralized user interface. CloudBees CI also offers features like Job Trigger Restrictions which can help you configure advanced restrictions for each instance.
Features for managing multiple teams with fine-grained permissions, either in a single master or in connected masters, are available in CloudBees CI, but not in CloudBees Jenkins Distribution or Jenkins.
However, there are some options for creating master-level isolation in CloudBees Jenkins Distribution or Jenkins:
CloudBees offers Docker and Marketplace images for CloudBees Jenkins Distribution, which you can use to quickly deploy multiple instances. For details on using the Marketplace images, see the blog post Start Using CloudBees Jenkins Distribution in the Cloud Today.