Preventing unauthorized interaction between builds

CloudBees Jenkins Distribution customers may see Queue Authentication Warnings displayed in the user interface. These warnings read:

Builds in Jenkins run as the virtual SYSTEM user with full permissions by default. This can be a problem if some users have restricted or no access to some jobs, but can configure others. If that is the case, it is recommended to configure the system and jobs to prevent unauthorized interaction between builds.

Affected environments

  • CloudBees Jenkins Distribution version 2.176.x and later

  • CloudBees Jenkins Support version 2.176.x and later

What the message means

This message is intended to alert administrators to potential escalation-of-privileges vulnerabilities. These vulnerabilities may occur when the system is configured with a permissions scheme that is more complex than a basic scheme like “all authenticated users are administrators” or “only one user is an administrator”.

This message indicates that under the current permissions scheme, the permissions that permit a user to configure and trigger one job may also permit the user to trigger another job, even if the UI would ordinarily prevent such an action. Depending on the configuration in Operations Center and/or on other masters, this may also permit a user to trigger a job on any other master in the same cluster.

Mitigating the problem

Mitigating the issue involves a configuration philosophy that is called master-level isolation. Master-level isolation can be combined with restricted masters or job restrictions to prevent jobs from being triggered across masters.

Configuring master-level isolation

Master-level isolation works best within CloudBees CI, which supports multi-master environments with SSO and a centralized user interface. CloudBees CI also offers features like Job Trigger Restrictions which can help you configure advanced restrictions for each instance.

Features for managing multiple teams with fine-grained permissions, either in a single master or in connected masters, are available in CloudBees CI, but not in CloudBees Jenkins Distribution or Jenkins.

However, there are some options for creating master-level isolation in CloudBees Jenkins Distribution or Jenkins: