Preventing unauthorized interaction between builds

2 minute read

CloudBees no longer supports CloudBees Jenkins Distribution as of February 24, 2021. Please refer to the following step-by-step documentation for Migrating from CloudBees Jenkins Distribution to Jenkins LTS. The increased alignment between CloudBees Jenkins Distribution and Jenkins means users will experience zero impact to Pipeline execution. Existing customers can also contact CloudBees Support to help ensure a smooth transition.

Please see About the CloudBees Jenkins Distribution retirement for more information.

CloudBees Jenkins Distribution customers may see Queue Authentication Warnings displayed in the user interface. These warnings read:

Builds in Jenkins run as the virtual SYSTEM user with full permissions by default. This can be a problem if some users have restricted or no access to some jobs, but can configure others. If that is the case, it is recommended to configure the system and jobs to prevent unauthorized interaction between builds.

Affected environments

  • CloudBees Jenkins Distribution version 2.176.x and later

  • CloudBees Jenkins Support version 2.176.x and later

What the message means

This message is intended to alert administrators to potential escalation-of-privileges vulnerabilities. These vulnerabilities may occur when the system is configured with a permissions scheme that is more complex than a basic scheme like “all authenticated users are administrators” or “only one user is an administrator”.

This message indicates that under the current permissions scheme, the permissions that permit a user to configure and trigger one job may also permit the user to trigger another job, even if the UI would ordinarily prevent such an action. Depending on the configuration in operations center and/or on other controllers, this may also permit a user to trigger a job on any other controller in the same cluster.

Mitigating the problem

Mitigating the issue involves a configuration philosophy that is called controller-level isolation. Controller-level isolation can be combined with restricted controllers or job restrictions to prevent jobs from being triggered across controllers.

Configuring master-level isolation

Master-level isolation works best within CloudBees CI, which supports multi-master environments with SSO and a centralized user interface. CloudBees CI also offers features like Job Trigger Restrictions which can help you configure advanced restrictions for each instance.

Features for managing multiple teams with fine-grained permissions, either in a single master or in connected masters, are available in CloudBees CI, but not in CloudBees Jenkins Distribution or Jenkins.

However, there are some options for creating master-level isolation in CloudBees Jenkins Distribution or Jenkins: