Package io.jenkins.plugins.batchcontrol.security

Class SystemBuildCheck

java.lang.Object
io.jenkins.plugins.batchcontrol.security.SystemBuildCheck
@Restricted(org.kohsuke.accmod.restrictions.NoExternalUse.class) public final class SystemBuildCheck extends Object
D-50, D-50a (SPEC item 2, e2e-03 DEF-37, security-21): whether builds on this instance may run as SYSTEM although change control is on.

"May run as SYSTEM" also covers an identity that holds Overall/Administer, or Item/Configure at the root, in the installed strategy without any Batch Control grant (D-50b): the D-35b guard does not revert a save by such an identity. Authenticators that decide by something the probe cannot represent (the job's name, folder or type, or the calling identity) are not judged (D-50b, a documented limitation).

A job's own build authorization does not protect it (a Configure holder can remove it, and a strategy that follows the triggering user leaves timer and SCM builds as SYSTEM). So one instance-wide question is asked: would a build of a job that has no build authorization of its own and no user cause get an identity other than SYSTEM from the configured authenticators?

The question is asked the way the queue asks it, Queue.Item.authenticate2(): every QueueItemAuthenticatorProvider's authenticators in order, the first identity wins, and without one the task's default, SYSTEM for a job. The probe is an in-memory FreeStyleProject that is never added to Jenkins, saved or scheduled, wrapped in a Queue.WaitingItem that never enters the queue and carries no cause. Nothing is scheduled and no listener fires. Constructing the item takes one queue id from QueueIdStrategy (core's own QueueItemAuthenticator#authenticate2(Queue.Task) does the same, and Queue.Item cannot be subclassed outside core); with the cache below that is at most one id per 5L minutes (S-21-07).

The probe runs in one fixed context, as anonymous, whoever renders the page, so an authenticator that consults the current authentication answers the same on every path (S-21-07). No ACL.SYSTEM2 switch is made. An authenticator that fails counts as "SYSTEM" (fail-safe). The answer is cached for 5L minutes and recomputed at once when the set of configured authenticators changes (a save of the global security page replaces them), so the monitor's isActivated() does not probe on every page (S-21-06).

  • Method Details

    • buildsMayRunAsSystem

      public static boolean buildsMayRunAsSystem()
      Whether, with change control on, a build of a job without its own build authorization and without a user cause would get no identity other than SYSTEM from the configured authenticators. false while change control is off. Cached; never throws.