[JIRA] (JENKINS-14750) Unprivileged view permissions for monitoring

[mcirtain@gmail.com (JIRA)]

Melissa Cirtain commented on JENKINS-14750

Re: Unprivileged view permissions for monitoring +1 Add Comment

This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c)

[s.austermuehle@hse24.de (JIRA)]

Stephan Austermühle commented on JENKINS-14750

Re: Unprivileged view permissions for monitoring

+1 Just received the request from one of our dev team members to view monitoring data which surprinsgly isn't possible without admin permissions.

Add Comment

[o.v.nenashev@gmail.com (JIRA)]

Oleg Nenashev commented on JENKINS-14750

Re: Unprivileged view permissions for monitoring

-1 for the Unprivileged access as a Jenkins Security team member. It is not only about gc() invocation. Operations like HeapDump collection may actually expose sensitive information. Thread termination by users may also cause cause significant damage. Etc. The thing which could be done is a special permission (e.g. "Computer.VIEW_MONITORING" impled By "Jenkins.ADMINISTER") with appropriate disclaimer in the documentation.

Add Comment

This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e)

[belfast77@gmail.com (JIRA)]

Belfast 77 commented on JENKINS-14750

Re: Unprivileged view permissions for monitoring

+1

Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)