[JIRA] [groovy-postbuild-plugin] (JENKINS-32681) Option to disable script security approval

It seems that permissive plugin does not help.

For example extended-choice-plugin goes directly to ScriptApproval which checks allowed hashes:

 
                                                                try {
    scriptApproval.configuring(groovyScript, GroovyLanguage.get(), ApprovalContext.create());
    scriptApproval.using(groovyScript, GroovyLanguage.get()); 
} catch(UnapprovedUsageException uUE) {
    result = false;
} catch(UnapprovedClasspathException uCE) {
    result = false;
}
 
                                                            

That would be great either to auto approve all scripts (or with some conditions) or approve scripts without user interation (i.e. with web service endpoint).

This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c)

VictorMartinezRubio@gmail.com (JIRA)

unread,

Oct 17, 2016, 9:42:07 AM10/17/16

to jenkinsc...@googlegroups.com

Victor Martinez commented on

Hi there,

I've tried to setup : Permissive Script Security Plugin to disable this security approval process but still same issue

                                                                groovy setup
                                                            
                                                                System.setProperty("org.jenkinsci.plugins.permissivescriptsecurity.PermissiveWhitelist.enabled","true")

                                                                java opts
                                                            
                                                                -Dpermissive-script-security.enabled=true

                                                                groovy postbuild stuff
                                                            
 
                                                                pattern = ~/^FOUND_EXPIRED_.*/
manager.build.logFile.eachLine { line ->
    matcher = pattern.matcher(line)
    if(matcher.matches()) {
        manager.buildUnstable()
    }
}
 
                                                            

                                                                log error

ERROR: Failed to evaluate groovy script.
org.jenkinsci.plugins.scriptsecurity.scripts.UnapprovedUsageException: script not yet approved for

 use
	at org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.using(ScriptApproval.java:459)
	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:168)
	at org.jvnet.hudson.plugins.groovypostbuild.GroovyPostbuildRecorder.perform(GroovyPostbuildRecorder.java:362)
	at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
	at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:779)
	at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:720)
	at hudson.model.Build$BuildExecution.post2(Build.java:185)
	at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:665)
	at hudson.model.Run.execute(Run.java:1745)
	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
	at hudson.model.ResourceController.execute(ResourceController.java:98)
	at hudson.model.Executor.run(Executor.java:404)
 
                                                            

Configuration:

script-security 1.21
groovy 1.29
groovy-postbuild
permissive-script-security 0.1
jenkins 2.19.1

Any ideas?

dbeck@cloudbees.com (JIRA)

unread,

Oct 17, 2016, 10:12:01 AM10/17/16

to jenkinsc...@googlegroups.com

Daniel Beck commented on

Victor Martinez Looks like you may need to enable the sandbox rather than have whole-script approval?

owood@cloudbees.com (JIRA)

unread,

Oct 17, 2016, 6:18:03 PM10/17/16

to jenkinsc...@googlegroups.com

Owen Wood reopened an issue

This also affects Additonal Classpath - Classpath Entries.

 
                                                                Groovy script failed:
org.jenkinsci.plugins.scriptsecurity.scripts.UnapprovedClasspathException: classpath entry

Enabling sandbox does not help

System.setProperty("org.jenkinsci.plugins.permissivescriptsecurity.PermissiveWhitelist.enabled","true") does not help

Jenkins /

Option to disable script security approval

Change By:	Owen Wood
Resolution:	Not A Defect
Status:	Resolved Reopened

jglick@cloudbees.com (JIRA)

unread,

Oct 17, 2016, 7:34:04 PM10/17/16

to jenkinsc...@googlegroups.com

Jesse Glick resolved as Not A Defect

Owen Wood not sure what you are seeing exactly but sounds unrelated; perhaps JENKINS-37599.

Jenkins /

Option to disable script security approval

Change By:	Jesse Glick
Status:	Reopened Resolved
Resolution:	Not A Defect

VictorMartinezRubio@gmail.com (JIRA)

unread,

Oct 18, 2016, 12:57:01 PM10/18/16

to jenkinsc...@googlegroups.com

Victor Martinez commented on

Daniel Beck, it works fine after using the sandbox checkbox as you suggested, thanks so much. I did assume something else about the sandbox flag. Sorry about this false alarm

Thanks again

prince96raj@gmail.com (JIRA)

unread,

May 1, 2018, 6:23:03 AM5/1/18

to jenkinsc...@googlegroups.com

Prince Raj Kumar commented on

One of the work-around might be using authorize-project plugin. It is working in my case.

Just need to configure the build execution with admin user. Configuration detail steps has given on the plugin page.

This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e)

prince96raj@gmail.com (JIRA)

unread,

May 1, 2018, 6:34:03 AM5/1/18

to jenkinsc...@googlegroups.com

Prince Raj Kumar edited a comment on

One of the work-around might be using authorize-project plugin. It is working in my case.

Just need to configure the build execution with admin user. Configuration detail steps has given on the plugin page.

Plugin wiki link: https://wiki.jenkins.io/display/JENKINS/Authorize+Project+plugin

mksd@mekomsolutions.com (JIRA)

unread,

Oct 18, 2018, 4:08:02 AM10/18/18

to jenkinsc...@googlegroups.com

Dimitri R commented on

Looks like you may need to enable the sandbox rather than have whole-script approval?

Thanks Daniel Beck, this hint put me on the right track. So I had this one Groovy script that I use in a job to trigger downstream jobs (with hudson.model.Hudson.instance.queue.schedule(..)), this required it to not be sandboxed and to be approved. The latter was problematic in my automation context.

What worked for me on Jenkins 2.141 was

Install the Permissive Script Security plugin 0.3.
Start Jenkins with the Java option -Dpermissive-script-security.enabled=true.
Note that I'm using the Docker container so here is how I do that:
```
ENV JAVA_OPTS="-Dpermissive-script-security.enabled=true"
```
Sandbox the script.

This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

jglick@cloudbees.com (JIRA)

unread,

Oct 18, 2018, 9:51:03 AM10/18/18

to jenkinsc...@googlegroups.com

Jesse Glick commented on

I had this one Groovy script that I use in a job to trigger downstream jobs

Note that if you are using Pipeline, this can be done much more simply and safely using the build step.

ace_11_89@yahoo.com (JIRA)

unread,

Oct 25, 2018, 7:36:03 AM10/25/18

to jenkinsc...@googlegroups.com

Adrian Vlad commented on

Why does Groovy Postbuild need Overall/Administer permission if Script Security is used to approve or whitelist scripts and methods?

This is a stopper for me because I use Authorize Project plugin to run the jobs as the user who triggered the build, but most of the users that will trigger builds will not have administer rights. This setup will fail all the builds that have groovy postbuild set up and triggered by regular users.

jglick@cloudbees.com (JIRA)

unread,

Oct 25, 2018, 8:29:02 AM10/25/18

to jenkinsc...@googlegroups.com

Jesse Glick commented on

Why does Groovy Postbuild need Overall/Administer permission if Script Security is used to approve or whitelist scripts and methods?

Perhaps predates script security integration, and you are the first to try using it with authorize-project. Best to file a separate bug report in groovy-postbuild for it.

ace_11_89@yahoo.com (JIRA)

unread,

Oct 26, 2018, 6:36:03 AM10/26/18

to jenkinsc...@googlegroups.com

Adrian Vlad commented on

I just opened a new bug (https://issues.jenkins-ci.org/browse/JENKINS-54262). Thank you for the suggestion.