Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-17081

Permission "hudson.model.Item.Read:anonymous" coming from nowhere

    XMLWordPrintable

Details

    Description

      Steps to reproduce:
      1. Go to the Configure Global Security screen (http://server/jenkins/configureSecurity/) and choose "enable security"
      2. Select "Jenkins's own user database" as the security realm
      3. Select "Project-based Matrix Authorization Strategy" as the authorization
      4. Give anonymous user the read access to overall
      5. In the text box below the table, type in your user name and click "add"
      6. Give yourself a full access by checking the entire row for your user name
      7. Scroll all the way to the bottom, click "save"

      Now, you have access to all projects and anonymous users have access to specific projects, the config.xml will have:

      <authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy">
      <permission>hudson.model.Computer.Configure:jose.rob.jr</permission>
      <permission>hudson.model.Computer.Connect:jose.rob.jr</permission>
      <permission>hudson.model.Computer.Create:jose.rob.jr</permission>
      <permission>hudson.model.Computer.Delete:jose.rob.jr</permission>
      <permission>hudson.model.Computer.Disconnect:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.Administer:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.ConfigureUpdateCenter:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.Read:anonymous</permission>
      <permission>hudson.model.Hudson.Read:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.RunScripts:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.UploadPlugins:jose.rob.jr</permission>
      <permission>hudson.model.Item.Build:jose.rob.jr</permission>
      <permission>hudson.model.Item.Cancel:jose.rob.jr</permission>
      <permission>hudson.model.Item.Configure:jose.rob.jr</permission>
      <permission>hudson.model.Item.Create:jose.rob.jr</permission>
      <permission>hudson.model.Item.Delete:jose.rob.jr</permission>
      <permission>hudson.model.Item.Discover:jose.rob.jr</permission>
      <permission>hudson.model.Item.Read:jose.rob.jr</permission>
      <permission>hudson.model.Item.Workspace:jose.rob.jr</permission>
      <permission>hudson.model.Run.Delete:jose.rob.jr</permission>
      <permission>hudson.model.Run.Update:jose.rob.jr</permission>
      <permission>hudson.model.View.Configure:jose.rob.jr</permission>
      <permission>hudson.model.View.Create:jose.rob.jr</permission>
      <permission>hudson.model.View.Delete:jose.rob.jr</permission>
      <permission>hudson.model.View.Read:jose.rob.jr</permission>
      <permission>hudson.scm.SCM.Tag:jose.rob.jr</permission>
      </authorizationStrategy>

      Go to jenkin management screen (http://server/jenkins/manage) and click "Reload configs from disk"

      After it finishes anonymous users can now access all projects, if you go to the Configure Global Security screen you'll see that anonymous task read is checked

      If you save again without changing anything, the config.xml will have:

      <authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy">
      <permission>hudson.model.Computer.Configure:jose.rob.jr</permission>
      <permission>hudson.model.Computer.Connect:jose.rob.jr</permission>
      <permission>hudson.model.Computer.Create:jose.rob.jr</permission>
      <permission>hudson.model.Computer.Delete:jose.rob.jr</permission>
      <permission>hudson.model.Computer.Disconnect:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.Administer:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.ConfigureUpdateCenter:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.Read:anonymous</permission>
      <permission>hudson.model.Hudson.Read:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.RunScripts:jose.rob.jr</permission>
      <permission>hudson.model.Hudson.UploadPlugins:jose.rob.jr</permission>
      <permission>hudson.model.Item.Build:jose.rob.jr</permission>
      <permission>hudson.model.Item.Cancel:jose.rob.jr</permission>
      <permission>hudson.model.Item.Configure:jose.rob.jr</permission>
      <permission>hudson.model.Item.Create:jose.rob.jr</permission>
      <permission>hudson.model.Item.Delete:jose.rob.jr</permission>
      <permission>hudson.model.Item.Discover:jose.rob.jr</permission>
      <permission>hudson.model.Item.Read:anonymous</permission>
      <permission>hudson.model.Item.Read:jose.rob.jr</permission>
      <permission>hudson.model.Item.Workspace:jose.rob.jr</permission>
      <permission>hudson.model.Run.Delete:jose.rob.jr</permission>
      <permission>hudson.model.Run.Update:jose.rob.jr</permission>
      <permission>hudson.model.View.Configure:jose.rob.jr</permission>
      <permission>hudson.model.View.Create:jose.rob.jr</permission>
      <permission>hudson.model.View.Delete:jose.rob.jr</permission>
      <permission>hudson.model.View.Read:jose.rob.jr</permission>
      <permission>hudson.scm.SCM.Tag:jose.rob.jr</permission>
      </authorizationStrategy>

      that line is being injected when jenkin load the config.xml:
      <permission>hudson.model.Item.Read:anonymous</permission>

      Attachments

        1. 1-after-save.png
          1-after-save.png
          494 kB
        2. 2-click-reload.png
          2-click-reload.png
          114 kB
        3. 3-after-reload.png
          3-after-reload.png
          527 kB

        Issue Links

          Activity

            joserobjr José Roberto A. JR. created issue -
            oleg_nenashev Oleg Nenashev made changes -
            Field Original Value New Value
            Component/s matrix-auth [ 18131 ]
            Component/s security [ 15508 ]
            Labels config configuration jenkins matrix security config configuration jenkins security
            oleg_nenashev Oleg Nenashev made changes -
            Assignee Jesse Glick [ jglick ]
            jglick Jesse Glick made changes -
            Assignee Jesse Glick [ jglick ]
            rtyler R. Tyler Croy made changes -
            Workflow JNJira [ 147912 ] JNJira + In-Review [ 177031 ]
            danielbeck Daniel Beck made changes -
            Link This issue duplicates JENKINS-42577 [ JENKINS-42577 ]
            danielbeck Daniel Beck made changes -
            Resolution Duplicate [ 3 ]
            Status Open [ 1 ] Resolved [ 5 ]

            People

              Unassigned Unassigned
              joserobjr José Roberto A. JR.
              Votes:
              2 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: