Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-41684

Plugin.postInitialize can be run as anonymous during dynamic load




      While running 2.32.2 (I think), I logged in as the initial admin user, then dynamically loaded support-core, and got

      ... hudson.ExtensionFinder$GuiceFinder$FaultTolerantScope$1 error
      WARNING: Failed to instantiate Key[type=com.cloudbees.jenkins.support.impl.JenkinsLogs, annotation=[none]]; skipping this component
      com.google.inject.ProvisionException: Unable to provision, see the following errors:
      1) Error injecting constructor, hudson.security.AccessDeniedException2: anonymous is missing the Overall/Administer permission
        at com.cloudbees.jenkins.support.impl.JenkinsLogs.<init>(JenkinsLogs.java:45)
      1 error
      	at com.google.inject.internal.ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:52)
      	at ...
      	at hudson.ExtensionList.iterator(ExtensionList.java:157)
      	at com.cloudbees.jenkins.support.SupportPlugin.postInitialize(SupportPlugin.java:476)
      	at hudson.PluginManager.dynamicLoad(PluginManager.java:868)
      	at hudson.PluginManager.dynamicLoad(PluginManager.java:813)
      	at hudson.model.UpdateCenter$InstallationJob._run(UpdateCenter.java:1891)
      	at hudson.model.UpdateCenter$DownloadJob.run(UpdateCenter.java:1652)
      	at ...
      Caused by: hudson.security.AccessDeniedException2: anonymous is missing the Overall/Administer permission
      	at hudson.security.ACL.checkPermission(ACL.java:65)
      	at hudson.model.Node.checkPermission(Node.java:464)
      	at jenkins.model.Jenkins.getLog(Jenkins.java:2449)
      	at com.cloudbees.jenkins.support.impl.JenkinsLogs.<init>(JenkinsLogs.java:49)
      	at com.cloudbees.jenkins.support.impl.JenkinsLogs$$FastClassByGuice$$adeef6a3.newInstance(<generated>)
      	at ...

      The Master Log Recorders component was not available until after I restarted Jenkins.

      It seems that InstallationJob runs in a fresh thread as Jenkins.ANONYMOUS and this "authentication" is carried over to plugin code, which rightly expects its initializers to be run as SYSTEM.


        Issue Links


            jglick Jesse Glick created issue -
            jglick Jesse Glick made changes -
            Field Original Value New Value
            Status Open [ 1 ] In Progress [ 3 ]
            jglick Jesse Glick made changes -
            Remote Link This issue links to "PR 2732 (Web Link)" [ 15373 ]
            jglick Jesse Glick made changes -
            Status In Progress [ 3 ] In Review [ 10005 ]
            jglick Jesse Glick made changes -
            Resolution Fixed [ 1 ]
            Status In Review [ 10005 ] Resolved [ 5 ]
            cloudbees CloudBees Inc. made changes -
            Remote Link This issue links to "CloudBees Internal OSS-1930 (Web Link)" [ 18508 ]
            allan_burdajewicz Allan BURDAJEWICZ made changes -
            Link This issue relates to JENKINS-59775 [ JENKINS-59775 ]


              jglick Jesse Glick
              jglick Jesse Glick
              0 Vote for this issue
              2 Start watching this issue