[JIRA] (JENKINS-24513) Zero executors on master not well documented or enforced

[jgl...@cloudbees.com (JIRA)]

Title: Message Title

Jesse Glick commented on JENKINS-24513   Re: Zero executors on master not well documented or enforced Well what we would really want is something along the lines of diff --git a/core/src/main/java/jenkins/model/Jenkins.java b/core/src/main/java/jenkins/model/Jenkins.java index 2552718..9740635 100644 --- a/core/src/main/java/jenkins/model/Jenkins.java +++ b/core/src/main/java/jenkins/model/Jenkins.java @@ -4713,13 +4713,26 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve } @Override - public boolean hasPermission(Permission permission) { - // no one should be allowed to delete the master. - // this hides the "delete" link from the /computer/(master) page. - if(permission==Computer.DELETE) - return false; - // Configuration of master node requires ADMINISTER permission - return super.hasPermission(permission==Computer.CONFIGURE ? Jenkins.ADMINISTER : permission); + public ACL getACL() { + final ACL base = super.getACL(); + return new ACL() { + @Override + public boolean hasPermission(Authentication a, Permission permission) { + // no one should be allowed to delete the master. + // this hides the "delete" link from the /computer/(master) page. + if (permission == Computer.DELETE) { + return false; + } else if (permission == Computer.CONFIGURE) { + // Configuration of master node requires ADMINISTER permission + return base.hasPermission(a, Jenkins.ADMINISTER); + } else if (permission == Computer.BUILD) { + // JENKINS-24513: do not allow user-configured builds on the master. + return base.hasPermission(a, Jenkins.RUN_SCRIPTS); + } else { + return base.hasPermission(a, permission); + } + } + }; } @Override and then including Authorize Project in the default plugin set and having it preconfigure a sensible queue authenticator. Might also need something like diff --git a/core/src/main/java/hudson/model/Node.java b/core/src/main/java/hudson/model/Node.java index d7c4071..6742918 100644 --- a/core/src/main/java/hudson/model/Node.java +++ b/core/src/main/java/hudson/model/Node.java @@ -386,7 +386,7 @@ public abstract class Node extends AbstractModelObject implements Reconfigurable } Authentication identity = item.authenticate(); - if (!getACL().hasPermission(identity,Computer.BUILD)) { + if (!(item.task instanceof Queue.FlyweightTask) && !getACL().hasPermission(identity,Computer.BUILD)) { // doesn't have a permission return CauseOfBlockage.fromMessage(Messages._Node_LackingBuildPermission(identity.getName(),getNodeName())); } diff --git a/core/src/main/java/hudson/model/queue/MappingWorksheet.java b/core/src/main/java/hudson/model/queue/MappingWorksheet.java index 4ef5af3..b8c2adf 100644 --- a/core/src/main/java/hudson/model/queue/MappingWorksheet.java +++ b/core/src/main/java/hudson/model/queue/MappingWorksheet.java @@ -30,6 +30,7 @@ import hudson.model.Executor; import hudson.model.Label; import hudson.model.LoadBalancer; import hudson.model.Node; +import hudson.model.Queue; import hudson.model.Queue.BuildableItem; import hudson.model.Queue.Executable; import hudson.model.Queue.JobOffer; @@ -133,7 +134,7 @@ public class MappingWorksheet { if (c.assignedLabel!=null && !c.assignedLabel.contains(node)) return false; // label mismatch - if (!nodeAcl.hasPermission(item.authenticate(), Computer.BUILD)) + if (!(item.task instanceof Queue.FlyweightTask) && !nodeAcl.hasPermission(item.authenticate(), Computer.BUILD)) return false; // tasks don't have a permission to run on this node return true; to ensure this is not applied overzealously. Add Comment   This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.