[JIRA] (JENKINS-56617) Node-based security is ignored with pipelines

[christian.gre...@pentacor.de (JIRA)]

Title: Message Title

Christian Gredig created an issue   Jenkins / JENKINS-56617 Node-based security is ignored with pipelines Issue Type: Bug Assignee: Unassigned Components: pipeline Created: 2019-03-19 12:00 Environment: Jenkins ver. 2.164.1 LTS java version "1.8.0_131" Labels: Security pipeline node slave Priority: Major Reporter: Christian Gredig Node-based security is ignored in Pipelines. Restricting "build" on a node to specific users has no effect. Reproduction: Create a node, let's say "test-node" Use restrictions to end up with a user that has access to Jenkins and can create pipelines but does not have "build" permission on that node Create a new job of type pipeline and add this code to it: node('test-node') { sh 'ls -la ..' } No matter which user will start this job, he will be allowed to do it and be able to read files on that node. I would expect that running the job is denied for users who do not have "build" access to that node. That opens up the problem that users who are allowed to create jobs (which is not generally a bad idea) can use this to spy on nodes they are not allowed to use. Add Comment   This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.