Dzahn has submitted this change and it was merged.

Change subject: contint: puppet cleanup for CI master
......................................................................


contint: puppet cleanup for CI master

* Remove package graphviz, was installed for the Jenkins plugin "job
  dependency graph" which we no more use.
* Drop groovy shutdown workaround for SECURITY-128 now included in
  Jenkins since 1.638 and 1.625.2
  https://github.com/jenkinsci-cert/SECURITY-218

Change-Id: I55b8b5509e7790b981a1b6e6e35ee8e34242f6d6
---
M modules/jenkins/manifests/init.pp
1 file changed, 6 insertions(+), 11 deletions(-)

Approvals:
  Dzahn: Looks good to me, approved
  jenkins-bot: Verified



diff --git a/modules/jenkins/manifests/init.pp 
b/modules/jenkins/manifests/init.pp
index 43a81bd..9669681 100644
--- a/modules/jenkins/manifests/init.pp
+++ b/modules/jenkins/manifests/init.pp
@@ -18,8 +18,6 @@
         require => Package['openjdk-7-jre-headless'],
     }
 
-    # Graphiz on Jenkins master for the 'job dependency graph' plugin
-    require_package('graphviz')
 
     # Jenkins should write everything group writable so admins can interact 
with
     # files easily, hence we need it to run with umask 0002.
@@ -34,18 +32,15 @@
         mode    => '0644',
     }
 
+    # Legacy workaround for a Jenkins security issue. No more needed since
+    # Jenkins 1.638 and 1.625.2
+    # 
https://jenkins.io/blog/2015/11/06/mitigating-unauthenticated-remote-code-execution-0-day-in-jenkins-cli/
+    # https://github.com/jenkinsci-cert/SECURITY-218
     file { '/var/lib/jenkins/init.groovy.d':
-        ensure => 'directory',
-        owner  => 'jenkins',
-        group  => 'jenkins',
-        mode   => '0755',
+        ensure => absent,
     }
-
     file { '/var/lib/jenkins/init.groovy.d/cli-shutdown.groovy':
-        source => 'puppet:///modules/jenkins/cli-shutdown.groovy',
-        owner  => 'jenkins',
-        group  => 'jenkins',
-        mode   => '0755',
+        ensure => absent,
     }
 
     service { 'jenkins':

-- 
To view, visit https://gerrit.wikimedia.org/r/315563
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I55b8b5509e7790b981a1b6e6e35ee8e34242f6d6
Gerrit-PatchSet: 2
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Hashar <has...@free.fr>
Gerrit-Reviewer: Chad <ch...@wikimedia.org>
Gerrit-Reviewer: Dzahn <dz...@wikimedia.org>
Gerrit-Reviewer: Hashar <has...@free.fr>
Gerrit-Reviewer: Paladox <thomasmulhall...@yahoo.com>
Gerrit-Reviewer: Thcipriani <tcipri...@wikimedia.org>
Gerrit-Reviewer: jenkins-bot <>

_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits

Reply via email to