jenkins pipeline no permission to run a tool from system32 folder - jenkins-pipeline

I'm running jenkins pipeline on a slave computer (slave run from agent command line - user with full admin privileges).
when trying to run a tool from system32 folder, it failes: The system cannot find the path specified.
if I copy the tool to c:\myfolder, it succeeds.
I've also tried to run msbuild - fails on post build regsvr32. but, when running the same command via computer's command line (not jenkins), it succeeds.
It looks like I have a problem with permissions but I do not know what is wrong. jenkins is running via command line with a user that have administrator permissions.
any ideas?

Related

Running .bat commands on a Jenkins slave with restricted execution permissions

I am running a Jenkins slave on a restricted environment. This environment will only allow me to execute files in a specific directory.
The problem I have is running simple batch commands.
The slave's java.io.tmpdir being AppData/Local/Temp, jenkins will copy my command in a temp bat file and attempt to run it, like such:
cmd /c call D:\Users\TastyWithPasta\AppData\Local\Temp\hudson8090039221524722157.bat
Here the issue becomes obvious, the command cannot be run due to restriction and the build fails.
Anybody working in a restricted environment and facing the same issues? What would be a good workaround?
Unfortunately, -Djava.io.tmpdir=newpath is not an option since this taps into the Java installation. Maybe there is a way to override it locally?

Run Jenkins' Cygwin script as user

I have Jenkins running on Windows, and I have a build that works fine under CygWin bash from the CygWin terminal, so I now want to automate it. However, using this script:
#!C:\cygwin\bin\bash.exe
whoami
make
The system reports me as nt authority\system, not the ken that I get when using an interactive shell. Is there an easy way to persuade Jenkins or CygWin to run as me?
Most likely you are running jenkins with default installation. You have two options. First is mentioned in the comment. Change the "Service account" to be same as yours.
Second option is derived from best practices. Run the jenkins master on a system with backup etc. Configure slave node with your account credentials. Change the project configuration to build on the specific node.
(It is possible to run slave and master on same machine with different credentials - just in case you want to try out things)
The real problem I was having was not that the shell script was running as the wrong user, but that the shell script was not executing the default /etc/profile. So, the solution was simply:
#!C:\cygwin\bin\bash.exe -l
whoami
make
I was still nt authority\system, but now I had the correct environment set up and could run make successfully.
Note also that if I create a /home/system directory I can add .bash_profile, etc, to that directory to further customise the build environment.

Hudson post build step security issue

Hudson jobs can be configured to have a post build step which can execute shell commands as an option, accidently or intentionally someone can wipe out the hudson home directory
just by running rm command is there a specific set of permission of home directory
which will prevent such scenario
On Linux, you will likely be running the Hudson process as the "hudson" user. Using a combination of chown and chmod, you can set the permissions on the hudson application server directory such that the hudson user only has read-access of the Hudson application server directory.
Hudson stores all of its file storage in /var/lib/jenkins by default (if you're using the .deb package).
so basically, make sure that the hudson user has recursive write access of that directory, allow hudson read-only access of the other Hudson installation files, and no access over any other file.

command not found in jenkins running on Mac machine

I predominantly work on windows OS and quite new to MAC systems. I am trying to set up Jenkins CI tool on one of the MAC machines, I have installed jenkins on mac and it is running on 8080 port.
Issue: I am getting the following error on Jenkins console output when i execute the job:
**/var/folders/zz/zzzivhrRnAmviuee+++++E++++2/-Tmp-/hudson6910375920437308281.sh: line 13:
**ampts: command not found**
Build step 'Execute shell' marked build as failure**
Things I tried:
I added the correct path in .bash_profile and since then I am able to successfully run the ampts command from terminal and every thing works fine from terminal. But the same does not run from the execute shell in Jenkins which is running on MAC.
Earlier the job was running as anonymous I created the account in jenkins and placed .bash_profile with the correct path under ~jenkins/users/home/my.account and restarted jenkins but still I am facing the same issue.
I also tried placing .bashrc under ~jenkins and also under ~jenkins/users/home/my.account but still no success.
Can some one point out what I am missing. or what needs to be done in case of Jenkins running on MAC.
This will depend on how you've started the Jenkins client. If you start it from the command line with the javaws command then I think this will inherit the environment variables of the terminal prompt. If you start the JNLP agent from the browser then it will inherit the system environment (which is different to the bash environment). There's a few things you could try:
Set the PATH variable explicitly in the ~/.MacOSX/environment.plist file (see the Apple docs)
If you are using Ant to run the jobs then you can add the environment variable to the ~/.antrc file (same syntax as the .bash_profile)
Set the environment variable in the Jenkins configure page for this node.

Jenkins Windows slave failing the Play! framework build

We are using the Play! framework and I've setup our Jenkins CI to run auto-test and other things on a master Unix machine. As a second step I want to setup a windows slave to run some in browser webdriver tests. Unfortunately my build doesn't get to that point. The source checks out fine in the workspace directory. As a first build step I run
play clean
Which seems to fail everytime. I've given full permissions to admin for that directory and I'm running the jenkins slave under that administrator like so
runas /noprofile /user:DOMAIN\Administrator "javaws http://jenkins:8080/computer/Keith/slave-agent.jnlp"
The console output I see from jenkins is:
Building remotely on Keith in workspace C:\Documents and Settings\administrator\My Documents\Jenkins\workspace\windows
Updating http://svnrepo..
At revision 448
no change for http://svnrepo.. since the previous build
play path is C:\Software\Play\play
Executing C:\Software\Play\play clean "C:\Documents and Settings\administrator\My Documents\Jenkins\workspace\windows"
[windows] $ C:\Software\Play\play clean "C:\Documents and Settings\administrator\My Documents\Jenkins\workspace\windows"
Build step 'Play!' marked build as failure
Finished: FAILURE
Note that when I run the command below manually on the windows box it works fine:
C:\Software\Play\play clean "C:\Documents and Settings\administrator\My Documents\Jenkins\workspace\windows"
Anyone got any ideas what I'm doing wrong?
Thanks!
I had the same problem and I solved it by adding .bat at the end of play path. In your case, you should configure play path in jenkins as C:\Software\Play\play.bat (not just C:\Software\Play\play).

Resources