jenkins pipeline的groovy脚本执行权限问题

发表于 | 阅读次数：

在Pipeline中直接如下执行Groovy脚本时，会提示权限问题

1
2
3
4
List<String> jenkinsPlugins = new ArrayList<String>(Jenkins.instance.pluginManager.plugins)
jenkinsPlugins.sort { it.displayName }.each { plugin ->
  println("${plugin.shortName}:${plugin.version}")
}

问题日志如下:

1
2
3
4
5
6
Started by user unknown or anonymous
Running in Durability level: MAX_SURVIVABILITY
[Pipeline] Start of Pipeline
Scripts not permitted to use method jenkins.model.Jenkins getPluginManager. Administrators can decide whether to approve or reject this signature.
[Pipeline] End of Pipeline
org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use method jenkins.model.Jenkins getPluginManager

解决方法:

  1. jenkins > Manage jenkins > In-process Script Approval中增加权限，这种方式在重启Jenkins服务后需要再次增加权限
  2. 创建pipeline任务时，取消Use Groovy Sandbox的勾选
  3. 安装Permissive Script Security插件，启动jenkins服务时，指定-Dpermissive-script-security.enabled=true启动参数

安装方法3配置后，在任务的执行日志中会有相关提示信息，但是不会再因为需要approve而终止任务运行

1
2
3
4
5
6
7
8
Started by user unknown or anonymous
Running in Durability level: MAX_SURVIVABILITY
[Pipeline] Start of Pipeline
Scripts not permitted to use staticMethod jenkins.model.Jenkins getInstance. Administrators can decide whether to approve or reject this signature.
Scripts not permitted to use method jenkins.model.Jenkins getPluginManager. Administrators can decide whether to approve or reject this signature.
Scripts not permitted to use method hudson.PluginManager getPlugins. Administrators can decide whether to approve or reject this signature.
expected to call java.util.ArrayList.sort but wound up catching org.jenkinsci.plugins.workflow.cps.CpsClosure2.call; see: https://jenkins.io/redirect/pipeline-cps-method-mismatches/
[Pipeline] End of Pipeline