1

I need to run a script through jenkins, the script is located, at a user x home directory, /home/x/script.sh

This script should only run through user x only as it will pull config settings from .ssh folder.

Currently the script is failing, as i believe it is being run thru jenkins user.

closed as unclear what you're asking by Hunter.S.Thompson, Stephen Rauch, Jeff Schaller, Timothy Martin, mattdm Dec 15 '17 at 1:45

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • The user Jenkins will not have access to the other user's home directory without elevated root permissions. You would therefore have to configure access to the other users home directory by putting Jenkins and the other user in the same group and then allowing group access to the home folder. – Raman Sailopal Dec 14 '17 at 9:38
  • Well i have resolved it with a work around,, but i would like to know if there is a better solution,, i ran the script like this. runuser -l x -c '/home/x/script.sh' – Mohammed Ali Dec 14 '17 at 14:17
0

You are operating at cross purposes with yourself. Your script depends on user specific credentials, but Jenkins is designed to isolate your build from user specific configuration and credentials. There are four ways to resolve such a conflict (all of which may have security implications, proceed carefully):

  1. grant credentials to jenkins to do the work. (give it ssh keys) this has the advantage that actions taken by jenkins get logged as jenkins not as a developer and that you can limit what permissions jenkins has to act (for example ssh forced commands are useful here). The disadvantage is that as jenkins is a shared user it is easier for his credentials to leak.

  2. switch users for the duration of the script. (this is what you are doing with your workaround) in addition to runuser look at sudo and super. (I prefer super for this use case.) the advantage is that troubleshooting is easier as the script is run as the same user that wrote it. The disadvantages are that actions performed by jenkins as the user will be blamed on the user and that this may make compromising the user's account easier. (this can be mitigated by tight permissions in sudo or super for the jenkins user and not trusting anything passed from jenkins to the user. perl documents the issue well in the documentation on taint)

  3. create a server to run the script. CGI, rpc etc.

  4. rethink the whole thing. There may be a way to do what needs done without credentials at all.

Not the answer you're looking for? Browse other questions tagged or ask your own question.