Merge pull request #3361 from agentgonzo/JENKINS-50296-RemotingAsSystem

[JENKINS-50296] Run ThreadPoolForRemoting as SYSTEM
jenkinsci · Apr 5, 2018 · 54325b1 · 54325b1
2 parents 6526181 + 7d13e17
commit 54325b1
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 3 deletions.
diff --git a/core/src/main/java/hudson/model/Computer.java b/core/src/main/java/hudson/model/Computer.java
@@ -30,7 +30,6 @@
 import hudson.Extension;
 import hudson.Launcher.ProcStarter;
 import hudson.slaves.Cloud;
-import jenkins.util.SystemProperties;
 import hudson.Util;
 import hudson.cli.declarative.CLIResolver;
 import hudson.console.AnnotatedLargeText;
@@ -65,7 +64,9 @@
 import hudson.util.NamingThreadFactory;
 import jenkins.model.Jenkins;
 import jenkins.util.ContextResettingExecutorService;
+import jenkins.util.SystemProperties;
 import jenkins.security.MasterToSlaveCallable;
+import jenkins.security.ImpersonatingExecutorService;
 
 import org.apache.commons.lang.StringUtils;
 import org.jenkins.ui.icon.Icon;
@@ -1352,9 +1353,11 @@ public String call() throws IOException {
     }
 
     public static final ExecutorService threadPoolForRemoting = new ContextResettingExecutorService(
+        new ImpersonatingExecutorService(
             Executors.newCachedThreadPool(
-                    new ExceptionCatchingThreadFactory(
-                            new NamingThreadFactory(new DaemonThreadFactory(), "Computer.threadPoolForRemoting"))));
+                new ExceptionCatchingThreadFactory(
+                    new NamingThreadFactory(
+                        new DaemonThreadFactory(), "Computer.threadPoolForRemoting"))), ACL.SYSTEM));
 
 //
 //

diff --git a/core/src/test/java/hudson/model/ComputerTest.java b/core/src/test/java/hudson/model/ComputerTest.java
@@ -1,9 +1,18 @@
 package hudson.model;
 
 import hudson.FilePath;
+import hudson.security.ACL;
+import jenkins.model.Jenkins;
+import org.acegisecurity.Authentication;
 import org.junit.Test;
+import org.jvnet.hudson.test.Issue;
 
 import java.io.File;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Future;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
 
 /**
  * @author Kohsuke Kawaguchi
@@ -28,4 +37,11 @@ public void testRelocate() throws Exception {
             dir.deleteRecursive();
         }
     }
+
+    @Issue("JENKINS-50296")
+    @Test
+    public void testThreadPoolForRemotingActsAsSystemUser() throws InterruptedException, ExecutionException {
+        Future<Authentication> job = Computer.threadPoolForRemoting.submit(Jenkins::getAuthentication);
+        assertThat(job.get(), is(ACL.SYSTEM));
+    }
 }