View source for Jenkins/In-process Script Approval

Documentation of [https://jenkins.io/doc/book/managing/script-approval/ script-approval] contains all details about:
* Script Security plugin (this is what we discussed here in this post)
* Groovy sandbox
* script approval
= Approve scripts =
In order to get past this Jenkins security feature, you will need to approve your script. Go to Manage Jenkins -> In-process Script Approval. In that screen, you will see the script that you are trying to execute. There should be an approve button that you'll need to click to approve that script.


Approved scripts hash are stored in <code>cat $JENKINS_HOME/scriptApproval.xml</code>:
<source lang=xml>
<?xml version='1.1' encoding='UTF-8'?>
<scriptApproval plugin="script-security@1.40">
  <approvedScriptHashes>
    <string>dbdd49c3b23c190f88daa4b57efc1adb29879044</string>
  </approvedScriptHashes>
  <approvedSignatures/>
  <aclApprovedSignatures/>
  <approvedClasspathEntries/>
  <pendingScripts/>
  <pendingSignatures/>
  <pendingClasspathEntries/>
</source>

= Disable globally =
Job DSL version 1.60 introduced <code>Script Security</code>, to restore old behavior, uncheck <tt>Enable script security for Job DSL scripts</tt> in the <tT>CSRF Protection</tt> section of the <tt>Configure Global Security</tt> page.
:[[File:ClipCapIt-200328-145440.PNG]]


The caveat, it will not prompt for approval any first layer DSL Script inline or from a file, but still will call for approval if nested scripts validate Security Script rules. Eg. Jenkins DSL Plugin will process without approval the DSL code (layer1) but if there is a  pipeline{} code that is considered as another script inline or from a file (layer2) it will need to be approved.


2-layer DSL script. It contains <code>Utils.markStageSkippedForConditional</code> that uses not whitelisted method.
<source lang=groovy>
pipelineJob('New_pipeline') {       // <- layer1 script will get executed
    parameters { 
        choiceParam( 'ACTION', ["plan","apply"],"terraform plan or apply")
    }
    definition {
        cps {
            script('''             // <- layer2, will require approval
                import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
                def hosts
                pipeline {
                    agent any
                    environment {
                        REGION = "eu-west-1"
                    }
                    stages {
                        stage('Build host lists') {
                            steps {
                                script {
                                    hosts = [ "node-1", "node-2" ]
                                }
                            }
                        }
                        stage('Display list') {
                            steps {
                                echo 'Print host[0]'
                                sh \'\'\'#!/bin/bash
                                    HOST=\'\'\' + hosts[0] + \'\'\'
                                    printf "HOST: $HOST";
                                \'\'\'
                            }
                        stage('SkipStage') {
                            steps {
                                // requires approval
                                Utils.markStageSkippedForConditional('SkipStage')
                            }
                        }
                        }
                    }
                }
            ''')
        }
    }
}
</source>

= Approve scripts programatically =
You can add this snippet after you processed all your <code>job_dsl.groovy</code> files and it will approve any outstanding script.
<source lang=bash>
import org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval

ScriptApproval scriptApproval = ScriptApproval.get()
scriptApproval.pendingScripts.each {
    scriptApproval.approveScript(it.hash)
}
</source>

Resources:
*[https://stackoverflow.com/questions/43699190/seed-job-asks-for-script-approval-in-jenkins seed job asks for script approval in jenkins] stackoverflow

= Resources =
* [http://job-dsl.herokuapp.com/ Jenkins Job DSL Playground]
* [https://github.com/cloudbees/jenkins-scripts/blob/master/pipeline-approval-scripts.groovy pipeline-approval-scripts.groovy] https://github.com/cloudbees/jenkins-scripts