19

I have recently started using Jenkins for integration. All was well until I was running jobs on master node without shell command but I have to run jobs on master as well as slave node which contains shell commands to. I am not able to run those shell commands as root user. I have tried

  1. Using SSH Keys.
  2. Setting user name in shell commands.
  3. Using sudo.

I am getting permission denied error every time I use any of the above methods.

8 Answers 8

46

I would suggest against running the jenkins user as root. This could expose the operating system and all of the repo's which jenkins can build.

Running any script as root is a security risk, but a slightly safer method would be to grant the jenkins user sudo access to only run the one script, without needing a password.

sudo visudo

and add the following:

jenkins    ALL = NOPASSWD: /var/lib/jenkins/jobs/[job name]/workspace/script

Double check your path via the console log of a failed build script. The one shown here is the default.

Now within the jenkins task you can call sudo $WORKSPACE/your script

3
  • then I need to append sudo to every command in my jenkinsfile, is that really the right approach? May 11, 2018 at 1:03
  • 1
    @JulioMarins Generally no, if you can find an alternative approach then take it. But if you need to use root access then this is the safer way to do it. Remember that if the script you are running is compromised then so is the Jenkins server.
    – oden
    May 16, 2018 at 0:35
  • to your second step add the file name being modified... sudo vi /etc/sudoers
    – masher
    Jan 24, 2022 at 19:42
35

You need to modify the permission for jenkins user so that you can run the shell commands. You can install the jenkins as as service (download the rpm package), You might need to change the ports because by default it runs http on 8080 and AJP on 8009 port.



Following process is for CentOS
1. Open up the this script (using VIM or other editor):

vim /etc/sysconfig/jenkins

2. Find this $JENKINS_USER and change to “root”:

$JENKINS_USER="root"

3. Then change the ownership of Jenkins home, webroot and logs:

chown -R root:root /var/lib/jenkins
chown -R root:root /var/cache/jenkins
chown -R root:root /var/log/jenkins

4) Restart Jenkins and check the user has been changed:

service jenkins restart
ps -ef | grep jenkins

Now you should be able to run the Jenkins jobs as the root user and all the shell command will be executed as root.

8
  • 32
    It is a really bad idea to run services that are expose a webinterface that allow you to run scripts, as root.
    – JamesP
    Feb 24, 2017 at 10:22
  • 1
    +1 for @JamesP. However incorrect installation of aws cli and Jenkins user permission can cause this issue.
    – Lovey
    Mar 14, 2017 at 16:39
  • Any idea, how can I do this in MacOSX?
    – Geek
    Apr 20, 2017 at 15:03
  • dscl . -append /Groups/admin GroupMembership jenkins
    – Guy Mazuz
    Jun 11, 2017 at 13:40
  • 1
    This looked promising, however later i reverted, dint use the above commands, yet to find a better solution. Feb 8, 2020 at 6:52
3

For Linux try to follow these steps:-

This worked for me.

Change Jenkins user: sudo vi /etc/default/jenkins

Change user root or your user that you use to access to your files: $JENKINS_USER="root"

Execute using the user that you setup before:

sudo chown -R root:root /var/lib/jenkins
sudo chown -R root:root /var/cache/jenkins
sudo chown -R root:root /var/log/jenkins
  1. Run as a services:

    service jenkins restart Or
    systemctl jenkins restart

You can execute jenkins has a process and disable headless mode for Linux with UI.

/etc/alternatives/java -Djava.awt.headless=false -DJENKINS_HOME=/var/lib/jenkins -jar /usr/lib/jenkins/jenkins.war --logfile=/var/log/jenkins/jenkins.log --webroot=/var/cache/jenkins/war --httpPort=8080 --debug=5 --handlerCountMax=100 --handlerCountMaxIdle=20

Validate Jenkins is running currently: ps -ef | grep jenkins

1

Another option is to set up a jenkins "Slave" that is actually running as root on the master and restrict it to tied jobs, then point your job at that slave. Far from ideal but certainly a quick solution.

0

Or you can change the permission of docker.sock. Make sure your docker container is running the user as root

docker exec <jenkinsContainerID> chmod 777 /var/run/docker.sock
0

Along with all the steps mentioned in the selected answer, I had to do the following:

  1. Identify where the Jenkins service file is, on Centos 7/8

    vim /usr/lib/systemd/system/jenkins.service

  2. Specify the root user instead of jenkins user

    User=root

    Group=root

0

I was facing the same issue with the EC2 "Azazon Linux 2023 AMI". I have checked many solutions but unfortunately, nothing works as one step is missing to Overring service configurations.

vi user/lib/systemd/system/jenkins.service. Here in the file need to change the User=root, and Group=root as by default it will be jenkins . Run this systemctl daemon-reload

then

vi /etc/sysconfig/jenkins change the JENKINS_USER="root"

chown -R root:root /var/lib/jenkins

chown -R root:root /var/cache/jenkins

chown -R root:root /var/log/jenkins

After this work like the charm.

-2

You just need to run the shell command on Linux machine using Root privileges from Jenkins.

Steps :

1) sudo vi /etc/sudoers

2) Add line :

jenkins ALL=NOPASSWD:/path of script/

3) From Jenkins,run the script on remote shell using sudo . for eg : sudo ps -ef

4) Build Jenkins job now. This job runs the script on Linux machine using root privileges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.