Limit shell commands in Jenkins

Question

I've been wondering if it's possible to limit shell commands a user can run in a Jenkins job?

Example: We store an universal password to access our Subversion repositories in Jenkins, and we don't want people to just cat the file, echo it out and display it in the buildlog for the job.

Exactly how can you limit the number of shell commands and directories users can utilize?

Answer 1

This is outside the scope of Jenkins, that's purely your responsibility for addressing this, main reason being that's impossible to do it correct from Jenkins.

There are two solutions * Start using docker containers as build slaves * Try to use OS level limitations

Regarding keeping secrets secret the final answer is you cannot really secure it from those writing scripted jobs.

And yes, keep the master isolated for special jobs.