make the MANAGE permission enabled by default #23873

jtnord · 2025-11-27T19:34:21Z

Removed experimental warning for MANAGE permission and enable it by default.

JEP-223

Fixes #16423
follows up #10183

Testing done

Proposed changelog entries

Enables the Overall/Manage Permission by default. This permission when granted to users allows them to configure certain parts of Jenkins' global configuration without the ability to execute arbitrary code.

Proposed changelog category

Proposed upgrade guidelines

As the permission is now enabled by default users can uninstall the Overall/Manage permission enabler plugin

Submitter checklist

The issue, if it exists, is well-described.
The changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developers, depending on the change) and are in the imperative mood (see examples). Fill in the Proposed upgrade guidelines section only if there are breaking changes or changes that may require extra steps from users during upgrade.
There is automated testing or an explanation as to why this change has no tests.
New public classes, fields, and methods are annotated with @Restricted or have @since TODO Javadocs, as appropriate.
New deprecations are annotated with @Deprecated(since = "TODO") or @Deprecated(forRemoval = true, since = "TODO"), if applicable.
UI changes do not introduce regressions when enforcing the current default rules of Content Security Policy Plugin. In particular, new or substantially changed JavaScript is not defined inline and does not call eval to ease future introduction of Content Security Policy (CSP) directives (see documentation).
For dependency updates, there are links to external changelogs and, if possible, full differentials.
For new APIs and extension points, there is a link to at least one consumer.

Desired reviewers

@mikecirioli

Before the changes are marked as ready-for-merge:

Maintainer checklist

There are at least two (2) approvals for the pull request and no outstanding requests for change.
Conversations in the pull request are over, or it is explicit that a reviewer is not blocking the change.
Changelog entries in the pull request title and/or Proposed changelog entries are accurate, human-readable, and in the imperative mood.
Proper changelog labels are set so that the changelog can be generated automatically.
If the change needs additional upgrade steps from users, the upgrade-guide-needed label is set and there is a Proposed upgrade guidelines section in the pull request title (see example).
If it would make sense to backport the change to LTS, be a Bug or Improvement, and either the issue or pull request must be labeled as lts-candidate to be considered.

Removed experimental warning for MANAGE permission and enable it by default.

timja · 2025-12-01T10:35:40Z

core/src/main/java/jenkins/model/Jenkins.java

            Messages._Jenkins_Manage_Description(),
            ADMINISTER,
-            SystemProperties.getBoolean("jenkins.security.ManagePermission"),
+            true,


see #4909 (review) from when system read went GA

May not be as bad as its 1 permission instead of 3, but GA and enabled by default are separate things

I would argue that the permission is already GA (having had the @Beta restriction removed in #10183 but that left the javadoc comment meaning the comment did not match the contract), thus this is really just enabling it by default which matches the PR title.

Whilst I agree that things are different between GA and being enabled by default I do not see a reason to keep this disabled by default as unlike Overall/SystemRead developers have to have opted into this permission.
Whilst SystemRead could have had issues where secrets where unintentionally leaked just by granting someone Overall/SystemRead a developer has to have updated their plugin to make use of Overall/Manage (and core has been adapted as part of creating the Manage permission) so there should not be any security issues arising from enabling this (administrators would still need to grant this permission too!).

Any complaints about "too many permissions" and its too "hard to manage permissions" should be mitigated by properly killing off RunScripts, ConfigureUpdateCenter, and UploadPlugins. Removing the afore mentioned permissions when combined with this PR would have the net effect of reducing the number of permissions by 2.

//cc @daniel-beck as the original author of the comment.

jglick

OK I think

mikecirioli

thanks @jtnord

timja · 2025-12-01T18:44:16Z

Is it worth running this through ATH and bom ?

Adapts to jenkinsci/jenkins#23873 so the tests pass on the current Jenkins version as well as a version containing the PR

Adapts to jenkinsci/jenkins#23873 so the tests pass on the current Jenkins version as well as a version containing the PR discovered by jenkinsci/bom#6031 in preparation for jenkinsci/jenkins#23873 tested with mvn test -Djenkins.version=2.540-rc37747.87da_150079a_1

…nkins version as well as a version containing the PR discovered by jenkinsci/bom#6031 in preparation for jenkinsci/jenkins#23873 tested with mvn test -Djenkins.version=2.540-rc37747.87da_150079a_1

Adapts to jenkinsci/jenkins#23873 so the tests pass on the current Jenkins version as well as a version containing the PR discovered by jenkinsci/bom#6031 in preparation for jenkinsci/jenkins#23873 tested with mvn test -Djenkins.version=2.540-rc37747.87da_150079a_1

jtnord · 2025-12-02T13:35:44Z

Is it worth running this through ATH and bom ?

ATH was passing, PRs filed to adapt plugins.

enable compatability with future Jenkins version bitbucket-branch-source-plugin#1150
Adapt to enablement of Overall/Manage permission config-file-provider-plugin#421 (released as 1006.vc7366c201f57)
Adapt to enablement of Overall/Manage permission kubernetes-plugin#1779 (released as 4398.vb_b_33d9e7fe23)
Adapt to enablement of Overall/Manage permission mailer-plugin#401 (released as 525.v2458b_d8a_1a_71)
Adapt tests to enablement of Overall/Manage permission role-strategy-plugin#432 (released as 848.va_a_ea_673cf0b_c)

As the adaptions is purely for tests and not production code I would prefer that we would merge this and then skip the affected tests in the BOM until plugins catch up (I can file a PR to exclude them). WDYT?

timja · 2025-12-02T13:55:17Z

As the adaptions is purely for tests and not production code I would prefer that we would merge this and then skip the affected tests in the BOM until plugins catch up (I can file a PR to exclude them). WDYT?

We can do although lets give them a little bit of time first, there's no rush here as there's a security release next week so there's at least 2 weeks before this can be released.

jtnord · 2025-12-02T13:56:06Z

We can do although lets give them a little bit of time first, there's no rush here as there's a security release next week so there's at least 2 weeks before this can be released.

I really want this in the next LTS - so to me there is a rush so this lands in this weeks release :)

…nkins version as well as a version containing the PR (#401) discovered by jenkinsci/bom#6031 in preparation for jenkinsci/jenkins#23873 tested with mvn test -Djenkins.version=2.540-rc37747.87da_150079a_1

daniel-beck · 2025-12-02T14:17:02Z

I really want this in the next LTS - so to me there is a rush so this lands in this weeks release :)

It won't, unless the LTS decision is delayed even further.

jtnord · 2025-12-02T14:19:26Z

I really want this in the next LTS - so to me there is a rush so this lands in this weeks release :)

It won't, unless the LTS decision is delayed even further.

I don't follow
Whilst it should have already happened, I was under the impression that the decision would now be taken on the 10th.

And yes tomorrow's weekly would not meet the strict 2 week guidelines but that's not stopped us before.

daniel-beck · 2025-12-02T14:36:04Z

And yes tomorrow's weekly would not meet the strict 2 week guidelines but that's not stopped us before.

This week's weekly is already out. I don't think they were ever released on Wednesdays unless coinciding with a security release.

Since there's going to be security releases next week (TBA properly probably tomorrow), and we never include non-security changes in security fix weeklies, anything currently unreleased will not be released before Dec 16.

jtnord · 2025-12-02T14:39:12Z

And yes tomorrow's weekly would not meet the strict 2 week guidelines but that's not stopped us before.

This week's weekly is already out. I don't think they were ever released on Wednesdays unless coinciding with a security release.

oh, I don't think I ever noticed that distinction I thought I had another day :(

Adapts to jenkinsci/jenkins#23873 so the tests pass on the current Jenkins version as well as a version containing the PR

make the MANAGE permission enabled by default

59b491a

Removed experimental warning for MANAGE permission and enable it by default.

jtnord added enhancement rfe For changelog: Minor enhancement. use `major-rfe` for changes to be highlighted and removed enhancement labels Nov 27, 2025

timja reviewed Dec 1, 2025

View reviewed changes

update tests to accomodate enabling of Overall/Manage

87da150

jtnord mentioned this pull request Dec 1, 2025

Start the removal of obsolete permissions #23883

Draft

14 tasks

jglick approved these changes Dec 1, 2025

View reviewed changes

jtnord marked this pull request as ready for review December 1, 2025 18:30

jtnord requested a review from mikecirioli December 1, 2025 18:31

mikecirioli approved these changes Dec 1, 2025

View reviewed changes

jtnord added a commit to jenkinsci/acceptance-test-harness that referenced this pull request Dec 1, 2025

pre-testing jenkinsci/jenkins#23873

d93580a

jtnord mentioned this pull request Dec 1, 2025

pre-testing https://github.com/jenkinsci/jenkins/pull/23873 jenkinsci/acceptance-test-harness#2278

Closed

6 tasks

jtnord added a commit to jtnord/bom that referenced this pull request Dec 1, 2025

pretesting jenkinsci/jenkins#23873

cc805f2

jtnord mentioned this pull request Dec 1, 2025

pretesting https://github.com/jenkinsci/jenkins/pull/23873 jenkinsci/bom#6031

Draft

6 tasks

jtnord added a commit to jtnord/bitbucket-branch-source-plugin that referenced this pull request Dec 2, 2025

enable compatability with future Jenkins version

1ac55f5

Adapts to jenkinsci/jenkins#23873 so the tests pass on the current Jenkins version as well as a version containing the PR

jtnord mentioned this pull request Dec 2, 2025

enable compatability with future Jenkins version jenkinsci/bitbucket-branch-source-plugin#1150

Merged

6 tasks

jtnord mentioned this pull request Dec 2, 2025

Adapt to enablement of Overall/Manage permission jenkinsci/config-file-provider-plugin#421

Merged

6 tasks

jtnord mentioned this pull request Dec 2, 2025

Adapt to enablement of Overall/Manage permission jenkinsci/kubernetes-plugin#1779

Merged

6 tasks

jtnord mentioned this pull request Dec 2, 2025

Adapt to enablement of Overall/Manage permission jenkinsci/mailer-plugin#401

Merged

6 tasks

jtnord mentioned this pull request Dec 2, 2025

Adapt tests to enablement of Overall/Manage permission jenkinsci/role-strategy-plugin#432

Merged

6 tasks

jtnord mentioned this pull request Dec 2, 2025

Update scheduling information for security advisories jenkins-infra/jenkins.io#8583

Merged

Uh oh!

make the MANAGE permission enabled by default #23873

Are you sure you want to change the base?

make the MANAGE permission enabled by default #23873

Conversation

jtnord commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing done

Proposed changelog entries

Proposed changelog category

Proposed upgrade guidelines

Submitter checklist

Desired reviewers

Maintainer checklist

Uh oh!

timja Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jtnord Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

jglick left a comment

Choose a reason for hiding this comment

Uh oh!

mikecirioli left a comment

Choose a reason for hiding this comment

Uh oh!

timja commented Dec 1, 2025

Uh oh!

jtnord commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

timja commented Dec 2, 2025

Uh oh!

jtnord commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

daniel-beck commented Dec 2, 2025

Uh oh!

jtnord commented Dec 2, 2025

Uh oh!

daniel-beck commented Dec 2, 2025

Uh oh!

jtnord commented Dec 2, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

jtnord commented Nov 27, 2025 •

edited

Loading

timja Dec 1, 2025 •

edited

Loading

jtnord commented Dec 2, 2025 •

edited

Loading

jtnord commented Dec 2, 2025 •

edited

Loading