[JENKINS-67173] Remove agent-to-controller kill switch, FilePath support for a2c, etc.

[jenkins-infra-bot]

Followup to https://www.jenkins.io/security/advisory/2021-11-04/ :

• Remove the ability to disable agent-to-controller access control
• Remove the customizable callable allowlist
• Remove the capability for FilePath methods to operate in the agent-to-controller direction
  • Remove the customizable file path filter allowlist supporting this
• Deprecate SlaveToMasterFileCallable

 

---

Originally reported by danielbeck, imported from: Remove agent-to-controller kill switch, FilePath support for a2c, etc.

• assignee: danielbeck
• status: Resolved
• priority: Major
• component(s): core
• label(s): security
• resolution: Fixed
• resolved: 2022-01-05T11:10:49+00:00
• votes: 1
• watchers: 3
• imported: 2025-11-24

Raw content of original issue

Followup to https://www.jenkins.io/security/advisory/2021-11-04/ :

	
Remove the ability to disable agent-to-controller access control
	
Remove the customizable callable allowlist
	
Remove the capability for FilePath methods to operate in the agent-to-controller direction
	

		
Remove the customizable file path filter allowlist supporting this
	
	
	
Deprecate SlaveToMasterFileCallable



 

[jenkins-infra-bot]

• Remote links associated with this issue:

  • jep #​381
  • JEP-235
  • jenkinsci/jenkins#​5885
  • jenkinsci/jenkins#​5884

[jenkins-infra-bot]

danielbeck:

• Original comment link
• Raw content of original comment:

  Proposed JEP: [JENKINS-67173] Simplify agent-to-controller security jep#381
  

Proposed JEP: jenkinsci/jep#381

[jenkins-infra-bot]

danielbeck:

• Original comment link
• Raw content of original comment:

  The core changes were delivered in Jenkins 2.326. Some plugins still need adapting, but that's up to their maintainers.
  

The core changes were delivered in Jenkins 2.326. Some plugins still need adapting, but that's up to their maintainers.