Script approval and sandbox in Jenkins - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Jenkins Script Approval Purpose

Why does Jenkins require script approval for certain scripts in the pipeline?

A To prevent execution of potentially unsafe scripts that could harm the system or leak data

B To speed up the execution of all pipeline scripts

C To automatically fix syntax errors in pipeline scripts

D To allow all users to run any script without restrictions

💡 Hint

Think about security risks when running scripts from different users.

Jenkins script approval is a security feature that blocks untrusted scripts from running until an administrator approves them. This prevents malicious or harmful code from executing.

💻 Command Output

intermediate

Output of Jenkins Script Approval Status Command

What is the output of the following Jenkins CLI command when there are pending scripts for approval?

Jenkins

java -jar jenkins-cli.jar -s http://jenkins.example.com/ list-plugins --pending-script-approvals

A Error: Unknown command 'list-plugins --pending-script-approvals'

B

Pending script approvals:
- method java.lang.Runtime exec java.lang.String
- method hudson.FilePath write java.lang.String

C No pending script approvals found.

D List of installed plugins with no script approval info

💡 Hint

Check if the command syntax matches Jenkins CLI commands for script approval.

The command 'list-plugins --pending-script-approvals' is invalid. The correct command to list pending script approvals is 'groovy =< script' or using the Jenkins UI. So this command returns an error.

❓ Configuration

advanced

Configuring Jenkins to Automatically Approve Safe Scripts

Which configuration snippet in Jenkins Pipeline script allows a method call to be automatically approved without manual intervention?

A Use 'allowUnsafeScripts()' function in the pipeline script

B In Jenkins Script Security plugin, add the method signature 'hudson.FilePath write java.lang.String' to the approved signatures list

C Set 'sandbox = false' in the pipeline script to disable script approval

D Add 'approveAllScripts = true' in the Jenkinsfile

💡 Hint

Think about how Jenkins manages method signatures for script security.

Jenkins Script Security plugin lets administrators approve specific method signatures. Adding a method signature to the approved list allows scripts using that method to run without manual approval each time.

❓ Troubleshoot

advanced

Troubleshooting Script Rejection in Jenkins Sandbox

A Jenkins pipeline script fails with a security exception when calling a custom method. What is the most likely cause?

A The Jenkins server is offline

B The pipeline script has syntax errors unrelated to security

C The method is not approved in the Jenkins script approval list and sandbox blocks it

D The Jenkinsfile is missing the 'pipeline' block

💡 Hint

Consider Jenkins sandbox restrictions on unapproved methods.

Jenkins sandbox restricts execution of unapproved methods for security. If a custom method is not approved, the script will fail with a security exception.

🔀 Workflow

expert

Correct Workflow for Approving a New Script Method in Jenkins

What is the correct sequence of steps to approve a new method call used in a Jenkins pipeline script that is currently blocked by the sandbox?

A 2,1,3,4

B 2,3,1,4

C 1,3,2,4

D 1,2,3,4

💡 Hint

Think about how Jenkins detects and approves new script methods step-by-step.

The pipeline must first run to create a pending approval request. Then an admin logs in, navigates to the approval page, and approves the method signature.

Practice

1. What is the main purpose of script approval in Jenkins?

easy

A. To automatically run all scripts without restrictions

B. To protect Jenkins by allowing admins to approve unsafe scripts before execution

C. To speed up the build process by skipping script checks

D. To disable all scripts in Jenkins

Solution

1. Step 1: Understand script approval role

   Script approval is designed to protect Jenkins by controlling which scripts can run.

2. Step 2: Identify admin involvement

   Admins review and approve scripts to prevent unsafe code from running.

3. Final Answer:

   To protect Jenkins by allowing admins to approve unsafe scripts before execution -> Option B

4. Quick Check:

   Script approval = Admin review for safety [OK]

Hint: Script approval means admin checks scripts before running [OK]

Common Mistakes:

• Thinking scripts run automatically without checks
• Confusing script approval with disabling scripts
• Assuming script approval speeds up builds

2. Which of the following is the correct way to enable sandbox mode in a Jenkins Pipeline script?

easy

A. Check the 'Use Groovy Sandbox' option in the Pipeline script configuration

B. Use @Sandbox annotation at the top of the script

C. Add sandbox=true inside the Jenkinsfile

D. Enable sandbox mode in Jenkins global settings only

Solution

1. Step 1: Identify sandbox enabling method

   Sandbox mode is enabled by checking the 'Use Groovy Sandbox' box in the Pipeline script configuration.

2. Step 2: Verify other options

   Annotations or code inside Jenkinsfile do not enable sandbox; global settings do not control this per script.

3. Final Answer:

   Check the 'Use Groovy Sandbox' option in the Pipeline script configuration -> Option A

4. Quick Check:

   Sandbox enabled via checkbox in script config [OK]

Hint: Sandbox mode is a checkbox in Pipeline script config [OK]

Common Mistakes:

• Trying to enable sandbox with code annotations
• Assuming sandbox is a global-only setting
• Adding sandbox flags inside Jenkinsfile

3. Given this Jenkins Pipeline snippet running with sandbox enabled:

node {
  def result = sh(script: 'echo Hello', returnStdout: true).trim()
  echo result
}

What will be the output?

medium

A. No output because sandbox blocks shell commands

B. Syntax error due to sandbox

C. result

D. Hello

Solution

1. Step 1: Analyze the sh step

   sh(script: 'echo Hello', returnStdout: true).trim() executes 'echo Hello', captures stdout, trims to 'Hello', assigns to result.

2. Step 2: Analyze echo step

   echo result prints the value of result ('Hello'). In Jenkins Pipeline, the echo step prints variable values directly. Sandbox allows whitelisted steps like sh and echo.

3. Final Answer:

   Hello -> Option D

4. Quick Check:

   sh captures stdout, echo prints var value [OK]

Hint: In Pipeline, echo result prints result's value [OK]

Common Mistakes:

• Thinking echo prints literal 'result' like shell
• Believing sandbox blocks whitelisted sh commands
• Expecting syntax error from sandbox

4. You wrote a Jenkins Pipeline script that uses a method not whitelisted in the sandbox. The build fails with a script approval error. What should you do to fix this?

medium

A. Restart Jenkins to clear the error

B. Remove sandbox mode and run the script without restrictions

C. Ask the Jenkins admin to approve the method in the script approval page

D. Rewrite the script to avoid using any methods

Solution

1. Step 1: Understand script approval error cause

   The error occurs because the method is not approved in Jenkins script approval.

2. Step 2: Fix by admin approval

   The correct fix is to have the Jenkins admin approve the method via the script approval UI.

3. Final Answer:

   Ask the Jenkins admin to approve the method in the script approval page -> Option C

4. Quick Check:

   Approval needed for unapproved methods [OK]

Hint: Unapproved methods need admin approval, not disabling sandbox [OK]

Common Mistakes:

• Disabling sandbox instead of approving scripts
• Trying to remove methods instead of approval
• Restarting Jenkins does not fix approval errors

5. You want to run a custom Groovy script in Jenkins Pipeline that uses a non-whitelisted method and also requires sandbox protection. Which approach correctly balances safety and functionality?

hard

A. Run the script with sandbox enabled and request admin approval for the method

B. Disable sandbox and run the script directly to avoid approval delays

C. Rewrite the script to avoid all non-whitelisted methods, ignoring sandbox

D. Run the script outside Jenkins and import results to avoid sandbox issues

Solution

1. Step 1: Understand sandbox and approval roles

   Sandbox protects Jenkins by restricting unsafe code; approval allows safe exceptions.

2. Step 2: Balance safety and functionality

   Enabling sandbox with admin approval keeps Jenkins safe while allowing needed methods.

3. Final Answer:

   Run the script with sandbox enabled and request admin approval for the method -> Option A

4. Quick Check:

   Sandbox + approval = safe and functional scripts [OK]

Hint: Use sandbox plus admin approval for safe custom scripts [OK]

Common Mistakes:

• Disabling sandbox risking Jenkins security
• Avoiding needed methods by rewriting scripts unnecessarily
• Running scripts outside Jenkins complicates workflow