Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Next challenges

Recent achievements

  • Global
  • Personal

Recognition

  • Give kudos
  • Received
  • Given

Leaderboard

  • Global

Trophy case

Kudos (beta program)

Kudos logo

You've been invited into the Kudos (beta program) private group. Chat with others in the program, or give feedback to Atlassian.

View group

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage
Highlighted

Bamboo does not clean up orphaned processes - security issue Edited

Hi all,

On both windows and linux agents and the latest version of Bamboo, it is very simple to detach a process from the parent bamboo build process, so that it continues to run after the build returns.

One can observe this for example with gradle builds, whereby the gradle deamon will stay running on the agent in the background. Windows generally launches processes in a detached mode, so if a build plan does a "Start-Process notepad", the notepad will stay open after the build returns. Same for linux. Very easy to detach, e.g. a sleep command with /bin/bash -c 'sleep 60  > /dev/null 2>&1 &'.

While this can be a stability issue for agents, it is a pretty sever security issue. A rogue process running on the remote agent can spy on anything that a subsequent build plan is executing. This may be passwords (even if passed by the plan as "password/secret variables", these values are stored as simple environment variables on the remote agent while a build is executing), or confidential source code in the build directory, just to name two prominent candidates.

I wonder how other companies are dealing with this problem? Has anyone found a good solution / written a plugin that takes care of the cleanup in a reliable way? Or are you opting for completely different architectures like "disposable" agents (run agents as containers and re-instantiate after each build)? 

Atlassian Bamboo team, is this on your radar? What is your take on this? We investigated the same behavior in VSTS, which is reliably cleaning up orphan processes after the build. Not sure about other CI/CD platforms.

Thanks

 

1 comment

Omar Herrera Community Leader Jan 07, 2019

Hi @Johannes A, I think the future is run agents as containers, in bamboo you are ready to run build process in docker support is a perfect way to  isolated each build.

Cheers.

Omar H.

Comment

Log in or Sign up to comment
TAGS
Community showcase
Published in Bamboo

Bamboo 7.2 is here!

I'm happy to announce that Bamboo 7.2 has been released and it’s overflowing with awesome new features. This will be the last major Server release before the launch of Bamboo DC. Bamboo logs We...

165 views 2 5
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you