Hudson post build step security issue

Question

Hudson jobs can be configured to have a post build step which can execute shell commands as an option, accidently or intentionally someone can wipe out the hudson home directory just by running rm command is there a specific set of permission of home directory which will prevent such scenario

Answer 1

On Linux, you will likely be running the Hudson process as the "hudson" user. Using a combination of chown and chmod, you can set the permissions on the hudson application server directory such that the hudson user only has read-access of the Hudson application server directory.

Hudson stores all of its file storage in /var/lib/jenkins by default (if you're using the .deb package).

so basically, make sure that the hudson user has recursive write access of that directory, allow hudson read-only access of the other Hudson installation files, and no access over any other file.