I have an installation of Jenkins on my server I use for continuous integration of a beta website. The configuration is pretty simple, I just use the proper directory in /var/www/ as the workspace, and Git with the Git plugin for source control.

I recently installed CSF on the server, and it keeps reporting the temp files Jenkins is making are 'suspicious'. Here is a log of the most recent report:

Time:   Mon Aug 24 16:11:08 2015 -0400
File:   /tmp/jffi6688931929611009979.tmp
Reason: Linux Binary
Owner:  jenkins:jenkins (112:120)
Action: No action taken

The file in question appears to legitimately be an executable file. My question is, why is Jenkins creating temporary executable files?

Note: The server is 100% PHP based, Jenkins should not create any executables from it!

The files seem to be created whenever Jenkins builds a project, even though the build step just puts the password into the correct config file. Nope, they randomly pop up around twice an hour or so.

file output on one of the files:

$ file /tmp/jffi6688931929611009979.tmp
/tmp/jffi6688931929611009979.tmp: ELF 64-bit LSB  shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped

Plugin list:

  • Ant Plugin
  • Build Monitor View
  • Credentials Binding Plugin
  • Credentials Plugin
  • CVS Plug-in
  • disk-usage plugin
  • External Monitor Job Type Plugin
  • GIT client plugin
  • GIT plugin
  • Javadoc Plugin
  • JUnit Plugin
  • LDAP Plugin
  • Mailer Plugin
  • Matrix Authorization Strategy Plugin
  • Matrix Project Plugin
  • Maven Integration plugin
  • OWASP Markup Formatter Plugin
  • PAM Authentication plugin
  • Plain Credentials Plugin
  • SCM API Plugin
  • Script Security Plugin
  • SSH Credentials Plugin
  • SSH Slaves plugin
  • Translation Assistance plugin
  • Windows Slaves Plugin
  • Workflow: Step API
  • 2
    Have you tried looking at the contents of the file ?
    – user9517
    Aug 24 '15 at 21:21
  • They're binary files (Like Windows's .exe). As far as I can see, they just contain random data, and I'm too scared to try running them. I'll see if I can make a VM to run them on that isn't connected to the internet.
    – ConnorJC
    Aug 24 '15 at 22:42
  • 1
    What does the 'file' command report those files as being?
    – Grant
    Aug 24 '15 at 23:06
  • An ELF (*nix executable) - Added the full result to the answer
    – ConnorJC
    Aug 24 '15 at 23:10

Jenkins is a Java program.

Java programs requiring native libraries may extract the native .so or .dll file from its .jar files into /tmp to be able to properly load the native library.

I don't think that standard Jenkins would include plugins which require native libraries. Maybe one of the plugins you installed requires native libraries?

  • Added my plugin list. Do any look like culprits? None of them do to me, especially since I've discovered these files are dropped randomly, not just during builds.
    – ConnorJC
    Aug 26 '15 at 23:18

OK, I discovered the problem. The file in question was a Jenkins update. I didn't notice that the file was improperly not getting deleted, and all the alerts were about the same file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.