JENKINS-61207 System read - logs (#4530)

Co-Authored-By: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>

core/src/main/java/hudson/logging/LogRecorder.java

@@ -68,7 +68,7 @@ import org.kohsuke.stapler.verb.POST;
  * TODO: still a work in progress.
  *
  * <h3>Access Control</h3>
- * {@link LogRecorder} is only visible for administrators, and this access control happens at
+ * {@link LogRecorder} is only visible for administrators and system readers, and this access control happens at
  * {@link jenkins.model.Jenkins#getLog()}, the sole entry point for binding {@link LogRecorder} to URL.
  *
  * @author Kohsuke Kawaguchi
@@ -332,6 +332,8 @@ public class LogRecorder extends AbstractModelObject implements Saveable {
      */
     @POST
     public synchronized void doConfigSubmit( StaplerRequest req, StaplerResponse rsp ) throws IOException, ServletException {
+        Jenkins.get().checkPermission(Jenkins.ADMINISTER);
+
         JSONObject src = req.getSubmittedForm();
 
         String newName = src.getString("name"), redirect = ".";
@@ -358,6 +360,8 @@ public class LogRecorder extends AbstractModelObject implements Saveable {
 
     @RequirePOST
     public HttpResponse doClear() throws IOException {
+        Jenkins.get().checkPermission(Jenkins.ADMINISTER);
+
         handler.clear();
         return HttpResponses.redirectToDot();
     }
@@ -385,6 +389,8 @@ public class LogRecorder extends AbstractModelObject implements Saveable {
      */
     @RequirePOST
     public synchronized void doDoDelete(StaplerResponse rsp) throws IOException, ServletException {
+        Jenkins.get().checkPermission(Jenkins.ADMINISTER);
+
         getConfigFile().delete();
         getParent().logRecorders.remove(name);
         // Disable logging for all our targets,

core/src/main/java/hudson/logging/LogRecorderManager.java

@@ -112,6 +112,8 @@ public class LogRecorderManager extends AbstractModelObject implements ModelObje
      */
     @RequirePOST
     public HttpResponse doNewLogRecorder(@QueryParameter String name) {
+        Jenkins.get().checkPermission(Jenkins.ADMINISTER);
+
         Jenkins.checkGoodName(name);
         
         logRecorders.put(name,new LogRecorder(name));
@@ -208,7 +210,7 @@ public class LogRecorderManager extends AbstractModelObject implements ModelObje
     @Restricted(NoExternalUse.class)
     public Object getTarget() {
         if (!SKIP_PERMISSION_CHECK) {
-            Jenkins.get().checkPermission(Jenkins.ADMINISTER);
+            Jenkins.get().checkPermission(Jenkins.SYSTEM_READ);
         }
         return this;
     }

core/src/main/java/jenkins/management/SystemLogLink.java

@@ -26,6 +26,8 @@ package jenkins.management;
 
 import hudson.Extension;
 import hudson.model.ManagementLink;
+import hudson.security.Permission;
+import jenkins.model.Jenkins;
 import org.jenkinsci.Symbol;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
@@ -55,6 +57,12 @@ public class SystemLogLink extends ManagementLink {
         return "log";
     }
 
+    @NonNull
+    @Override
+    public Permission getRequiredPermission() {
+        return Jenkins.SYSTEM_READ;
+    }
+    
     @NonNull
     @Override
     public Category getCategory() {

core/src/main/java/jenkins/model/Jenkins.java

@@ -2559,7 +2559,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
      * Everything below here is admin-only, so do the check here.
      */
     public LogRecorderManager getLog() {
-        checkPermission(ADMINISTER);
+        checkPermission(SYSTEM_READ);
         return log;
     }