◦ stat : read metadata of a file/directory, such as timestamp, length, file access modes. ◦ <JENKINS_HOME>  can be used as a prefix to match the master’s  JENKINS_HOME  directory. ◦ <BUILDDIR>  can be used as a prefix to match the build record directory, such as /var/lib/jenkins/job/foo/builds/2014-10-17_12-34-56 . ◦ <BUILDID>  matches the timestamp-formatted build IDs, like  2014-10-17_12-34-56 . 3. file path : regular expression that specifies file paths that matches this rule. In addition to the base regexp syntax, it supports the following tokens: The rules are ordered, and applied in that order. The earliest match wins. For example, the following rules allow access to all files in  JENKINS_HOME  except the  secrets  folders: Ordering is very important! The following rules are incorrectly written because the 2nd rule will never match, and allow all agents to access all files and folders under  JENKINS_HOME : Administrators may also add File Access Rules by creating files with the  .conf.  extension in the directory  JENKINS_HOME/secrets/filepath-filters.d/ . Jenkins itself generates the  30-default.conf  file on boot in this directory which contains defaults considered the best balance between compatibility and security by the Jenkins project. In order to disable these built-in defaults, replace  30- default.conf  with an empty file which is not writable by the operating system user Jenkins run as. On each boot, Jenkins will read all  .conf  files in the  filepath-filters.d  directory in alphabetical order, therefore it is good practice to name files in a manner which indicates their load order. Jenkins also manages  50-gui.conf , in the  filepath-filters/  directory, where File Access Rules added via the web UI are written. In order to disable the ability of administrators to change the File Access Rules from the web UI, place an empty  50-gui.conf  file in the directory and change its permissions such that is not writeable by the operating system user Jenkins run as. While it is not recommended, if all agents in a Jenkins environment can be considered "trusted" to the same degree that the master is trusted, the Agent/Master Access Control feature may be disabled. Additionally, all the users in the Jenkins environment should have the same level of access to all configured projects. 155 Disabling Advanced # To avoid hassle of escaping every '\' on Windows, you can use / even on Windows. deny all <JENKINS_HOME>/secrets/.* allow all <JENKINS_HOME>/.* allow all <JENKINS_HOME>/.* deny all <JENKINS_HOME>/secrets/.*