Advanced File Access Rules Administrators may also whitelist classes by creating files with the  .conf  extension in the directory JENKINS_HOME/secrets/whitelisted-callables.d/ . The contents of these  .conf  files should list command names on separate lines. The contents of all the  .conf  files in the directory will be read by Jenkins and combined to create a default.conf  file in the directory which lists all known safe command. The  default.conf  file will be re-written each time Jenkins boots. Jenkins also manages a file named  gui.conf , in the  whitelisted-callables.d  directory, where commands added via the web UI are written. In order to disable the ability of administrators to change whitelisted commands from the web UI, place an empty  gui.conf  file in the directory and change its permissions such that is not writeable by the operating system user Jenkins run as. The File Access Rules are used to validate file access requests made from agents to the master. Each File Access Rule is a triplet which must contain each of the following elements: 1. allow  /  deny : if the following two parameters match the current request being considered, an allow  entry would allow the request to be carried out and a  deny  entry would deny the request to be rejected, regardless of what later rules might say. 2. operation : Type of the operation requested. The following 6 values exist. The operations can also be combined by comma-separating the values. The value of  all  indicates all the listed operations are allowed or denied. ◦ read : read file content or list directory entries ◦ write : write file content ◦ mkdirs : create a new directory ◦ create : create a file in an existing directory ◦ delete : delete a file or directory 154