[JENKINS-38187] Make slaveAgentPort readonly in case the enforce flag is set

core/src/main/java/hudson/security/GlobalSecurityConfiguration.java

@@ -72,6 +72,10 @@ public class GlobalSecurityConfiguration extends ManagementLink implements Descr
         return Jenkins.getInstance().getSlaveAgentPort();
     }
 
+    public boolean isSlaveAgentPortEnforced() {
+        return Jenkins.getInstance().isSlaveAgentPortEnforced();
+    }
+
     public Set<String> getAgentProtocols() {
         return Jenkins.getInstance().getAgentProtocols();
     }

core/src/main/java/jenkins/model/Jenkins.java

@@ -1104,11 +1104,21 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
         return slaveAgentPort;
     }
 
+    public boolean isSlaveAgentPortEnforced() {
+        return Jenkins.SLAVE_AGENT_PORT_ENFORCE;
+    }
+
     /**
      * @param port
      *      0 to indicate random available TCP port. -1 to disable this service.
      */
     public void setSlaveAgentPort(int port) throws IOException {
+        if (!SLAVE_AGENT_PORT_ENFORCE) {
+            forceSetSlaveAgentPort(port);
+        }
+    }
+
+    private void forceSetSlaveAgentPort(int port) throws IOException {
         this.slaveAgentPort = port;
         launchTcpSlaveAgentListener();
     }
@@ -1240,7 +1250,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
         }
 
         public void doAct(StaplerRequest req, StaplerResponse rsp) throws IOException {
-            j.setSlaveAgentPort(getExpectedPort());
+            j.forceSetSlaveAgentPort(getExpectedPort());
             rsp.sendRedirect2(req.getContextPath() + "/manage");
         }
 

core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.groovy

@@ -26,8 +26,18 @@ l.layout(norefresh:true, permission:app.ADMINISTER, title:my.displayName, csscla
             set("descriptor", my.descriptor);
 
             f.optionalBlock( field:"useSecurity", title:_("Enable security"), checked:app.useSecurity) {
-                f.entry (title:_("TCP port for JNLP agents"), field:"slaveAgentPort") {
-                    f.serverTcpPort()
+                f.entry(title: _("TCP port for JNLP agents"), field: "slaveAgentPort") {
+                    if (my.slaveAgentPortEnforced) {
+                        if (my.slaveAgentPort == -1) {
+                            text(_("slaveAgentPortEnforcedDisabled"))
+                        } else if (my.slaveAgentPort == 0) {
+                            text(_("slaveAgentPortEnforcedRandom"))
+                        } else {
+                            text(_("slaveAgentPortEnforced", my.slaveAgentPort))
+                        }
+                    } else {
+                        f.serverTcpPort()
+                    }
                 }
                 f.advanced(title: _("Agent protocols"), align:"left") {
                     f.entry(title: _("Agent protocols")) {

core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.properties

+slaveAgentPortEnforced=enforced to {0,number,#} on startup through system property.
+slaveAgentPortEnforcedRandom=enforced to random port on startup through system property.
+slaveAgentPortEnforcedDisabled=disabled on startup through system property.