Access Denied in media application but can read data in it

[aerospyke]

Hey all,

Firstly, i'm migrating from another NAS box and I am testing access as I migrate from old NAS (QNAP) to TrueNAS Scale.

I am using Emby as an application on a windows box elsewhere. I have set the permissions for my dataset and SMB share to match the same as the existing share.

My box is AD integrated and share permissions are everyone/full, SMB (NFSv4 permission type) share is

domain\media user /modify
domain\media group /modify (contains AD computer account of Emby server that runs the emby server application, and AD user account that runs the emby client application
domain\admins /full (for admin and general troubleshooting but would love to remove this down the track as it's not how I use it on old NAS so not required long term

My problem is this. The server application can see the share, it can traverse the contents and read all the media content so the application can play videos. WIN. BUT any new content is not added to the database. Looking at the server logs, I'm getting access denied messages.

Is anyone able to help out on if computer accounts are handled differently for permissions? I cannot currently change the service to run under a different user account other than a domain admin (which fixes it but I don't want this). I've checked with the application side and it is confirmed what user account i'm troubleshooting is the one running the service (in this case, the AD service account of the computer, which is part of the AD security group "media group".

 

[sretalla]

Go to that directory from the shell and do ls -l (you may also need to use getfacl to see additional Windows Permissions)

Whatever application you're using to get the new files is probably operating as root or something, so you'll see that there on the new files.

Either change the program that is grabbing the new files to make it assign permissions differently or run it as a user that has the permissions you want on the share.

 

[aerospyke]

Thanks, so it looks like it's creating the files with the owner groups,... the windows permissions on one of the new files shows the permissions i expected from the file permissions (not share) ... which is confusing ... I'm assuming TrueNAS can interpret a computer account as accessing a file if it's part of the owners group (even if it's not the owner user).

 

[anodos]

Your user (or a group they are a member of) needs execute (x) permissions on _every_ path component leading to `Media`. I'd start with reviewing permissions on full path.

 

[aerospyke]

Your user (or a group they are a member of) needs execute (x) permissions on _every_ path component leading to `Media`. I'd start with reviewing permissions on full path.

Thanks, I went back on permissions on all datasets above this one, and even though they were all set to inherit, I just told it to re-apply anyway.... started working after that. Something got out of sync it seems. Simple fix. Thanks!

 

[anodos]

Thanks, I went back on permissions on all datasets above this one, and even though they were all set to inherit, I just told it to re-apply anyway.... started working after that. Something got out of sync it seems. Simple fix. Thanks!

Inherit only gets evaluated on new file / dir creation. If user or application decides to `chmod 770` a path component after the fact, then permissions will be broken.