SOLVED Permissions - Suddenly unable to READ pdf files on NAS (OSX+AFP+mac)

[Eniac74]

A surprising and very nerve-wrecking discovery - I am not able to open PDF-files on my NAS (AFP share, mac permissions). This seems to have happened following a migration of data from Volume1 to Volume2 (new disks).
In short, the same files currently exist on both Volume1 and Volume2. The PDF-file I was unable to open on Volume2 I was expecting to be able to open Volume1, where it initially came from, and where PDF-files were easily opened prior to the installation of Volume2. No such luck unfortunately. The same goes for picture files (TIFF, JPG), but with Office files (PPTX, DOCX, XLSX) there is no problem. Very confusing to me...

I used the 'setfacl' command to grant 'everyone' read access to one of the PDF-files, but it changed nothing. I am still getting "the file couldn't be opened because you don't have permission to view it." when I try to open it.

From CLI I have the following permissions set for the file:

1. 
   # owner: User1
   # group: GrpUser1
   owner@:rwxp--aARWcCos:------:allow
   group@:r-x---a-R-c--s:------:allow
   everyone@:r-----a-R-c--s:------:allow
   

What could be the problem? Is there some way to revert to "factory settings" and start over with permissions again?

 

[Eniac74]

OK, after trying to access the same files from an old MBP running Snow Leopard instead, I homed in on the problem. The problem lies in OSX 10.11 (El Capitan).

With that version of OSX they introduced something called SIP, which is meant to protect the OS from malice, by locking out root-level access to core files. However, it also seems to copulate the permissions upwards. This is what happened to me apparently, when suddenly all PDF and picture files suddenly were unreadable.

SOLUTION
What you need to do is fix those broken permissions (in OSX). What I did (which worked for me) was simply

1. disable SIP,
2. reboot machine and enter the NAS (verifying that files were again readable),
3. enable SIP again.

This is one guide to how to disable/enable SIP:
http://osxdaily.com/2015/10/05/disable-rootless-system-integrity-protection-mac-os-x/

Hope this helps someone from feeling the same frustration as I did.