Trying to set tight permissions on my future NAS.
The essential on what I have:
TrueNAS NFS storage <- mounted via NFS -> Proxmox VE Host <-> Debian 12 VM
That's all fine and so on.
My little Debian VM:
NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1 vfat FAT32 A5D7-88E3 505.1M 1% /boot/efi
└─sda2 ext4 1.0 3c43a477-51fd-425b-aee8-a6e75224f781 48.5G 16% /
sdb
└─sdb1 ext4 1.0 media e3e0eac5-806a-44e9-a0e9-07fb99a18281 933.2G 0% /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281
sdc
└─sdc1 ext4 1.0 nas 0f3a3d74-901d-4243-b20b-59210c1cee18 46.4G 0% /srv/dev-disk-by-uuid-0f3a3d74-901d-4243-b20b-59210c1cee18
sdd
└─sdd1 ext4 1.0 backup fbe21b9f-2339-4223-ac7e-00e75374fc32 46.4G 0% /srv/dev-disk-by-uuid-fbe21b9f-2339-4223-ac7e-00e75374fc32
sr0
Background:
- media = media library for Jellyfin
- nas = small (future) file server for my PC running Windows
- backup = used to store backups of various services like Firewall backups with SFTP etc.
The storage on the debian VM will be mounted by a NUC running bare metal Debian due to hardware acceleration. The proxmox host is unable to do it due to it also being a NUC. But I like the flexibility I will soon have because I can just nuke my bare-metal NUC without loosing any data.
Anyway my real problem is with permissions on my media drive.
My permissions right now are as following:
1. /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281# ls -l media
drwxrwxr-x 3 nobody nogroup 4096 Oct 12 20:45 media
2. /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media# ls -l data
drwxrwsr-x+ 6 mediaU serviceG 4096 Oct 13 00:21 data
3. /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# ls -l *
drwxrwsr-x+ 7 mediaU serviceG 4096 Oct 13 00:21 media
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 recycle_bin
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 torrents
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 usenet
4. /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data/media# ls -l *
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 anime
drwxrwsr-x+ 3 mediaU serviceG 4096 Oct 13 00:22 movie
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 music
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 soundtrack
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 tv
Current directory tree:
srv-dev-disk-by-uuid-XXX/
└── media
└── data
├── media
│ ├── anime
│ ├── movie
│ ├── music
│ ├── soundtrack
│ └── tv
├── recycle_bin
├── torrents
└── usenet
What I am trying is:
- Docker host mounts
/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/mediavia NFS - The docker containers should only be able to access the the
datadirectory inside it (2.ls -l) as mediaU:serviceG - In addition I wanna access, modify and move files with my windows user without being part of the service group. Because of this I have setup SGID and ACL on the
/media/data/mediafolder. The ACL was set recursive as follows:
/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# getfacl media/
# file: media/
# owner: mediaU
# group: serviceG
# flags: -s-
user::rwx
group::rwx
group:extUserG:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:extUserG:rwx
default:mask::rwx
default:other::r-x
So far so good. mediaU:serviceG has RWX permissions (2775).
My user is part of the group extUserG also with 775 permission.
My issue and how I tested it under the root user executing commands via su:
- Works:
root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# su mediaU -c 'mkdir dir-mediaU' - Doesn't work:
root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# su appoxo -c 'mkdir dir-extUserG' mkdir: cannot create directory ‘dir-extUserG’: Permission denied
BUT if I enter one level deeper inside the freshly created dir-mediaU folder I am able to create files with my personal account:
root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# cd dir-mediaU/
root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data/dir-mediaU# su appoxo -c 'mkdir dir-extUserG'
root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data/dir-mediaU# ls -l
total 4
drwxrwsr-x+ 2 appoxo serviceG 4096 Oct 13 00:45 dir-extUserG
root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data/dir-mediaU# getfacl dir-extUserG/
# file: dir-extUserG/
# owner: appoxo
# group: serviceG
# flags: -s-
user::rwx
group::rwx
group:extUserG:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:extUserG:rwx
default:mask::rwx
default:other::r-x
So dear Lemmy Community:
Have I done something wrong in my setup or thinking? I have no problem as it is right now but I am sure it will be annoying to troubleshoot in the future so might as well fix it while still setting it up.
Thanks in advance for helping slowly escaping the windows world :)
That's what I get for falling asleep. Looks like you guys nailed it. I just saw the first reply this morning, and was going to say exactly what you did. There was a default group entry and no actual group entry on the media/data folder. Appoxo, with no actual group entry for extUserG it wouldn't have permission in that folder, but any folder created in that folder would inherit the 'default group' permission and would have group permission for extUserG. :)
Also a thank you for confirming what @tal@lemmy.today said!
Had to refer back to the thread a number of times already.
I thank both of you for helping me!
You are welcome. And kudos for a well laid out, albeit very complicated question. If we were at work this is where I would have made you share your screen, lol.
I would love to take this question to a phone because this is one of those best shown/asked in person. Text + giving context is very complicated/limiting for such a async conversation.