Dataset Traversal with Nested Datasets

[X10a Freedom]

Hello all,

I am having a head scratcher here. I am attempting to restrict access of a group down to a bottom level dataset but cannot seem to access it. When I go to access the top level dataset it tells me that I do not have permissions to view it.

Specific setup:

TrueNAS version: TrueNAS-12.0-U8.1

Group: media
User: medias

Structure:

Data (pool) -> ds1 -> middle -> media

I am attempting to restrict the media group to only be able to see / read / write on the media dataset.

Current permissions:

ds1 (who: group -> group: media -> acl type: allow -> permissions type: basic -> permissions: traverse -> flags type: basic -> flags inherit) -> middle (same as ds1) -> media (same except for permissions is set to permissions: modify)

I attempt to browse to my IP through Windows file explorer and I can see ds1 share. When I click on the share is when I get the permissions issue. If I enter the full file path in file explorer, I can reach it just fine (IP address\ds1\middle\media).

It has to be something in my permissions as when I follow this entire structure down with permissions set to permissions: full control, I can make it down to the media dataset. Also, when I set the permissions to permissions: read, I can also make it all the way down to the media dataset. The instant I take away the "read" permission in advanced permissions (which basically gives it the "traverse" set of permissions) I get the error. I have also attempted to set the permissions for this group on ds1 and middle to "basic: traverse" but this also does not allow me to push right through the datasets and be able to directly see the media dataset when clicking on my share.

End goal: I would like to be able to have to only network map the appliance IP and then access the ds1 share and when I click on it, be only able to see the "media" dataset when I am logged in with my medias user. I am thinking that this is happening because the datasets are nested. If I dont have the "read data" permissions checked off, there would be nothing further to click to continue down the dataset structure as I then technically dont have access to see the top level dataset, if that makes sense. Am I stuck with just having to be fine with this user being able to "read" and see each dataset all the way down the structure, or will as an alternative, would I just have to be fine with creating another smb share that directly file paths to the dataset that I want / map a network drive with the direct file path to the dataset. It would be great to just have a single point of entrance and be able to have it traverse down to my media dataset instead of having to bounce in and out of shares / mapped network drives / file explorer paths.

Any thoughts? Am I looking at this or approaching this completely wrong? Thanks all!

 

[X10a Freedom]

If this helps, I did a getfacl all the way down to my media dataset. I would like for the users in the Media group to be able to browse to my nas IP, click on my cifs / samba share and then be able to access the media dataset without seeing any information about the datasets above it. I can see that the traverse permissions are set all the way down the directory path, but still getting the dont have permission error when I go to click into ds1 and start down the path to the media dataset. If I give the "read data" permission to the Media group, I can make it all the way down the dataset I want to, but I can then see the data in the parental higher up datasets which is what I do not want.

# file: /mnt/Data/ds1/
# owner: "my personal name"
# group: Full
group:Media:--x---a-R-c---:fd-----:allow
owner@:rwxpDdaARWcCos:fd-----:allow
group@:rwxpDdaARWcCos:fd-----:allow
everyone@:--------------:fd-----:allow
root@truenas[~]# getfacl /mnt/Data/ds1/middle
# file: /mnt/Data/ds1/middle
# owner: "my personal name"
# group: Full
group:Media:--x---a-R-c---:fd----I:allow
owner@:rwxpDdaARWcCos:fd----I:allow
group@:rwxpDdaARWcCos:fd----I:allow
everyone@:--------------:fd----I:allow
root@truenas[~]# getfacl /mnt/Data/ds1/middle/media
# file: /mnt/Data/ds1/middle/media
# owner: "my personal name"
# group: Full
group:Media:rwxpDdaARWc--s:fd-----:allow
owner@:rwxpDdaARWcCos:fd-----:allow
group@:rwxpDdaARWcCos:fd-----:allow
everyone@:--------------:fd-----:allow

 

[anodos]

Traverse is sufficient to access a path directly. If you want to click through, you need to be able to read the mountpoint's contents.

 

[X10a Freedom]

Traverse is sufficient to access a path directly. If you want to click through, you need to be able to read the mountpoint's contents.

Got ya, after thinking about it more, it makes senes. I think that I just had to redefine what the end result of Traverse accomplishes and how to make use of it. Thanks!

 

[anodos]

Got ya, after thinking about it more, it makes senes. I think that I just had to redefine what the end result of Traverse accomplishes and how to make use of it. Thanks!

Right, this is one of the disadvantages of the way that Windows by default disables traverse checking.
Consider a share "share" where you have two directories "public" and "private"
Windows:

\\server\share\public\<lots of things>
\\server\share\private\accounting_information

"bob" has r/w access to share, and can read and write to the 'public' dir
"bob" has no permissions for "private" dir. He cannot access anything in accounting_information.

"larry" has r/w access to accounting_information
He creates dir "larry_things" in accounting_information and since he is owner of dir and hates ACLs, decides to make it wide-open.

Now bob can type \\server\share\private\accounting_information\larry_things into his explorer bar and access the files there (because traverse checking is disabled).

Unix:
Since we have "traverse checking" always enabled in Linux / FreeBSD kernel, Bob cannot access larry_things unless the admin has granted "traverse" (execute) to Bob on \\server\share\private.

This very simple and critical permissions feature in Unix is often overlooked by new users, and unfortunately there are some prominent youtube influencers who advocate removing execute from paths like /mnt/tank (which results in users breaking access to their server for non-root processes).