Inter-plugins permission issues

[gilgha]

Hello everyone,

I run FreeNAS-9.10.1 on a great HP microserver with 8 GB of RAM and 4 drive bays ! So I decided to setup my box to be my NAS and multimedia server using FreeNAS plugins and jails. However, I have an issue with the permissions of my datasets and I would like to ask you some help !

I have installed and configured the transmission plugin to write downloaded files and folders to a DOWNLOAD dataset. However, I also have a OwnCloud plugin that needs read and write access to this dataset and a few others.

I managed to give them both read and write access with the following group permission policy:

Code:

drwxrwxr-x   9 gilgha  ds-download    16 Aug 24 13:07 DOWNLOAD/

The transmission service account that accesses this folder is a member of the group ds-download:

Code:

root@transmission_1:~ # id transmission
uid=921(transmission) gid=921(transmission) groups=921(transmission),1003(ds-download)

The same with owncloud service account (www):

Code:

root@owncloud_1:/ # id www
uid=80(www) gid=80(www) groups=80(www),1002(ds-documents),1003(ds-download),1004(ds-filespace),1005(ds-media),1006(ds-photos)

So far so good, both Transmission and OwnCloud plugins can read and write files that I copy in this dataset through CIFS share because they all come with the same permissions:

Code:

drwxrwxr-x  2 1001  ds-download

The issue is that files created by the transmission plugins come with different permissions:

Code:

-rw-r--r--  1 921   ds-download

And thus, the OwnCloud plugin is not able to write/delete those files anymore.

Is there a way to prevent this kind of behavior? I would like that every single file created in this dataset comes with the same, initially configured, permissions. Since the dataset is configured to use Unix permission style, I think I can tune the ACLs of this directory to achieve this behavior but I cannot figure out how. I managed to find documentation for up-to-date Linux ACLs but it seems that FreeNAS uses a FreeBSD version of ACLs that acts differently.

Is one of you know some advanced stuff on FreeBSD directory ACLs and is able to help me with that? It would removes me the need of ssh-ing into the box to manually fix the file permissions each time I download a new torrent !

Thank you very much :D,


Gilgha

 

[Joshua Parker Ruehlig]

You can change the permission level transmission wirtes files with. FreeNAS WebUI > Plugins (left pane) > Transmission > Permissions

Also, is owncloud seeing the newly written files? I assume you are using owncloud's mountpoint setting. Otherwise I would think you need to have scheduled rescans for it to see changes.

 

[gilgha]

Thank you Joshua, I didn't even notice that I had this option in the WebUI... However, the goal here is to get this kind of behaviour for all my shared folder so I was searching for a lower level configuration that would solve the issue.

Finally, I managed to understand how NFSv4 ACL works so I solved my issue by setting the file and directory inheritance flag on my DOWNLOAD dataset.

Code:

[root@freenas] /mnt/zfs-volume# ll -h | grep DOWNLOAD
drwxrwxr-x+  9 gilgha  ds-download     11B Aug 27 11:24 DOWNLOAD/

[root@freenas] /mnt/zfs-volume# getfacl DOWNLOAD
# file: DOWNLOAD
# owner: gilgha
# group: ds-download
            owner@:rwxp--aARWcCos:fd-----:allow
            group@:rwxp--a-R-c--s:fd-----:allow
         everyone@:r-x---a-R-c--s:fd-----:allow

By default, the DOWNLOAD directory did not use ACLs. Thus, I did a 'getfacl DOWNLOAD' to check what default ACLs where configured and then I edited the ACLs to add the 'fd' inheritance flags.

Code:

[root@freenas] /mnt/zfs-volume# setfacl -m owner@:rwxp--aARWcCos:fd-----:allow DOWNLOAD
[root@freenas] /mnt/zfs-volume# setfacl -m group@:rwxp--a-R-c--s:fd-----:allow DOWNLOAD
[root@freenas] /mnt/zfs-volume# setfacl -m everyone@:r-x---a-R-c--s:fd-----:allow DOWNLOAD

To apply the same configuration to all subfolders, I used the same command combined with 'find':

Code:

[root@freenas] /mnt/zfs-volume# find DOWNLOAD/ -type d -exec setfacl -m owner@:rwxp--aARWcCos:fd-----:allow {} \;
[root@freenas] /mnt/zfs-volume# find DOWNLOAD/ -type d -exec setfacl -m group@:rwxp--a-R-c--s:fd-----:allow {} \;
[root@freenas] /mnt/zfs-volume# find DOWNLOAD/ -type d -exec setfacl -m everyone@:r-x---a-R-c--s:fd-----:allow {} \;

In case someone want to do the same configuration !