Difficulty Executing Applications Within Windows 11

TrueNAS General
, ,
1

I have a TrueNAS system (information below). I have a Windows (SMB) Share active. Microsoft Windows executable programs installed onto the NAS need to have their Security permissions manually altered within Windows 11 to be allowed to Execute. Is there a way to set it up so that this is done by default? Thank you for any insight you can provide. Please note that when I install applications on the NAS via macOS or Linux, it works as expected. This seems to only be an issue with Microsoft Windows 11.

  • Platform: TRUENAS-MINI-3.0-XL+
  • Edition: Community
  • Version: 25.10.3 - Goldeye
2

Generally any of the write permissions sets in ACL also set the execute bit, but typically this will often be insufficient to allow execution of binaries directly from an SMB due to client-side (e.g. Windows) security settings.

3

Does this mean one is forced, within Windows, to have to manually change all of the EXEs accordingly? Is there a way to tell Windows to relax this security measure on this NAS? Thank you for your help with this.

4

This is a case where you look at OS vendor documentation rather than NAS documentation. There’s nothing we can really change about what we’re sending over the wire here.

5

Better details may render you better results…

Are you talking about file permissions? (only for .exe files??).

How about the specific use case and specific errors?
(Are you pointing the installer to install on an SMB share?).

Owner of the files? Specific file permissions (unix or acl?).

Details!

6

Thank you for your feedback. I have a bulleted list below of some setup information along with new data.

  • My intended setup is for each user to have a personal drive that only they can access. Then, each user is part of a NAS Group group that has full permissions on a shared drive that they can all access and modify.
  • For testing, I am using the Alacritty Windows portable bundle and the standard LibreOffice Windows installer (both x86_64).
  • Both installation types work out of the box and as expected with the shared drive but not within the personal drive.
    • The error message I get when I double-click on the EXE file is below.
  • I can make it work with the personal drive if I edit permissions of the file and add Execute capabilities.
  • So, I spent some time trying to go through the TrueNAS interface to see differences that would cause this but that is proving more difficult than anticipated.
    • Note that this NAS was setup in the TrueNAS 11/12 days before the Core/Scale schism and the Community Edition. The GUI has changed dramatically (at least to my eyes).
  • The data above suggest the solution to my issue is tied to the TrueNAS CE configuration (since it works for shared drive). It sounds like I need to check for differences between Unix and ACL permissions (although I’m not exactly sure where).

What should I be searching for in the GUI to find differences that would cause this? Any guidance would be greatly appreciated. Thank you for your help with this.

Error Message

Windows cannot access \nas\foo..\Alacritty-v0.17.0-portable.exe
You do not have permission to access \nas\foo\bar\Alacritty-v0.17.0-portable.exe. Contact your network administrator to request access.

7

Yes, it’s a permissions issue.

I usually do not use ACLs, only Unix permissions and I have been able to do everything I need/want.

For this, more details are needed (does the shared share have ACLs? Specific ACLs in shared share/directory?).

Now, for the shared drive with programs/binaries:

Aren’t you worried about different users running the same binary and overwriting settings or temp files on each other?

(Some software uses the binaries directory to save settings, temp files, etc.).

8

I could see it being something stupid like the user/pass for the Windows user needing to match the user/pass for the acl share on truenas… something along the line of Window’s end where the windows user is the one running the .exe, hence that is what tries to open it on TrueNAS & then gets rejected since it’d user the Windows login.

9

This is usually Windows attaching the “downloaded from another computer” security flag (Mark-of-the-Web) on executables over SMB, so the fix is typically on the Windows side via Group Policy/Defender settings rather than a TrueNAS SMB setting.

10

The quick-n-dirty fix is to use find to set the executable bit like so:

sudo find /mnt/path/to/your/share -name *.[Ee][Xx][Ee] -execdir chmod +x '{}' \;