Need help fixing default POSIX permissions on SMB share

TrueNAS General
,
1

I appear to have messed up the default POSIX permissions that get applied to new folders on my SMB share. I am still learning TrueNAS so I am unsure how I did this, so I am hoping for some direction on how to fix it:

This is what my folders that work look like:

truenas_admin@truenas[~]$ getfacl "/mnt/Plex/Media/TV Shows/Mad Men (2007)"
getfacl: Removing leading '/' from absolute path names
# file: mnt/Plex/Media/TV Shows/Mad Men (2007)
# owner: root
# group: fettuccine
# flags: -s-
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:other::r--

And this is what new folders I create look like:

truenas_admin@truenas[~]$ getfacl "/mnt/Plex/Media/TV Shows/test"          
getfacl: Removing leading '/' from absolute path names
# file: mnt/Plex/Media/TV Shows/test
# owner: root
# group: fettuccine
# flags: -s-
user::rwx
user:root:rwx
group::rwx
group:fettuccine:rwx
mask::rwx
other::r--
default:user::rwx
default:user:root:rwx
default:group::rwx
default:group:fettuccine:rwx
default:mask::rwx
default:other::r--

How do I adjust default POSIX permissions to be correct?

This set of commands fixes the permissions issue after the folder is created (There is an additional command there for files I am leaving in case someone needs it)

sudo chown -R root:fettuccine "<PATH>"
sudo setfacl -R -b "<PATH>"
sudo setfacl -R -k "<PATH>"
sudo find "<PATH>" -type d -exec chmod 775 {} +
sudo find "<PATH>" -type f -exec chmod 664 {} +
sudo setfacl -R -d -m u::rwx,g::rwx,o::r-- "<PATH>"
2

TrueNAS docs bot replied with this:

To change the default permissions on an SMB share in TrueNAS SCALE, you should use the web interface to adjust either the share-level ACL (Access Control List) or the dataset permissions associated with the share. Here’s how you can do it:

  1. Go to Shares in the TrueNAS web interface and locate your SMB share.
  2. Click the Edit Share ACL icon for the desired share. This allows you to modify permissions at the SMB share level.
  3. In the Edit Share ACL screen, select either User or Group in the Who field, then choose the specific user or group.
  4. Set the permission level using the Permissions and Type fields.
  5. (Optional) Click Add to include additional users or groups and set their permissions.
  6. Click Save to apply your changes.

Note: Changing permissions at the share level only affects SMB access for that specific share. If you want to change permissions for all access methods (including NFS or direct file system access), you should also update the dataset ACL by editing the dataset’s permissions directly.

For more details, see:

I’d suggest trying the advice and asking if an when it fails in an unexpected way.

3

Except the GUI gives me an error

If I try to remove any of these:

image
image820×1054 29.6 KB

I get:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/middlewared/job.py", line 515, in run
    await self.future
  File "/usr/lib/python3/dist-packages/middlewared/job.py", line 562, in __run_body
    rv = await self.middleware.run_in_thread(self.method, *args)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/middlewared/main.py", line 622, in run_in_thread
    return await self.run_in_executor(io_thread_pool_executor, method, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/middlewared/main.py", line 619, in run_in_executor
    return await loop.run_in_executor(pool, functools.partial(method, *args, **kwargs))
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/middlewared/api/base/decorator.py", line 101, in wrapped
    result = func(*args)
             ^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/middlewared/plugins/filesystem_/acl.py", line 805, in setacl
    self.setacl_posix1e(job, current_acl, data)
  File "/usr/lib/python3/dist-packages/middlewared/plugins/filesystem_/acl.py", line 610, in setacl_posix1e
    verrors.check()
  File "/usr/lib/python3/dist-packages/middlewared/service_exception.py", line 72, in check
    raise self
middlewared.service_exception.ValidationErrors: [EINVAL] filesystem_acl.dacl: Presence of [USER_OBJ] entry is required.

But you can clearly see from the first screenshot, I screwed up and duplicated permissions.

4

anyone have an idea what I am doing incorrectly here?

5

Finally fixed this.

I was able to use setfacl -bR<mount location>

To reset the ACL and then I set the mount to ‘POSIX Open’ and now everything works.