Forum Discussion

Virtuoso

Nov 12, 2020

Shares user and and group permissions

Hi, 4 years after this thread... https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/User-and-group-broken-permissions/td-p/1107451/page/3 I am migrating to FreeNAS and turni...

StephenB

Guru - Experienced User

Nov 16, 2020

FWIW, when I set file permissions so that the group smb_enfants_ro is read-only in the GUI, I also end up with read-only access for enfants2. I did not set any permissions for enfants. I confirmed first that with network access also set with the group having only read access - and then confirmed it again with network access giving everyone rw access.

The linux ACL for the each file in the folder looks like this:

root@NAS:/data/enfants2# getfacl *
# file: FileAccess.png
# owner: admin
# group: admin
user::rwx
user:admin:rwx
user:guest:rwx
group::rwx
group:admin:rwx
group:guest:rwx
group:smb_enfants_ro:r-x
mask::rwx
other::---

This file was copied into the share from windows previously with admin credentials.

The linux ACL for the share itself looks like this:

root@NAS:/data/enfants2# getfacl .
# file: .
# owner: guest
# group: guest
user::rwx
user:admin:rwx
user:guest:rwx
group::rwx
group:admin:rwx
group:guest:rwx
group:smb_enfants_ro:r-x
mask::rwx
other::---
default:user::rwx
default:user:admin:rwx
default:user:guest:rwx
default:group::rwx
default:group:admin:rwx
default:group:guest:rwx
default:group:smb_enfants_ro:r-x
default:mask::rwx
default:other::---

The share is owned by guest/guest, and folder group and folder owner both are set to rw access.

Note I did not attempt to apply file permissions from Windows - I set them for the share using the web ui.

chopin70 wrote:

Any Netgear tech we can ping ?

You can loop in the mods - JohnCM_S and Marc_V

chopin70

Virtuoso

Nov 16, 2020

Wired,

In my case and above test, the File Permissions applied only at group level in the GUI did not propagate to the users in linux shell mode.

Furthermore, changing File Permissions in GUI did not propagate them to the ACLS. It is rather the "Network TAB" in my case that did propagate the ACLS permissions to Windows 10 ACLS.

As shown in my above screeshots, the user teddy still got r/w permissions and could delete tommy's owned folder at the root of the freshly created office share which is just amazing and should never happen as far as I know.

Anyway, maybe there is an inconsitent bug in GUI that causes this ?

My advise is to ensure all permissions are properly propagated to windows 10 ACLS. Once verified, to only apply them from windows 10 and to verify that they properly apply to the shell access, either you are using it or not for security reasons.

StephenB

Guru - Experienced User

Nov 16, 2020

It might be worth posting the linux ACL (which I am not seeing in your images). The acl in my previous post was examined with network access set to everyone rw, and file permissions restricting access to the group to ro. AFAICT that did propagate correctly.

Testing with ssh:

enfants@NAS:~$ cd /data/enfants2
enfants@NAS:/data/enfants2$ ls -al
total 100
drwxrwx---+ 1 guest guest    82 Nov 15 19:43 .
drwxr-xr-x  1 root  root    530 Nov 12 19:20 ..
-rwxrwx---+ 1 admin admin 36981 Nov 12 19:12 FileAccess.png
-rwxrwx---+ 1 admin admin 27040 Nov 12 19:11 NetworkAccess.png
enfants@NAS:/data/enfants2$ rm NetworkAccess.png
rm: remove write-protected regular file 'NetworkAccess.png'? y
rm: cannot remove 'NetworkAccess.png': Permission denied

chopin70
Virtuoso
Nov 16, 2020
I will test later again with a new share
Meanwhile: can you hint me how to make the forum accept images like you did ? I tried png, jpg, resize image, make it public... it never works. That way my next post will be easier to look at
StephenB
Guru - Experienced User
Nov 16, 2020
chopin70 wrote:
Meanwhile: can you hint me how to make the forum accept images like you did ?

Unfortunately I don't have a good suggestion there - I've seen several other posts recently where the images didn't come out consistently. All I did was use the photos tool in the toolbar.

I have a couple of elevated privileges as a superuser, which might account for why mine rendered correctly. Images often do need to be flagged for mod approval, but recently I've seen some that failed to render even though they were approved. So I am thinking there was a recent change to the forum software, and there might be a bug.
Sandshark
Sensei - Experienced User
Nov 16, 2020
StephenB wrote:
Unfortunately I don't have a good suggestion there - I've seen several other posts recently where the images didn't come out consistently. All I did was use the photos tool in the toolbar.
Up until very recently, I lost the Photos tool for many months, but now it's back. I know some, including much newer users than I, have always had it. So, maybe there are some who still don't or have not noticed they do now have it.