How should I manage library permissions on Ubuntu (24.04)

[TheDreadPirate]

The jellyfin user does not have a shell with which to log in to for the purposes of file transfer.  What you've described, changing the ownership to jellyfin is the simplest solution.  But I also found this annoying and used the process below.

You can set sticky bits to ensure that the jellyfin user has, at least, read access.  This is what I do.  My user owns the library, the jellyfin user has read access via setting the group for the library to jellyfin.  Setting a sticky bit on the group will ensure that all newly created files and folders in your library have the group ownership set to jellyfin.  An example is below.  Notice the "s" in the group permissions.  That indicates there is a sticky bit.  All files and folders created in this directory inherit the sticky bit and ownership.

Code:

chris@rat-trap:/media/library$ ll -d /media/library
drwxr-sr-x 22 chris jellyfin 22 Apr  3 09:13 /media/library/
chris@rat-trap:/media/library$ mkdir test
chris@rat-trap:/media/library$ ll -d test/
drwxrwsr-x 2 chris jellyfin 2 Apr  3 09:13 test/
chris@rat-trap:/media/library$ cd test/
chris@rat-trap:/media/library/test$ touch testFile
chris@rat-trap:/media/library/test$ ll
total 34
drwxrwsr-x  2 chris jellyfin  3 Apr  3 09:14 ./
drwxr-sr-x 23 chris jellyfin 23 Apr  3 09:13 ../
-rw-rw-r--  1 chris jellyfin  0 Apr  3 09:14 testFile

The exception being if you copy files from outside your library, but are already on your server, and you use the -p option to preserve the file's/folder's permissions and ownership.  If you copy without the -p option, it should inherit the sticky bit and ownership.

Files transferred with FTP should be considered "new" files and should inherit the sticky bit and ownership.

Use this command to recursively set permissions and the sticky bit.  Replace the username with your user and the path for your library path.  You should only need to do this once.  Going forward, assuming you don't copy in files or folders with -p, jellyfin should be able read anything you transfer in here without having to change ownership or permissions.

Code:

sudo chown -R chris:jellyfin /media/library
sudo chmod -R 750 /media/library
sudo chmod -R g+s /media/library
sudo find /media/library -type f -exec chmod 640 {} \;

If jellyfin needs write access to your library, change 750 to 770 and 640 and 660.