Synology NFS LXC Permissions

[Delsla38]

Hi! 

I'm trying to get my NFS permissions in order in my LXC running jellyfin, I tried changing the user id of jellyfin in the lxc from 110 to match the user id on my jellyfin user on the NAS but it gives me the following error when trying to run the service. 

`-jellyfin.service.conf
    Active: failed (Result: signal) since Fri 2024-01-26 17:57:42 UTC; 2s ago
    Process: 14220 ExecStart=/usr/bin/jellyfin $JELLYFIN_WEB_OPT $JELLYFIN_RESTART_OPT $JELLYFIN_FFMPEG_OPT $JELLYFIN_SERVICE_OPT $JELLYFIN_NOWEBAPP_OPT $JELLYFIN_ADDITIONAL_OPTS (code=killed, signal=ABRT)
  Main PID: 14220 (code=killed, signal=ABRT)
        CPU: 84ms

Jan 26 17:57:42 jellyfin systemd[1]: jellyfin.service: Scheduled restart job, restart counter is at 5.
Jan 26 17:57:42 jellyfin systemd[1]: Stopped Jellyfin Media Server.
Jan 26 17:57:42 jellyfin systemd[1]: jellyfin.service: Start request repeated too quickly.
Jan 26 17:57:42 jellyfin systemd[1]: jellyfin.service: Failed with result 'signal'.
Jan 26 17:57:42 jellyfin systemd[1]: Failed to start Jellyfin Media Server.

I'd like to use this method rather than using a workaround I've seen on reddit which is t Squash "Map all userso admin" doesn't really feel like a secure option. 

I'm not sure why the service cares about the UID since the folders and files are still owned by the same user (jellyfin). 

Any help is greatly appreciated!

[TheDreadPirate]

We need more info.

Code:

sudo journalctl -u jellyfin

That will drop you in a vim/less like interface. Shift+G to go to the bottom. And provide us with the last ~100 lines and paste it in https://sourceb.in/.

[tmsrxzar]

I'm not sure why the service cares about the UID since the folders and files are still owned by the same user (jellyfin).

linux filesystems do not store user "names", they store user id

changing a user's "id" does not reset owned permissions already set on files, it orphans the permissions on the filesystem

did you change only the userid for jellyfin and not change the owner of the files?

[Delsla38]

We need more info.

Code:

sudo journalctl -u jellyfin

That will drop you in a vim/less like interface.  Shift+G to go to the bottom.  And provide us with the last ~100 lines and paste it in https://sourceb.in/.

Jan 26 17:57:42 jellyfin jellyfin[14220]: Unhandled Exception
Jan 26 17:57:42 jellyfin jellyfin[14220]: System.UnauthorizedAccessException: Access to the path '/etc/jellyfin/logging.default.json' is denied.
Jan 26 17:57:42 jellyfin jellyfin[14220]:  ---> System.IO.IOException: Permission denied
Jan 26 17:57:42 jellyfin jellyfin[14220]:    --- End of inner exception stack trace ---
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Interop.ThrowExceptionForIoErrno(ErrorInfo errorInfo, String path, Boolean isDirectory, Func2 errorRewriter)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String path, OpenFlags flags, Int32 mode)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String fullPath, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.Strategies.OSFileStreamStrategy..ctor(String path, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.Strategies.FileStreamHelpers.ChooseStrategy(FileStream fileStream, String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options,>
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.InitLoggingConfigFile(IApplicationPaths appPaths)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.InitLoggingConfigFile(IApplicationPaths appPaths)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.StartApp(StartupOptions options)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.<Main>(String[] args)
Jan 26 17:57:42 jellyfin jellyfin[14220]: Unhandled exception. System.UnauthorizedAccessException: Access to the path '/etc/jellyfin/logging.default.json' is denied.
Jan 26 17:57:42 jellyfin jellyfin[14220]:  ---> System.IO.IOException: Permission denied
Jan 26 17:57:42 jellyfin jellyfin[14220]:    --- End of inner exception stack trace ---
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Interop.ThrowExceptionForIoErrno(ErrorInfo errorInfo, String path, Boolean isDirectory, Func2 errorRewriter)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String path, OpenFlags flags, Int32 mode)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String fullPath, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.Strategies.OSFileStreamStrategy..ctor(String path, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.Strategies.FileStreamHelpers.ChooseStrategy(FileStream fileStream, String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options,>
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.InitLoggingConfigFile(IApplicationPaths appPaths)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.InitLoggingConfigFile(IApplicationPaths appPaths)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.StartApp(StartupOptions options)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.<Main>(String[] args)

Seeing a bunch of this so I believe that tmsrxzar is correct I also have to set the ownership of the files to the new UID.  Is this still an OK approach or am I doing it wrong?

---

linux filesystems do not store user "names", they store user id

changing a user's "id" does not reset owned permissions already set on files, it orphans the permissions on the filesystem

did you change only the userid for jellyfin and not change the owner of the file

Exactly I only changed the UID of the jellyfin user I was not aware of that I had to change the owner as well. So even though it says jellyfin still owns the files it's actually owned by the old UID?

---

linux filesystems do not store user "names", they store user id

changing a user's "id" does not reset owned permissions already set on files, it orphans the permissions on the filesystem

did you change only the userid for jellyfin and not change the owner of the file

Exactly I only changed the UID of the jellyfin user I was not aware of that I had to change the owner as well. So even though it says jellyfin still owns the files it's actually owned by the old UID?

---

[quote="TheDreadPirate" pid='14893' dateline='1706296319']
We need more info.
[code]sudo journalctl -u jellyfin[/code]
That will drop you in a vim/less like interface.  Shift+G to go to the bottom.  And provide us with the last ~100 lines and paste it in https://sourceb.in/.
[/quote]
[quote]Jan 26 17:57:42 jellyfin jellyfin[14220]: Unhandled Exception
Jan 26 17:57:42 jellyfin jellyfin[14220]: System.UnauthorizedAccessException: Access to the path '/etc/jellyfin/logging.default.json' is denied.
Jan 26 17:57:42 jellyfin jellyfin[14220]:  ---> System.IO.IOException: Permission denied
Jan 26 17:57:42 jellyfin jellyfin[14220]:    --- End of inner exception stack trace ---
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Interop.ThrowExceptionForIoErrno(ErrorInfo errorInfo, String path, Boolean isDirectory, Func2 errorRewriter)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String path, OpenFlags flags, Int32 mode)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String fullPath, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.Strategies.OSFileStreamStrategy..ctor(String path, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.Strategies.FileStreamHelpers.ChooseStrategy(FileStream fileStream, String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options,>
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.InitLoggingConfigFile(IApplicationPaths appPaths)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.InitLoggingConfigFile(IApplicationPaths appPaths)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.StartApp(StartupOptions options)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.<Main>(String[] args)
Jan 26 17:57:42 jellyfin jellyfin[14220]: Unhandled exception. System.UnauthorizedAccessException: Access to the path '/etc/jellyfin/logging.default.json' is denied.
Jan 26 17:57:42 jellyfin jellyfin[14220]:  ---> System.IO.IOException: Permission denied
Jan 26 17:57:42 jellyfin jellyfin[14220]:    --- End of inner exception stack trace ---
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Interop.ThrowExceptionForIoErrno(ErrorInfo errorInfo, String path, Boolean isDirectory, Func2 errorRewriter)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String path, OpenFlags flags, Int32 mode)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String fullPath, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.Strategies.OSFileStreamStrategy..ctor(String path, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.Strategies.FileStreamHelpers.ChooseStrategy(FileStream fileStream, String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options,>
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.InitLoggingConfigFile(IApplicationPaths appPaths)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.InitLoggingConfigFile(IApplicationPaths appPaths)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.StartApp(StartupOptions options)
Jan 26 17:57:42 jellyfin jellyfin[14220]:    at Jellyfin.Server.Program.<Main>(String[] args)[/quote]
Seeing a bunch of this so I believe that tmsrxzar is correct I also have to set the ownership of the files to the new UID.  Is this still an OK approach or am I doing it wrong?
[/quote]
[quote="tmsrxzar" pid='14895' dateline='1706297255']
linux filesystems do not store user "names", they store user id
changing a user's "id" does not reset owned permissions already set on files, it orphans the permissions on the filesystem
did you change only the userid for jellyfin and not change the owner of the file
[/quote]
Exactly I only changed the UID of the jellyfin user I was not aware of that I had to change the owner as well. So even though it says jellyfin still owns the files it's actually owned by the old UID?
[/quote]

[tmsrxzar]

use a terminal, list the files with the -n flag so that you are seeing the actual id of the owner+group instead of it being translated

'ls -n'

---

if the owner/group are wrong, chown -R (uid):(gid) /path/to/files

[Delsla38]

Thank you! As you mentioned the files are still owned by UID 110.

Is there a good way to find all relevant directories I need to do this for?

[tmsrxzar]

use this guide https://www.cyberciti.biz/faq/how-do-i-f...r-or-group

i did notice they do not mention filtering errors which could lead to extraneous output on things like /proc
recommend appending commands with 2>/dev/null to send all 'errors' to dev null instead of printing them into the terminal
with that you should be able to search the entire root drive

[TheDreadPirate]

In /etc/jellyfin, set the permissions of logging.default.json to match the rest of the files in that directory.

Code:

Jan 26 17:57:42 jellyfin jellyfin[14220]: System.UnauthorizedAccessException: Access to the path '/etc/jellyfin/logging.default.json' is denied.

I'm assuming you created that file and is probably only readable by you or root.

[Delsla38]

Thanks a lot, I'll take a look at this!

Another thing I thought about, can I uninstall jellyfin, switch the UID then install it again? My thinking is then the user would already exist and the installation would set up the correct file permissions automatically.

[tmsrxzar]

Thanks a lot, I'll take a look at this!

Another thing I thought about, can I uninstall jellyfin, switch the UID then install it again? My thinking is then the user would already exist and the installation would set up the correct file permissions automatically.

i don't know how the installer works, for all i know it may just create an entirely new jellyfin user with another id