Permissioning for Sage server folder

[wayner]

What is the recommended permissioning for the sage folder structure in appdata?

Presumably some of the folders, like /appdata/sage/server/userdata should be 777 so that you can transfer files like Fanart and Gemstone import/export files from other users/PCs into these folders. Is that true or is this asking for trouble?

[alfi33]

Originally Posted by wayner

What is the recommended permissioning for the sage folder structure in appdata?

Presumably some of the folders, like /appdata/sage/server/userdata should be 777 so that you can transfer files like Fanart and Gemstone import/export files from other users/PCs into these folders. Is that true or is this asking for trouble?

I spent a little time awhile back trying find the best way to get the permissions set on the Sage appdata directories so that I could transfer and edit files from Windows. The problem is every time the SageTV Docker is updated (or restarted?), the permissions are reset back to their original values.

I've found it much easier to just use WinSCP and connect as root.

[Fuzzy]

The permissions set by the docker container should allow manipulation from in Windows no problem. That's how i do everything.

[alfi33]

Originally Posted by Fuzzy

The permissions set by the docker container should allow manipulation from in Windows no problem. That's how i do everything.

Hmm...not me. Maybe I messed something up.

For example, I can't do things like save edits to the sage.properties file.

[Fuzzy]

What error are you getting when trying to edit sage.properties?

[alfi33]

I get an "Access Denied" error.

I also get an "Access Denied" if I try to create a new file or folder in \\tower\appdata\sagetv\server\userdata\Phoenix\Fanart\TV (and many directories).

However, I am able to write to \\tower\appdata\sagetv\server\ChannelLogos and I can also save changes to the .SAGE_CUR_VERSION file.

But, like I said, this really hasn't been a big deal to me since I can just connect with root using WinSCP and do whatever I need.

[Fuzzy]

In the docker log (clicking no the log option in the unRAID docker screen) do you see a lot of permissions/ownership changes failing? The docker container creates a sagetv:sagetv user:group (99:100) and then sets the entire sagetv folder to that owner.

What this does, is the 99:100 sagetv:sagetv inside the sage container maps directly to 99:100 nobody:users outside the container. This should leave the permissions wide open. What permissions are you seeing if you do an ls -l of the sagetv folder from the unraid shell?

[stuckless]

I could likely add an option to NOT change the onwership, but the whole point of it was to allow remote access via windows shares to be able to edit anything under the sagetv media and appdata areas. As Fuzzy said, things get set to 99:100 (user:group) and that should be accessible over smb.

[wayner]

Originally Posted by Fuzzy

What permissions are you seeing if you do an ls -l of the sagetv folder from the unraid shell?

When I telnet or ssh into my unraid server and go to /mnt/cache/appdata and look at permissions for the sagetv folder I see 777 but I think I changed it from 775. When I go into sagetv most of the folders, other than the ones that I changed are 755. The ownership/group is nobody:users

[Fuzzy]

For starters, you shouldn't necessarily be accessing things through /mnt/cache. You should access things through /mnt/users. That is where everything is virtually mapped by the unRAID array. Not that that matters in this situation, since the /mnt/users is where the smb shares are at.

The difference in permissions shouldn't really matter. 777 or 775 would both work just fine, since the 'owner' is nobody:users, everyone accesses it as a user, so the group and other permissions are essentially ignored. FWIW, the sage start script does set the folder to 775 I think, which should be fine.

I'm wondering if this is actually an issue in your smb config, and not having to do with file permissions.

[wayner]

How do I check out the smb config? For appdata I have Export set to yes and Security set to Public.

[EnterNoEscape]

Originally Posted by Fuzzy

FWIW, the sage start script does set the folder to 775 I think, which should be fine.

It actually does 777 for everything but the recordings folder. I've always wondered about that.

[stuckless]

Originally Posted by EnterNoEscape

It actually does 777 for everything but the recordings folder. I've always wondered about that.

Yeah, I thinking that it should really be 775 or 770... I've never liked the fact that sagetv does set 777 for any directory, but I've never felt strongly enough to actually change it (it should be changed, though).

[Fuzzy]

Originally Posted by EnterNoEscape

It actually does 777 for everything but the recordings folder. I've always wondered about that.

Ah, yeah, I actually saw the /var/run folder which is set 775.

[EnterNoEscape]

Originally Posted by Fuzzy

Ah, yeah, I actually saw the /var/run folder which is set 775.

By everything, I really just meant the "default" media folders. I probably could have been a little more specific.

[wayner]

So how come some of us are seeing 755? I definitely was not able to copy over my Gemstone settings which goes in sage/server/userdata/Gemstone as it was not writable from Windows.

[Fuzzy]

Couldn't tell you without knowing the permission set on that folder/file.

[stuckless]

Once the container is running any files and directories created by the container will likely be 755 (that's sort of the default file permissions when users create new dirs).

When sagetv is restarted, it doesn't always reset the permissions to 775... I think it only does it when there is an update, if I recall.

That being said even 755 should be fine for windows shares, provided the user is 99 (nobody or sagetv) -- unless windows fileshare requires the group writeable because it uses a different user, but I thought that unRAID used "nobody" as the default user for most things..

[wayner]

Speaking of this, does it make sense that stuff like Fanart is stored in the same folder structure (by default it is in server/userdata/Phoenix) as the binaries that run SageTV. Shouldn't this type of stuff go in a separate application data location? You may not want all other PCs to have write access to the core Sage files, but it is convenient to have write access to stuff like Fanart folders or other "data-type" of folders? For example, I would like to be able to easily move my Gemstone settings files from one server to another.

Maybe userdata should be in a different partition?

[Fuzzy]

if sage was designed today, then yes, app, config, and content would all be separated. This is mostly a legacy issue that has just never been dealt with. Sage was primarily developed for windows, and the core architecture was laid down before windows really had program and user space separation. The architecture just stuck around.