I'm having what I think is a fairly common problem but after reading numerous posts and Reddit articles I'm not making any progress. 

 

From what I can see a folder on UNRAID is given the permissions drwxrwxrwx while files are given -rw-rw-rw-. In particular if I have run the New Permissions app. 

 

I'm running the linuxserver/qbittorrent container with effectively standard settings. From what I can see the umask is set to 022 and so folders are being created with drwxr-xr-x and files are -rw-r--r--. 

 

So, what I understand is the existing folders are 777 and the umask setting is creating the new folders with 755 (777 - 22).  

 

Can anyone explain to me why 755 is prefered over 777? I understand 755 prevents write and is in theory more secure etc, but if 777 is good enough for existing files why are new files being created with 755?

 

If I want to create new files with the same permissions as my existing files, do I just remove the umask value?

 

 

 

 

Coming in here for future users: yes. Set umask to 000.

Notably linuxserver.io docker images ship with a umask 022 value, and this value is a good choice for other linux systems, just not unraid.

The reason is that Unraid's default security approach is to manage secure access via shares in the virtual filesystem and otherwise use containers for software.
If you have qbittorrent set files as 755, and prevent write by others, then the result is that only root (the web gui or ssh), and qbittorrent can do anything to them.

This effectively results in being unable to delete old files when browsing a network share over smb, or modify and update documents when syncing them on a network share.
Unraid's security model is set such that files being in 777 is not a problem. The core focus of the filesystem is data storage and NAS use, so you want to gate it based on the share or "library" it contains, rather than at a file level in a shared filesystem under multiple users.

For the security concerned, keep in mind that the OS is not stored on the same file system at all (USB) and by default docker containers only have as much access and permission as you allow. So this security model effectively moves a lot of the risk via filesystem out of the way.

Also this advice applies to container settings and shares, but the default appdata and system shares should be left alone unless something is critically wrong with them.

Thanks this helped me today. Clear and concise answer in the comment by @skywalker6705. Helped me today when I was scratching my head trying to remember the UMASK thing from a while back.

Thanks a bunch internet stranger.