I'm running Tdarr in a docker container using the trashed guides.  All works fine when the unraid node does the work.

 

But when I use my Win11 Mini PC (n97) it sometimes fails. Essentially can't move the file at the end due to rights. If I go in manually and reset the permissions at the data root it will work again fine. But then it will happen again at some point.

 

So obviously I have something configured wrong as I think new files are not getting the correct permissions.  How do I set the default permissions for my data share?

you may need to set extra permission to have samba wirte as xyz user or write with xyz permission...
 

To ensure your files and directories are created with the correct default permissions on your Unraid data share, particularly when using an external node like your Windows 11 Mini PC with Tdarr, you can adjust both the SMB (Samba) and file system permissions. Here's a step-by-step guide:

 

Stop array > Tools > SMB extra options:

create mask = 0666
directory mask = 0777
force create mode = 0666
force directory mode = 0777

^-add to set theses permission...

This ensures all new files are created with read and write permissions for all users (0666), and directories are executable as well (0777).

 

2. Ensure Docker Container User and Group Match

If the Tdarr Docker container uses a specific user (e.g., nobody:users by default in Unraid), ensure that files are written with the same user and group.

Check Container User/Group:

Open the container settings in Unraid and look for "User ID (UID)" and "Group ID (GID)".

Set Permissions on the Share:

 

*Run Unraid Docker safe permissions....

chown -R nobody:users /mnt/user/<share_name>
chmod -R 0777 /mnt/user/<share_name>

 

3. Adjust Tdarr Windows Node Behavior

The issue may also arise from how your Windows 11 Mini PC interacts with the share. Ensure proper permissions are maintained.

Configure SMB Client Settings on Windows 11:

If your Windows node connects using a specific user, ensure the user has write permissions on the share.

Use the Correct SMB Version:

Ensure the SMB protocol version used is compatible and consistent. In Unraid, this can be set under Settings > SMB > Enhanced SMB Settings > Enable SMB 1, 2, or 3 Protocols.

Force Group Ownership on the Unraid Share:

Add this to the extra SMB options:

 

force group = users
#or
force group = nobody

This ensures all files created via the SMB share belong to the users group.

 

Advanced: Automating Permission Fixes

If issues persist with certain workflows, you can use a periodic cron job or a Tdarr post-processing script to reset permissions:

User scripting to set file permission in folder... run on cron...

chmod -R 0777 /mnt/user/<share_name>
chown -R nobody:users /mnt/user/<share_name>

 

10 hours ago, Davo67 said:

I'm running Tdarr in a docker container using the trashed guides.  All works fine when the unraid node does the work.

 

I am assuming that you are having problems accessing files written by this Docker container.  From this post:

                  https://forums.unraid.net/topic/131730-update-from-69-to-6115-and-got-permission-denied/#comment-1219731

Read this section and do this:

 

 

This often is required to fix the problem as many Docker containers write directly to the array using Linux rather than SMB.

Edited November 21, 20241 yr by Frank1940

So in terms of "best practice" should I be connecting as a user?  At the moment the data share is published and public. So anyone on my network can see it write to it etc.  I think the windows computer also connects that way.

 

I could setup a user to have for this stuff if it is better practice though???

For security in Samba, yes, you should be connecting as a user.

The need for user share security or guest access depends on network access, how the shares are configured, and the contents of the share.

Windows has been causing compatibility issues with Samba since the XP era. In Windows 10/11, the Windows Discovery Service (WDS), under the guise of security, has further complicated things.

 

I recommend setting up user-secured shares. Even if you choose to configure guest access without a password in Windows 10/11, I’ve found that the default settings often require manual credential entries in the Control Panel for the Unraid NAS. This is true even if you're using local accounts and not logged in with a Microsoft account.

For more details, review the official documentation:

 

Network Access

https://docs.unraid.net/unraid-os/manual/shares/network-access/

Create a Share

https://docs.unraid.net/unraid-os/manual/shares/create-a-share/

 

Security policies can vary widely based on your needs and practices. Personally, I prefer enabling guest access without a password until a user attempts to access a secured folder. This setup can be achieved by configuring UNIX ACL permissions.

 

Note: This sometimes requires manual SMB share edits and advanced knowledge of Linux Samba configurations. A Samba server should handle and establish the correct connection for any client, but each client behaves differently in how it handles and connects to Samba.

 

A bit out of left field but:

*I’d love to see a future feature allowing custom SMB options per share—such as force user, directory settings, or additional Apple-specific configurations.

 

 

Unraid has an interesting and simple approach to samba, that works for most end users. They are getting better with new features and updates...
 

Compared to other systems same samba application... 
True nas scale / Ubuntu/Debain via termainl/ webmin / 45drive cockpit... they all have some form of custom share edits...

There are mutiple talks on teh forum regraing issues wiht samba and windwos/mac setting need for user needs as they vary...
thus the stop array and edit the smb-extra permission..

Thanks. Very good explanation. 

 

I'll reconfigure that share to require user access which will also mean changes in plex and the arrs but shouldn't be hard. I'm hoping lol. 

So I'm connecting from Windows as a user. The share is defined to give that user RW access. Works correctly.

 

But. When one of the arrs adds a new file the new file permission is

-rw-r--r--

 

Not 

 

-rw-rw-rw-

 

As per the other files, and accordingly I have no write access to the share on a windows computer. 

 

I'm sure it's something I'm doing wrong or misconfigure in unraid as I haven't at this point ever tried to access the file in windows. 

 

Share settings attached. The file is on my cache drive at the moment. Not sure if this is relevant or not.

1 hour ago, Davo67 said:

So I'm connecting from Windows as a user. The share is defined to give that user RW access. Works correctly.

 

But. When one of the arrs adds a new file the new file permission is

-rw-r--r--

 

Not 

 

-rw-rw-rw-

 

As per the other files, and accordingly I have no write access to the share on a windows computer. 

 

I'm sure it's something I'm doing wrong or misconfigure in unraid as I haven't at this point ever tried to access the file in windows. 

 

Share settings attached. The file is on my cache drive at the moment. Not sure if this is relevant or not.

as mentioned earlier.. you need samba options:

create mask = 0666 directory mask = 0777 force create mode = 0666 force directory mode = 0777

your fighting whth touched what where and wrote as who. 

smb extra options:
 

[data]
create mask = 0666
directory mask = 0777
force create mode = 0666
force directory mode = 0777

*this will make any file read or writen to that rwxrwxrwx...

333,666,777

 

permission to:  user(u)   group(g)   other(o)     
                /¯¯¯\      /¯¯¯\      /¯¯¯\
octal:            6          6          6
binary:         1 1 0      1 1 0      1 1 0
what to permit: r w x      r w x      r w x

binary         - 1: enabled, 0: disabled

what to permit - r: read, w: write, x: execute

permission to  - user: the owner that create the file/folder
                 group: the users from group that owner is member
                 other: all other users

for (rw rw rw) I believe that is 666

Edited November 24, 20241 yr by bmartino1
typo

you can even force user to set the permission in the folder and anytime somtheing reads or writes form smb it is that user...

So I made the changes to the smb settings as below and restarted the array. Downloaded via sabnzbd and it unfortunately the new file still has the wrong permissions. Did I make a mistake with how I did the settings?

 

This is the permissions of the file one it was moved to the folder (the new file is the 4.73GB file), the others have the correct permissions:

 

 

If this a Docker container, it is very unlikely that it is using Samba to write to the array.  It will write directly to the array using Linux read/write file procedures.  Look at my early post (11/21/2024) in this thread for the parameters to modify/add to the Docker container.  If it is not obvious how to modify/add these parameters, ask in the support thread for the Docker container.  (It is my understanding that the now recommended file/directory permissions for Linux distributions are 644 and 755.)

 

EDIT:  Go to the Docker container and click on the Icon and you will see this menu:

 

The line indicates the place where you can edit/add parameters to the Docker container and the circle should take you to the support thread for this particular docker container. . 

 

EDIT 2  Be sure that you click on the 'Show more settings' dropdown....

Edited November 24, 20241 yr by Frank1940

I think that this post may provide all the information necessary to set up those three parameters:

 

     https://forums.unraid.net/topic/71764-support-binhex-krusader/page/38/#findComment-1486740

 

15 hours ago, Davo67 said:

So I made the changes to the smb settings as below and restarted the array. Downloaded via sabnzbd and it unfortunately the new file still has the wrong permissions. Did I make a mistake with how I did the settings?

 

This is the permissions of the file one it was moved to the folder (the new file is the 4.73GB file), the others have the correct permissions:

 

 

you still need samba info?... That may not be applying picture is not clear...

you may require:
[global]
to affect across samba 
*some of those settings are share only setting

Can't be sure you set your smb permission correctly....

you may need them under the share name:
[data]
to set those permissions... as shown above... RE-read the entire post. ask question if you don't understand.
the docker needs updaing to use uuid/guid as well Thanks Frank!
*Learned something new with docker read write set access...

You still haven't answed the rhetorical question of "who touched what where and who can touch what where"...
This is what your trying to fix and there many ways to go about it...

you may also need to manuly set to fix current permission issues as well.
 

cd /mnt/user/path

chmod 777 -R *

chown -R nobody:users

smb help:

cat /etc/samba/smb-shares.conf

*these are the samb smb.conf config form the unraid web UI for your shares
using smb extra you can add more to that share by calling the 
[ ]

your data share needs that info for samba to set new file to theses permissions...

testparm to see if the share is getting updated...

not enoth info to help.

I don't believe the issue is to do with Samba. As has been mentioned, the rights are incorrect after the files were written by the arr apps/sab which wouldn't use samba.

 

Looking at the container setup for these apps they all run as user PUID 99 (nobody).  I've changed to PUID 1000 (remote - the user I connect from the windows pc) and potentially it's working. After downloading a file via Sonarr/Sabnzbd I have the following:

(owner) remote    (permissions)  rw-r--r--

 

Which I think is correct?  Certainly it appears that my mini windows pc can write to those files now.

 

I forced rights of rw-rw-r-- across the entire share. It probably would have made more sense to change the owner to remote and set them to rw-r--r-- I'm guessing?

The problem is that Samba (as LimeTech has it setup) uses the group permission for most Share Access user access.  Look at what the default direct from a Windows PC is writing files to the array:

 

Notice that there are three different owners for this group of three videos and their files---  smbuser, user and nobody.  There is only one group--- users.  If you do some investigating, you will find that all three of the 'user names' are members of the 'users' group.  Note that the permissions are identical for both owner and group-- rx-  

 

I can assure you that this share is Private and users 'smbuser' and 'user' have full read/write privileges to all of these files regardless of who owns them!  The only way that this can happen is because that LimeTech has set up Samba in Unraid so that it is expected that the file access will be controlled through the 'group' privileges/permissions not through the Owner's.

 

The same argument might be made for those connections are using the Guest access when accessing public shares.  They are using the 'other' permissions. 

 

This is the reason that underlying Linux Permissions must 666 for files and 777 for directories. 

Edited November 24, 20241 yr by Frank1940