Syno: java.nio.file.AccessDeniedException after DSM upgrade

Support for Synology NAS, QNAP NAS and other Embedded Linux systems
Post Reply
drsteveplatt
Posts: 7
Joined: 05 Aug 2018, 23:07

Syno: java.nio.file.AccessDeniedException after DSM upgrade

Post by drsteveplatt »

I upgraded from DSM 6.2.3-25426 Update 2 to Update 3. Filebot and FB Node were working well before.
After the upgrade, I get

Code: Select all

filebot -script 'fn:amc' '/volume1/tmp/Plex/TV Shows' --output /volume1/video/Plex --action TEST -non-strict --order Airdate --conflict auto --lang en --def 'ut_label=TV' 'music=y' 'unsorted=y' 'artwork=y' 'skipExtract=y' 'excludeList=.excludes' --apply refresh --log all --log-file '/usr/local/filebot-node/data/filebot.log'

------------------------------------------

java.nio.file.AccessDeniedException: /volume1/tmp/Plex/TV Shows: /volume1/tmp/Plex/TV Shows
Run script [fn:amc] at [Mon Feb 01 19:14:08 EST 2021]
Parameter: ut_label = TV
Parameter: music = y
Parameter: unsorted = y
Parameter: artwork = y
Parameter: skipExtract = y
Parameter: excludeList = .excludes
Invalid usage: output folder must exist and must be a directory: /volume1/video/Plex
Abort (×_×)

------------------------------------------

[Process error]

🔺 Exit Code: 4
when I try a dry run. The same thing happens on a full run. Running the command from an ssh session (logged in as an admin account) yields the same result.

I have uninstalled and reinstalled Java, FB, FB Node. I am running from an Admin account, and it owns the appropriate directories. I have no idea what has changed.

I also tried moving the source from /volume1/tmp to /volume1/some_new_folder. It then threw AccessDeniedExceptions for some_new_folder.

This is all on a DS1515+; FB has been running on it for several years. I recently purchased a permanent FB license after a couple of one-year purchases.

On the side, I installed Java, FB, FB Node on a DS916+ on the same network. I mounted the folders from the 1515+ onto the 916+. Everything runs beautifully on the 916+, and the processed information is directly accessible from Plex (running on the 1515+).

Any suggestions?

-Steve
User avatar
rednoah
The Source
Posts: 22923
Joined: 16 Nov 2011, 08:59
Location: Taipei
Contact:

Re: Syno: java.nio.file.AccessDeniedException after DSM upgrade

Post by rednoah »

drsteveplatt wrote: 02 Feb 2021, 00:29 I am running from an Admin account, and it owns the appropriate directories. I have no idea what has changed.
It's definitely a permission problem. Note that DSM uses Linux ACLs, which override classic Unix permissions that you may be familiar with. You can change those via DSM, but not via chmod.


:arrow: My first step would be creating a new share, with pristine permissions, and then trying with that. That will most likely work. Once you have a destination folder that works, and one that doesn't work, then the next step is figuring out what's different.
:idea: Please read the FAQ and How to Request Help.
drsteveplatt
Posts: 7
Joined: 05 Aug 2018, 23:07

Re: Syno: java.nio.file.AccessDeniedException after DSM upgrade

Post by drsteveplatt »

I had already tried a new share. That was when I created /Incoming/OldPlex/Movies and /Incoming/NewPlex/Movies. The folders are empty. Same result.

So I took a deeper examination of permissions on the /Incoming folder. And... It allows permissions (no exceptions generated) if and only if the Admin account has R/W access to /Incoming! I keep Admin disabled and give it no permissions anywhere -- I use a different account (not my day-to-day account) for administration.

Test cases: Admin and only admin has R/W: it works. Everyone has rights except admin: It doesn't work.

I then reset /video and /tmp to give Admin r/w access. It works now. Even with the Admin account being disabled.

My two questions at this point:
  • Why does it require Admin account r/w permissions to work (after the DSM update) on this system?
  • Why is it running well on my other system when admin has NO permissions to foldlers? This includes (on the other system) direct access to the other system's folders (Admin disabled) and accessing the folders on the "bad" system through mounted folders (even when Admin was disabled).
We can mark this one as "solved with a workaround" (thanks for the ongoing support and the reassurance that it was, indeed, an ACL problem!). I'm not 100% happy about leaving Admin with r/w access, but I can live with it since Admin is disabled.
User avatar
rednoah
The Source
Posts: 22923
Joined: 16 Nov 2011, 08:59
Location: Taipei
Contact:

Re: Syno: java.nio.file.AccessDeniedException after DSM upgrade

Post by rednoah »

On DSM 6 (but not DSM 7) all packages run as root, so FileBot Node is running as root. However, when FileBot Node executes filebot, FileBot Node will explicitly execute filebot as admin:administrators (as not to default to running it as root). As for what specifically is going awry in your case, no idea... Disabling admin is likely going to break things in unexpected ways, since this use case is untested.


TL;DR FileBot Node will always execute filebot as admin. If you execute filebot via SSH, then filebot will run as your user.
:idea: Please read the FAQ and How to Request Help.
drsteveplatt
Posts: 7
Joined: 05 Aug 2018, 23:07

Re: Syno: java.nio.file.AccessDeniedException after DSM upgrade

Post by drsteveplatt »

Interesting, disabling admin being an untested use case. Every Syno guide in existence recommends doing this! And I've been running three Synos for years that way -- file services, web service, Plex, MariaDB, audio streaming, etc., no issues.

But... I run computer/network test programs for a living, and I get curious about these things. If you're interested in digging deeper, I have two similar Synos (1515+, 916+) that are acting differently concerning the "enabled admin account". If you have things you'd like to try to dig into why the boxes are acting differently, drop me a note offline and I'd be glad to help.

-Steve
User avatar
rednoah
The Source
Posts: 22923
Joined: 16 Nov 2011, 08:59
Location: Taipei
Contact:

Re: Syno: java.nio.file.AccessDeniedException after DSM upgrade

Post by rednoah »

Well, I wouldn't spend too much time on this one. DSM 7 will make this thread irrelevant soon enough.
:idea: Please read the FAQ and How to Request Help.
Post Reply