[Solved] Privileges are not permanent

linerman · 2021-08-29 07:42:28

Hi,

Using Plex Media Server and I am trying to add my external drives to Library.
Because Plex needs privileges I run:

sudo chown USER:plex /run/media/USER/
sudo chmod 750 /run/media/USER/
sudo setfacl -m g:USER:rwx /run/media/USER/

and that is working, but only till rebooting the machine.
After reboot I need to do it again, because Plex has not privileges.
I do not get it, why I need to add access to these disks over and over.

Last edited by linerman (2021-09-02 09:36:29)

seth · 2021-08-29 07:55:49

/run/media/USER/ is the runtime path for (i guess your) $USER, it's in a tmpfs and gets recreated on every boot.
It's kinda for transient mounts.
Depending on the setup, you maybe rather want a dedicated mountpoint for certain drives (by UUID or label) in your fstab, pointing to some static path in /media

linerman · 2021-08-29 08:16:15

seth wrote:

/run/media/USER/ is the runtime path for (i guess your) $USER,

Correct.

seth wrote:

you maybe rather want a dedicated mountpoint for certain drives (by UUID or label) in your fstab, pointing to some static path in /media

I've got over 14 HDDs and sometimes I borrow ones from a family. I would not like to litter my fstab.
As long as I do not run plexservice as a boot service, but rather I turn it on when it is needed, so what about a script which could:
1. run a privileges for my /run/media/USER/
2. start plexservice

Is it reasonable?

seth · 2021-08-29 08:21:37

The path is protected for the currently activ users, you could maintain that since your usecase sounds like you want to run plex as a https://wiki.archlinux.org/title/Systemd/User service?

linerman · 2021-08-29 08:27:04

There are no other users using the machine except for me.
And yes, when I need plex I just run:

systemctl start plexmediaserver.service

when plex is not needed anymore I just turn it of with:

systemctl stop plexmediaserver.service

So considering these things, I thought about a script to speed up the usage of media server

seth · 2021-08-29 08:36:03

You can also just edit the plexmediaserver.service to run as your user - otherwise, adding access for the plex user via setfacl would suffice.

linerman · 2021-08-29 09:09:24

Well, that makes plexservice failed.

I edited service file to:
(and put a copy of a file to :~/.config/systemd/user/

[Install]
WantedBy=default.target

and run:

systemctl --user start plexmediaserver.service

but plexserver failed

plexmediaserver.service: Failed to determine supplementary groups: Operation not permitted
plexmediaserver.service: Failed at step GROUP spawning /usr/lib/plexmediaserver/Plex Media Server: Operation not permitted
Failed to start Plex Media Server.

snakeroot · 2021-08-29 11:03:05

How are you auto-mounting disks and could you adjust the manner in which the program doing so operates?

For example,, if you were using udisks2 or a wrapper (e.g. udiskie), you could write a udev rule setting UDISKS_FILESYSTEM_SHARED to "1", as described in the "mount to /media (udisk2) section of the usdisk Wiki article.

seth · 2021-08-29 11:44:16

Well, that makes plexservice failed.

Because you're trying to run a service that actively seeks to drop privilegues (from root to plex) as user, that's not gonna work - you'll have to adjust the service file no matter what.

linerman · 2021-08-29 16:56:05

seth wrote:

you'll have to adjust the service file no matter what.

Looks like Plex service may be run only as a plex user and plex group.
When I changed user to $USER or put it next to plex user, the mediaserver failed to run.

snakeroot wrote:

How are you auto-mounting disks and could you adjust the manner in which the program doing so operates?
For example,, if you were using udisks2 or a wrapper (e.g. udiskie), you could write a udev rule setting UDISKS_FILESYSTEM_SHARED to "1", as described in the "mount to /media (udisk2) section of the usdisk Wiki article.

Thanks, I will try that second solution also.

seth · 2021-08-29 20:50:35

In that case you could probably use ExecStartPre to alter the ACL entry and ExecStartPost to reset it.

linerman · 2021-09-01 13:44:39

Well, I'm caught with my pants down! Don't know how to do it

plexmediaservice

 
ExecStartPre=-/usr/bin/bash /etc/perm.sh
ExecStartPost=-/usr/bin/bash /etc/perm.sh

and perm.sh

chown @USER:plex /run/media/@USER/
chmod 750 /run/media/@USER/
setfacl -m g:@USER:rwx /run/media/@USER/

and log gives me error, that no sudo permission to chown etc...

seth · 2021-09-01 13:57:42

#1 Editing: https://wiki.archlinux.org/title/System … ided_units
#2

man 5 systemd.service wrote:

"-" If the executable path is prefixed with "-", an exit code of the command normally considered a failure (i.e. non-zero exit status or abnormal exit due to signal) is recorded, but has no further effect and is considered equivalent to success.

#3 @USER is no usable variable in the context of a shellscript.
Since this is a system service there's no outside way to communicate which user the paths to leverage for. You could
a) hardcode the $USER
b) query loginctl for all/your currently active users

loginctl list-users
loginctl show-user -p State $USER

#4 You're running the same script as Pre and Post, what do you think that does?

Edit:
#5 I thought the required user is plex anyway?
#6 The ACL shall suffice.

Last edited by seth (2021-09-01 13:58:34)

linerman · 2021-09-01 15:14:04

seth wrote:

#2
man 5 systemd.service wrote:
"-" If the executable path is prefixed with "-", an exit code of the command normally considered a failure (i.e. non-zero exit status or abnormal exit due to signal) is recorded, but has no further effect and is considered equivalent to success.

So I hardcoded user and did:

ExecStartPre=-setfacl -m g:linerman:rwx /run/media/linerman/

but the answer from the service is:

setfacl: / run / media / linerman /: Operation not allowed

seth · 2021-09-01 15:21:50

Are you sure you want to free it for "linerman" (since it probably already has that and relevant user is plex?)?

man 5 systemd.service wrote:

"+" If the executable path is prefixed with "+" then the process is executed with full privileges. In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command line (but still affect any other ExecStart=, ExecStop=, ... lines).

linerman · 2021-09-02 09:30:51

Thanks for your patience and effort.
I am stupid and do not fully understand many of the commands I run.
Thanks to your guidance and provoking me to think what I am doing, I finally made it with the full success (almost have a feeling like I did it all by myself )
You should be a teacher
Thank you again!

Edit:
What made me solved:
I made drop-in file for overriding configuration file with the commands:

[Service]
ExecStartPre=
ExecStartPre=+setfacl -m g:plex:rwx /run/media/linerman/

and that worked.

Last edited by linerman (2021-09-02 09:35:55)

Arch Linux

#1 2021-08-29 07:42:28

[Solved] Privileges are not permanent

#2 2021-08-29 07:55:49

Re: [Solved] Privileges are not permanent

#3 2021-08-29 08:16:15

Re: [Solved] Privileges are not permanent

#4 2021-08-29 08:21:37

Re: [Solved] Privileges are not permanent

#5 2021-08-29 08:27:04

Re: [Solved] Privileges are not permanent

#6 2021-08-29 08:36:03

Re: [Solved] Privileges are not permanent

#7 2021-08-29 09:09:24

Re: [Solved] Privileges are not permanent

#8 2021-08-29 11:03:05

Re: [Solved] Privileges are not permanent

#9 2021-08-29 11:44:16

Re: [Solved] Privileges are not permanent

#10 2021-08-29 16:56:05

Re: [Solved] Privileges are not permanent

#11 2021-08-29 20:50:35

Re: [Solved] Privileges are not permanent

#12 2021-09-01 13:44:39

Re: [Solved] Privileges are not permanent

#13 2021-09-01 13:57:42

Re: [Solved] Privileges are not permanent

#14 2021-09-01 15:14:04

Re: [Solved] Privileges are not permanent

#15 2021-09-01 15:21:50

Re: [Solved] Privileges are not permanent

#16 2021-09-02 09:30:51

Re: [Solved] Privileges are not permanent

Board footer