Nextcloud-snap: Prevent snap resetting permissions for data folder after reboot

[Seferi]

Hi, I installed plex with nextcloud and set the data directory permissions with sudo chmod -R 775 /home/user/nextcloud/data/ so plex could read the directory but after every reboot nextcloud resets the permissions for the directory. Is there a way to prevent that?

[kyrofa]

Hey @Seferi sorry for the slow responses recently-- just had a baby!

Remind me-- you have this dir bind-mounted into /media/ somewhere, right?

[Seferi]

@kyrofa Congrats mate!! Mine is a few months old too :) Boy or girl? No worries for the delay mate! Family always comes first!

Yes, in /etc/fstab /home/user/nextcloud /media/nextcloud none bind

I just realized not just with every reboot but like all the time resets after some time..

[kyrofa]

Thank you-- my third boy!

Okay, that permissions thing sounds a little odd. Let me investigate once I'm at my computer.

[oparoz]

My third boy!

Wow, congrats :)

[ch1x0r]

Congrats!

[Seferi]

My third boy!

Congrats mate! And thanks for looking in to it. It's a pretty frustrating problem.. Couldn't find a way around it..

[Seferi]

I tried using symlink instead of bind mount : sudo ln -s /home/user/nextcloud /media
but when I visited nextcloud web, I got this: Your data directory is readable by other users
Please change the permissions to 0770 so that the directory cannot be listed by other users.

Did you have time to investigate @kyrofa ?

[kyrofa]

I've managed to duplicate this behavior. Pretty sure it's due to this bad boy. Not sure there's anything we can do about this in the snap if it's upstream Nextcloud behavior :cry: .

[Seferi]

@kyrofa Thanks for looking into it mate. I stupidly did chown -R www-data:plex /home/user/data
and now I'm getting :
Your data directory is invalid
Ensure there is a file called ".ocdata" in the root of the data directory.

Cannot create "data" directory
This can usually be fixed by giving the webserver write access to the root directory. See https://docs.nextcloud.com/server/12/go.php?to=admin-dir_permissions

Anyway I could recover from this?

[Seferi]

When I do: sudo nextcloud.occ I get this if it helps:
Your data directory is not writable
Permissions can usually be fixed by giving the webserver write access to the
root directory. See https://docs.nextcloud.com/server/12/go.php?to=admin-dir
permissions.

An unhandled exception has been thrown:
Exception: Environment not properly prepared. in /snap/nextcloud/5132/htdocs
lib/private/Console/Application.php:145
Stack trace:

0 /snap/nextcloud/5132/htdocs/console.php(99): OC\Console\Application->load

ommands(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Co
ponent\Console\Output\ConsoleOutput))

1 /snap/nextcloud/5132/htdocs/occ(11): require_once('/snap/nextcloud...')

2 {main}user@NUC:~$

I already tried sudo chown -R www-data:www-data /home/user/nextcloud/data

[kyrofa]

Hey @Seferi, note that the web server in the snap runs as root, not www-data (confined root though, don't worry). Try that instead.

[Seferi]

Thanks mate, I really got worried here for a day.. :) Did root:www-data and it works now.
EDIT: Somehow Plex is able to read the directory now.. What are the odds? :confused:

[kyrofa]

Nice! Plex must be www-data, then?

[Seferi]

Well I added plex to www-data group with sudo usermod -aG www-data plex long ago but it didn't work.. Very strange..

[kyrofa]

Well, by default the snap uses root:root so without changing that, adding Plex to www-data didn't do anything. Changing permissions like you did would work, but only by making your data world-readable. Changing ownership like this is a much better solution.

[kyrofa]

Sounds like this solution is working, so I'll go ahead and close this. Please reopen if necessary.

[Seferi]

@kyrofa Just for the sake of understanding what happened.. All I did was changing the ownership to plex with sudo chown -R www-data:plex /home/user/nextcloud/data and then back to root with sudo chown -R root:www-data /home/user/nextcloud/data How come plex can still read the directory? root owns it now, everything is back to before..

[kyrofa]

Well, you said you added Plex to the www-data group, right? If you have 750 permissions with root:www-data, you're allowing the owner (root) to do anything, allowing the group (www-data) to read and execute, and disallowing anyone else from doing anything. Plex is in www-data, so it can read and execute.