New sc-download setup can't access files even with full permissions

They changed the users nzbdrone and sonarr to sc-nzbdrone. By default they have added it to the sc-download group instead of the sc-media group.

drwxr-xr-x 7 sc-nzbdrone nzbdrone 4096 Mar 3 19:16 nzbdrone

cat /etc/group
nzbdrone:x:265802:
sc-download:x:65537:deluge,sabnzbd,nzbget,jackett,transmission,sc-transmission,sc-nzbdrone

Edit 1: Might be wrong about not being in sc-media. Another package slipped up and removed the group, so it might be in both sc-media aswell as sc-download.

i did chown -R sc-nzbdrone:sc-download to both the source and destinations and finally sonarr was able to move and rename stuff.

unsure if now i need to make deluge change the chown upon completing files to make this work because deluge makes everything deluge/users

Edit: it seems to be the source that matters, The file that the torrent downloads needs to be sc-downloads group. not sure how to make deluge or transmission do this…

Your synology utilizes ACLs to add an additional security layer. That helps in not needing to fiddle around with the user:group in the *nix layer.

It took me a while to realize, the best thing is to stay away from the *nix layer, and use the ACLs what they are intended for.

In a “clean” setup, as long as the sc-download or sc-media group has been granted access in the Synology layer.

drwxrwxrwx+ 3 Me users 4096 Mar 6 07:49 Deluge
drwxrwxrwx+ 2 deluge users 4096 Mar 6 07:52 Once…
The + indicates an ACL is present and utilized on the folder

-rwxrwxrwx+ 2 deluge users 1997941137 Mar 6 07:53 Once…mkv
The + indicates an ACL is present and utilized on the file

Even though it seems that it all has 777, actual access is restricted by the ACL. And that’s what you want, because the ACL are the permissions in the synology layer.
Just because we got used to fiddling in the *nix layer due to packages utilizing hidden users, that doesn’t mean that was ever a good idea.

In this example, just grant the group sc-download (which contains the sc-nzbdrone user) read/write in the synology layer on the Deluge folder, and it will have no problem processing your files.

If you have other packages using hidden users, you could always add those to an existing group using for example “sudo synogroup --member sc-media user1 user…”.
But please note that will overwrite the group so all users already present in the group need to be in the command, or they will be lost.

1 Like

YOU ARE AN ABSOLUTE LEGEND!!

as per Mirxs advice i went and did “synogroup --get sc-download” which prints the current list (so you know the current ones to add in the member command)

you’ll see this (i already added deulge to this)
Group Name: [sc-download]
Group Type: [AUTH_LOCAL]
Group ID: [65539]
Group Members:
0:[deluge]
1:[sc-nzbdrone]
2:[sc-radarr]

then i added everything with “synogroup --member sc-download deluge sc-nzbdrone sc-radarr

Another thing you may want to check out is in the DSM GUI settings, go into the group management, double click sc-download then click permissions. make sure the source and destination both have access ( i had to select where my stuff was downloaded to)

everything seems to be working and i tested with importing a file that had deluge:users as the ownership and it worked.

Thanks Mirx

You can also do a “cat /etc/group” for a printout of all group memberships.

CHMOD 777 -R of the downloads AND destination folders fixed this for me

Well. I’ve tried everything suggested in this thread. Reinstall sonarr, group settings, ACL settings. Nothing seems to solve the problem. I give up…

Sonarr version (exact version): 2018303-13
Mono version (if Sonarr is not running on Windows):5.8.0.108-11
OS: Synology DSM
Debug logs: https://pastebin.com/raw/nJ9kZjWT
(Make sure debug logging is enabled in settings and post the full log to hastebin/pastebin/dropbox/google drive or something similar, do not post them directly here. Post in .txt not .doc, .rtf or some other formatted document)
Description of issue: I’ve been using Sonarr on my Synology NAS (DS415+) since I got it several years ago. It’s worked fine until this recent update (or could have been the recent mono update). Now I get an error saying Missing root folder. If I try to add a series manually when I click to browse, Sonarr cannot see the folder where I store all of my TV shows (/volume1/video/TV). I can browse to /volume1/video, but it shows no folders under that, and there are many. I have no idea what could be causing this. Interestingly, it can see some other shares I’ve set up, and I’ve checked the permissions, and they’re actually stricter for those shares than the video share, so it should be able to see anything under that share. I also tried to browse in Radarr and the same thing happens, it doesn’t see sub-directories under video. I’ve tried rebooting the NAS, restarting Sonarr several times, nothing works. I’ve linked to the logs. Hopefully someone can see what is going wrong here. Thanks!

Also tried all of the above.
I decided to edit one of the series to change the path. I just added a letter on to the folder name.
I then imported an episode which created the new folder and imported the episode with no problem.

Using winscp I checked the group and owner of the new folder and saw that the owner was sc-nzbdrone.

I then used winscp to recursively change the owner of the TV folder to sc-nzbdrone which updated all the subfolders and seems to have fixed my import problem!

This was after trying all of the above so some of those changes may also have contributed to fixing my install.

I managed to fix this the following way
First of all, make sure NZBget is in the sc-download group.
if it’s not, you must add it

try the following:

  • go to the parent folder of your “tv-folder” (mine is /volume1/series)
  • set permissions (write and read) for sc-download
  • Connect to your NAS using Putty.
    login as admin, type: sudo -i and enter your password.
  • enter the following: "chown :sc-download /volume1/Series/, press enter
  • next enter: chmod g+s “folderlocation”

Do the same for the downloadfolder. and it should work.
Files already in the folder should be changed manually.

Sonarr moving the files might take a minute or so.

I had the same issue after software update and no amount of Sonarr / Radarr restarts or Synology reboots did anything. Did not fancy uninstalling or reinstalling any of the apps.

The following worked for me and YMMV:

  • Syno Control Panel
  • Group
  • sc-download & sc-media and edit permissions
  • ensured that read/write access was set for my downloads folder
  • in the subsequent pop up checked on apply to all sub folders
    I only have media files in that folder so had no concerns with applying to all other folders and files.
  • no restarts or reboots required and it was all working within 1-2 mins and the backlog of files were imported automatically with no further intervention

That did the trick for me and both Sonarr and Radarr imported files with no issues. I just wanted the least path to resistance for the fix without getting under the bonnet…

1 Like

I’ve been tearing my hair out all day on this.
Sonarr Version: 2.0.0.4689
Mono Version: 5.8.0.108
Synology DSM Version: DSM 6.1.5-15254 Update 1

I am having the same issues that a lot of the people on this post are having. After the most recent update to the Sonarr and Mono packages, Sonarr has stopped importing shows due to Access to Path denied errors.

Couldn’t import episode /volume1/download/nzbget/completed/TV/TVSHOWNAMEHERE/TVSHOWNAMEHERE.mkv: Access to the path is denied.

I have verified that sc-nzbdrone is a member of both sc-download and sc-media:
sc-download:x:XXXXX:apps,nzbget,sc-radarr,sc-nzbdrone
sc-media:x:XXXXX:apps,nzbget,sc-nzbdrone,sc-radarr

I have verified that in the GUI that sc-media and sc-download have full read/write access to /volume1/download/ and all subsequent folders. I have uninstalled/reinstalled Sonarr. I have verified a umask of 000 from NZBGet. I even created a new shared folder under /volume1/test, gave sc-media and sc-download full read/write and still it doesn’t import. I changed the owner:group to sc-nzbdrone:sc-media and sc-nzbdrone:sc-download on /volume1/test and it still didn’t work! (That one kinda blows my mind). I’ve also tried manual imports from /volume1/download/Torrents and those don’t work. Permissions have been verified on all folders in question.

Here’s the nutty thing: RADARR STILL WORKS FINE. Deleted one of my movies and re-downloaded it with ZERO issues. It’s able to pull from /volume1/download/nzbget/completed/Movies with no problem. But Sonarr can’t pull from /volume1/download/nzbget/completed/TV.

I’m at a complete loss as to why this isn’t working anymore. Can anyone give me some more things to try?

Okay…I just figured it out. I had to allow the sc-media and sc-download groups Full Control over the DESTINATION directories…which are /volume1/media. For the love of Pete man…all this time I thought it didn’t have control over the SOURCE directory. That is some really ambiguous logging.

Thanks @molachai for that last tip — I had tried everything else here (reinstalled Sonarr, made sure sc-nzbdrone was in the sc-download and sc-media groups, made sure those groups had read-write access to source folders)… but it turned out that it was indeed the destination that was the problem. Sonarr really needs to fix that error message!

As a side note, changing permissions through Synology’s web interface seems to really mess things up — whether applying extra permissions or changing owner — I did something where Plex no longer had access to its library (that’s the destination for Sonarr) so I reset the owner of that folder to “plex” and checked the box to “Apply to this folder, sub-folder, and files”… when it finished, I SSH’ed in to my NAS and found that it had erased the normal linux permissions on all the subfolders, and Plex was unable to start. :frowning: Had to chmod -R 777 on the Plex folder to get back to normal… finally it all works again. Ugh!

You change permission through the GUI and are surprised it did what you asked, change the permissions…

DSM isn’t a separate permission structure, it set the *nix permission through ACLs, which is an standard permission “add-on” to provide more configurability.

If you use both the GUI and then go in to the *nix layer, you will be in a loop where you are overwriting the either the changes you made in DSM or the changes you made in the shell.

Changes on the shell aren’t reflected/detected in DSM, there is no scheduled/automated permission audit.

So just don’t use chmod/chown if you expect it to work in a logical and reproducible fashion.

If you wanted Plex to have access, you should have just given the Plex user access in the DSM layer, and not overwritten the ACL you just applied.

@Mirx_NL I’m surprised that changing permissions in the GUI erases the standard linux permissions on subfolders, yes.

Regardless, my point here is that settings permissions in the GUI did not work in both cases:

  1. Setting “plex” to the owner of the Plex library folder, recursively, in the GUI, resulted in Plex no longer being able to access anything in the library. Resetting the permissions using chmod and restarting Plex got it back to normal.
  2. Giving Sonarr access to the Plex library folder through the GUI did not fix the “Access to the path is denied” errors mentioned in this thread, whereas using chmod to set standard unix permissions did work.

Just putting this out there in case others run into the same issue. If setting ACLs through the GUI works for you, great!

I’m only trying to explain why the behaviour is weird, and that is that changing permissions in the shell is something DSM does not like, and tends to result in fubar permissions.

The only reason I responded is that this thread is full of people fiddling around until it magically works and then “promoting” that solution, instead of trying to understand how it is supposed to work.

If 10 people say “chmod -R 777” in the shell is the fix, any user reading this thread will assume changing permissions or owners in the shell is a good idea and the starting point for a fix. And yes, the chance it will work is incredibly high as you are giving every user read/write/execute permissions. So unlimited access.

I’m a firm believer in “If it works it ain’t stupid”, but that doesn’t mean it’s smart either.

Chances are when you add a new folder though it might get different permissions due to setgid “conflicts” as a result of the fiddling.

I’ll rest my case, as there’s no additional insight I can share.

I have the same problem and unfortunately I can’t get it to work. My skills with linux cmd is minimal, so most of my problem solving has been in the GUI.
Things a have quadruple checked:
Control Panel
Shared Folder - both nzbget download folder and sonarr destination folder have sc-download and sc-media groups in both system internal user and local groups.
Group - both sc-download and sc-media have sonarr and radarr added in there.
File Station
Navigated to both source and destination directories and made sure the owner (my user admin) and group is set to sc-download for that and all sub directories.
Note: where ever possile, my user admin has been added to these groups if that has any affect, as i could only pick that account for my options.
I’d prefer to get this sorted via GUI like Mirx talks about. I have no idea why its npt working but I bet its something simple.
This only happened recently after the updates…radarr works fine

I won’t get in to making sure the Sonarr install is clean (backup, uninstall, purge old folder, reinstall, restore), but here’s what I did in the folder structure to make it clean through the GUI. I didn’t want to muk around in old configs to be sure there weren’t remnants conflicting, so started “started from scratch” as much as possible.

Please note that I was stressed for time, so didn’t follow the ACL best-practices fully (didn’t change old dir/files)

This is something you might want to try, and then if t doesn’t suit your need, alter it to your prefered structure.
The only 1 thing you need to do in the shell/CLI is checking if the group membership is correct.

Validation (optional)

  1. Login to the CLI and give the command “cat /etc/group |grep sc-”. Output is dependent on your installed package, but should be similar to:
    sc-download:x:65537:deluge,autosub,sabnzbd,nzbget,jackett,transmission,sc-nzbdrone
    sc-media:x:65536:autosub,sc-nzbdrone,plex

Download setup

  1. Go to “control panel”, “shared folder”, and select “create” to create a new shared folder “download_client”.

  2. When prompted for permissions, select “local groups” from the drop-down menu, and grant “read/write” permissions to administrators, sc-download, and sc-media.

  3. Through file-station, add subfolders for your download clients, like NZBGet, Deluge, and Sonarr. I use the Sonarr directory as a destination for tv-shows and sonarr post-processing.

  4. In NZBGet under “settings” and “paths” set your “MainDir” to “/volume1/download_client/NZBGet”. “Destdir” can be to your choosing.

  5. In NZBGet under “settings” and “categories” set your Sonarr category to “DestDir” “/volume1/download_client/Sonarr”.

  6. Do the similar actions for your other download clients.

Sonarr processing
I was in luck here, as Sonarr doesn’t like path changes as far as I’m aware. My TV show folder is already a dedicated Shared Folder. If this not the case for you, then just try adding the permission recusively through the GUI. Also, all my “old” files have 777 like most did in the past.

  1. Important: Shutdown Sonarr

  2. Rename your Shared Folder to _1

  3. Create a new Shared Folder with the original name, and add the permission in the pop-up

  4. Move all your folder to the newly created Shared Folder. This results in identical paths.

  5. Start Sonarr.

New shows will get the ACL permissions. This looks like:
drwxrwxrwx+ 2 sc-nzbdrone nzbdrone 4096 Mar 21 13:32 Bl…

-rwxr-xr-x 1 nzbget users 2265550267 Jan 20 14:33 Bl…mkv
-rwxrwxrwx+ 1 sc-nzbdrone nzbdrone 373322 Mar 21 13:26 poster.jpg

If your old folders don’t work, you might want to try to set the Shared Folder permissions recursively.

Be aware that SynoCommunity just updated the NZBGet package to utilize the DSM6 permission structure and changed the user from nzbget to sc-nzbget

Group
sc-download:x:65537:deluge,autosub,sabnzbd,jackett,transmission,sc-nzbdrone,sc-nzbget

New (downloaded old episode, hence the timestamp)
-rwxr-xr-x 1 sc-nzbget nzbget 3294100649 Mar 17 06:45 Gr…mkv

Old
-rw-rw-r-- 1 107 users 3588815288 Mar 23 09:31 Gr…mkv

1 Like