Setting Permissions on Datasets

Permission settings in TrueNAS are applied onto Datasets in a Pool. Think of datasets as a folder and the pool is the C: or D: drive. 

You can learn more about the permission settings at the office documentation site: https://www.truenas.com/docs/core/coretutorials/storage/pools/permissions/ 

Login to your TrueNAS system. Navigate to the dataset, and click on the three dots to the right of the dataset to see the possible Dataset Actions.

Choose Edit Permissions.

Permission Editor

TrueNAS defaults to the simple Permission Editor when you first go to Edit Permission. This is useful for setting permissions quickly if there is only one user accessing the dataset. 

Edit the options as you see fit. Select the user and user group that will be accessing the dataset. 

Once you have selected the user and group, make sure to check the box for Apply User and Apply Group in order to have the change take effect when you click Save.

Check the option for Apply Permission Recursively in order for the changes to apply to all files in the dataset. Otherwise, the new permission settings will only apply to new files created afterward.

Choose Save to save the changes. The dataset is now ready to be use.

ACL Manager

If you need multiple users to access the dataset, you can use the ACL Manager to manage the permission settings.

After choosing Edit Permission on the Dataset Actions, select the ACL Manager.

You will be prompted to choose a preset ACL or create a custom one.

For this guide, we will create a custom ACL.

FirstWe thingswill Istart likeoff by setting the owner user and owner group for the share. Choose the User and Group that you want to doown the share and have full permission to, and check Apply User and Apply Group in order to save and apply the changes.

Without checking Apply User and Apply Group, the changes will not take effect for the share.

Next, we will remove the default presets that's on the ACL list. Starting from the bottom, with the everyone@ item, click Delete to remove it. Then remove the group@ item. When you reach the owner@ item, the Delete option should be greyed out as you must have a minimum of one ACL item on the list.

Click on ADD ACL ITEM to start a new ACL entry. You can remove the owner@ item after the new ACL entry is created.

Choose the Group option under the Who* dropdown. This will allow us to set the permission for the share base on group.

By utilizing groups for the permissions, you can have users automatically inherit the permission for the group if they are member of the group, without needing to individual set the permission in the ACL Managereditor for athe newlyusers. created datasetThis is tohandy deleteif allyou thehave existinga ACLlot items,of untilusers, or if you are leftfrequently withadding oneor entryremoving (whichusers cannotin beTrueNAS.

deleted)

For the Permission Type, you can choose Advanced or Basic.

Basic, as its name implies, will give you simple options of Read, Modify, Traverse, or Full Control.

Basic Permission Options Descriptions

Read	Can view file or directory contents, attributes, named attributes, and ACL. Includes the Traverse permission.
Modify	Can adjust file or directory contents, attributes, and named attributes. Create new files or sub-directories. Includes the Traverse permission. Changing the ACL contents or owner is not allowed.
Traverse	Execute a file or move through a directory. Directory contents are restricted from view unless the Read permission is also applied. To traverse and view files in a directory, but not be able to open individual files, set the Traverse and Read permissions, then add the advanced Directory Inherit flag.
Full Control	All and every permission possible to the share, as if the user/group is the owner of the share.

For most use cases, the Basic permission type is sufficient.

EditAdvanced Permission type is for when you have special uses cases for the dataset, such as giving a group read and write permission, but not delete permissions.

Advanced Permission Options Description

Read Data	View file contents or list directory contents.
Write Data	Create new files or modify any part of a file.
Append Data	Add new data to the end of a file.
Read Named Attributes	view the named attributes directory.
Write Named Attributes	create a named attribute directory. Must be paired with the Read Named Attributes permission.
Execute	Execute a file, move through, or search a directory.
Delete Children	delete files or sub-directories from inside a directory.
Read Attributes	view file or directory non-ACL attributes.
Write Attributes	change file or directory non-ACL attributes.
Delete	remove the file or directory.
Read ACL	view the ACL.
Write ACL	change the ACL and the ACL mode.
Write Owner	change the user and group owners of the file or directory.
Synchronize	synchronous file read/write with the server. This permission does not apply to FreeBSD clients.

When you are done setting the permissions, check the option Apply permissions recursively so that all data in the dataset will inherit the new permissions.

Also check the option for the Access Control List. 

Most of time, it is a good idea to use Groups for the permission settings so that you can easily add or remove users permission from a dataset by simply modifying the user's group membership. 

Make sure you have at least one ACL entry with the Inherit flag set. 

Once you're done editing the ACL, choose Apply permission recursively and Apply permissionpermissions to child datasets inso orderthat forany dataset under the changescurrent toone applywill toalso all files inget the dataset.

new

Clickpermission setup. Save towhen save the changes.finished.

That's it!