[Help] TOS 7 `tmacl`: how do I let a non-root Docker user read a bind-mounted shared folder? [SOLVED]

[validide]

Model: TNAS T6-423 · TOS: 7.0.0777 (recently upgraded from TOS 6) · Docker: built-in package

What's happening

Since upgrading from TOS 6 to TOS 7, a Docker container of mine can no longer read files I bind-mount into it from a shared folder on /Volume1. The catch is that the process inside the container runs as an unprivileged user (nobody, uid 65534), not root. Under TOS 6 this worked fine; under TOS 7 every read by that user fails with "Permission denied".

Things that run as root inside the container can read the mounted files without issue — it's specifically the non-root user that's blocked.

What I've verified

The files themselves have permissive modes and I've even added a POSIX ACL granting the uid — getfacl shows the grant and the mask allows it:

Code: Select all

$ getfacl /Volume1/<share>/<file>
user::rw-
user:nobody:r--
group::r--
mask::r--
other::r--

...but the uid still can't read it. Crucially, this is not a Docker problem — it fails the same way directly on the host, outside any container:

Code: Select all

$ sudo -u nobody cat /Volume1/<share>/<file> >/dev/null && echo OK || echo DENIED
DENIED

So a world-readable (0644) file, owned by an admin user, with an explicit POSIX ACL granting nobody:r, still can't be read by uid 65534 — on the host itself.

The thing that stands out is the mount options on the volume:

Code: Select all

$ findmnt -T /Volume1/<share>
TARGET   SOURCE                  FSTYPE OPTIONS
/Volume1 /dev/mapper/vg0-lv0[/@] btrfs  rw,noatime,discard=async,tmacl,space_cache=v2,subvol=/@

I see tmacl in the options rather than the standard btrfs "acl". From other threads here it sounds like TOS 7 introduced a new permission mechanism and that tmacl is TerraMaster's own ACL layer, with /usr/sbin/aclconv used to convert/flag folders for it. That seems to line up with what I'm seeing: standard POSIX permissions and setfacl entries are stored but simply not honored for a uid that TOS doesn't know about.

My questions

1. Is my understanding of tmacl correct — that it overrides POSIX permissions/ACLs, so chmod/setfacl no longer grant access to arbitrary uids the way they did on TOS 6?
2. What is the supported way to grant a specific uid/gid (e.g. 65534) read access to a shared folder under TOS 7, so a non-root container process can read bind-mounted files? Is there a Control Panel / File Manager permission setting for this, or must it be done at the CLI?
3. Does /usr/sbin/aclconv apply here, and if so what's the correct usage to add a tmacl grant for a given uid/gid on a folder (recursively)? I've seen the general "btrfs property set … ro false" → setfattr → aclconv → "ro true" sequence mentioned, but not the exact aclconv syntax or whether it can target a raw numeric uid.
4. Is the recommended pattern instead to run the container as a real TOS user/group (one that has been granted access to the shared folder in the UI) and map the container to that uid/gid — rather than trying to grant the generic nobody uid?
5. Is there any mount-level option (e.g. mounting that subvolume with standard "acl" instead of "tmacl") that's supported/safe, or would that break TOS's permission management?

Goal

I just want a non-root process (running as an arbitrary uid) to be able to read a handful of config/data files from a shared folder, in a way that's supported and survives reboots/upgrades — without running the container as root and without fighting the permission system.

Any guidance on the intended TOS 7 workflow for this would be much appreciated. Thanks!

[Felix]

Thank you for your detailed testing and analysis.

Your understanding is correct. In TOS 7, system-wide permissions are managed through tmacl. If you need to grant access permissions to an arbitrary UID/GID (for example, UID 65534), you need to use tmacltool to add the corresponding permissions.

1. Does tmacl affect traditional POSIX ACL permissions?

Yes. In TOS 7, permission management is based on tmacl. Traditional methods such as chmod and setfacl cannot be used to manage TOS global permissions.

2. How can permissions be granted to a specific UID/GID?

For users and groups created within TOS, we recommend granting permissions through:

Control Panel → Privilege → Shared Folder Permission

For users or groups that are not created within TOS, permissions can be granted through the command line using tmacltool.

3. Is aclconv required for this case?

No. It is not applicable to this scenario.

4. Recommended Docker permission configuration:

We recommend creating users or groups within TOS, granting them the required permissions on the shared folder, and then running Docker containers with the corresponding UID/GID.

For users or groups that are not created within TOS, you can use tmacltool to add the required permissions.

5. How to use tmacltool:

You can use:

tmacltool add

to add permissions. The permissions will remain effective after reboot.

You can use:

tmacltool help

to view the command syntax and usage instructions.

Currently, TOS 7 only supports managing system-wide permissions through tmacl.

We recommend using tmacltool for permission management. Other methods are not supported or recommended, as they may cause permission inconsistencies.

[validide]

Hi Felix,

Thank you for the infomration I will give this a try.