Page 2 of 24
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 18:19
by T1mbo
Hello everyone
In TOS 7, the root user cannot perform any privileged actions, which imposes certain restrictions when using the new developer mode.
For example, I installed zabbix-agent2 and want to receive SMART data from disks, but I can't figure out how to give root permission to do so. I added root to the admin group, but that didn't help. Does anyone have any ideas?
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 18:26
by RyanYang
Thank you for bringing this to our attention. We have updated the corresponding post with information regarding TOS 7.
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 18:27
by athurdent
T1mbo wrote: ↑15 Dec 2025, 18:19
For example, I installed zabbix-agent2 and want to receive SMART data from disks, but I can't figure out how to give root permission to do so. I added root to the admin group, but that didn't help. Does anyone have any ideas?
zabbix-agent2, for regular Ubuntu you'd usually do it similar to this:
Code: Select all
/etc/sudoers.d/zabbix
zabbix ALL=(ALL) NOPASSWD:/usr/sbin/smartctl
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 18:38
by T1mbo
athurdent wrote: ↑15 Dec 2025, 18:27
zabbix-agent2, for regular Ubuntu you'd usually do it similar to this:
Code: Select all
/etc/sudoers.d/zabbix
zabbix ALL=(ALL) NOPASSWD:/usr/sbin/smartctl
This will not work for TOS 7 because root cannot run smartctl:
Code: Select all
root@TNAS:/tmp/log$ smartctl -a /dev/sda
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org
Read Device Identity failed: Operation not permitted
Similarly, root is not allowed to run dmesg, etc.
So, it turns out that root is not root because it does not have privileges for privileged commands.
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 18:46
by athurdent
T1mbo wrote: ↑15 Dec 2025, 18:38
Similarly, root is not allowed to run dmesg, etc.
So, it turns out that root is not root because it does not have privileges for privileged commands.
One has to wonder what kind of developer mode that is supposed to be then.
Would be great if TerraMaster could chime in on how we are supposed to "gain full root access and seamlessly access Ubuntu's vast software repository" ( quote from
https://www.terra-master.com/pages/tos7 ) without actual root access?
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 18:47
by athurdent
TMroy wrote: ↑15 Dec 2025, 18:39
Thank you for your feedback, the release note has been to modified to better clear.
Awesome, thank you very much!
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 18:55
by storageninja
T1mbo wrote: ↑15 Dec 2025, 18:38
athurdent wrote: ↑15 Dec 2025, 18:27
zabbix-agent2, for regular Ubuntu you'd usually do it similar to this:
Code: Select all
/etc/sudoers.d/zabbix
zabbix ALL=(ALL) NOPASSWD:/usr/sbin/smartctl
This will not work for TOS 7 because root cannot run smartctl:
Code: Select all
root@TNAS:/tmp/log$ smartctl -a /dev/sda
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org
Read Device Identity failed: Operation not permitted
Similarly, root is not allowed to run dmesg, etc.
So, it turns out that root is not root because it does not have privileges for privileged commands.
Disable: security and privacy control (SPC) protection
That made my Zabbix-agent run fine afterwards, I got a full NVMe F4-SSD and this works fine for me.
Code: Select all
@TNAS2:~# smartctl -a /dev/nvme0
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Model Number: KINGSTON OM
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 19:13
by T1mbo
storageninja wrote: ↑15 Dec 2025, 18:55
Disable: security and privacy control (SPC) protection
That made my Zabbix-agent run fine afterwards, I got a full NVMe F4-SSD and this works fine for me.
I have F2-424 and SPC is disabled.
I even enabled and disabled it, but root still has no privileges.
Code: Select all
root@TNAS:/home/user$ dmesg
dmesg: read kernel buffer failed: Operation not permitted
Code: Select all
root@TNAS:/home/user$ smartctl -a /dev/sda -d sat
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org
Read Device Identity failed: Operation not permitted
It's funny that everything works fine when running commands as non-root user, but zabbix-agent2 seems to be hardcoded to elevate privileges to root, and this behavior cannot be fixed.
EDIT:
In the end, I found out:
1) root in the system is fake
Code: Select all
root@TNAS:/etc/pam.d$ getent passwd root
root:x:9999:9999:Linux User,:/root:/usr/sbin/nologin
Code: Select all
root@TNAS:/etc/pam.d$ cat /proc/self/status | grep CapEff
CapEff: 0000000000000000
uid 0 is the primary user in the system
Therefore, the smart zabbix-agent2 plugin will not work because sudo is hardcoded there.
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 21:34
by storageninja
T1mbo wrote: ↑15 Dec 2025, 19:13
storageninja wrote: ↑15 Dec 2025, 18:55
Disable: security and privacy control (SPC) protection
That made my Zabbix-agent run fine afterwards, I got a full NVMe F4-SSD and this works fine for me.
I have F2-424 and SPC is disabled.
I even enabled and disabled it, but root still has no privileges.
Code: Select all
root@TNAS:/home/user$ dmesg
dmesg: read kernel buffer failed: Operation not permitted
Code: Select all
root@TNAS:/home/user$ smartctl -a /dev/sda -d sat
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org
Read Device Identity failed: Operation not permitted
It's funny that everything works fine when running commands as non-root user, but zabbix-agent2 seems to be hardcoded to elevate privileges to root, and this behavior cannot be fixed.
EDIT:
In the end, I found out:
1) root in the system is fake
Code: Select all
root@TNAS:/etc/pam.d$ getent passwd root
root:x:9999:9999:Linux User,:/root:/usr/sbin/nologin
Code: Select all
root@TNAS:/etc/pam.d$ cat /proc/self/status | grep CapEff
CapEff: 0000000000000000
uid 0 is the primary user in the system
Therefore, the smart zabbix-agent2 plugin will not work because sudo is hardcoded there.
Which catched me, you use zabbix-agent2 I do use zabbix-agent.
This works for me:
Code: Select all
systemctl edit zabbix-agent
[Service]
User=root
Group=root
misterx@TNAS:~# cat /etc/zabbix/zabbix_agentd.conf | grep -i root
### Option: AllowRoot
# Allow the agent to run as 'root'. If disabled and the agent is started by 'root', the agent
AllowRoot=1
# Only has effect if run as 'root' and AllowRoot is disabled.
User=root
Re: TOS 7 Beta Is Available for Testing
Posted: 15 Dec 2025, 22:26
by T1mbo
storageninja wrote: ↑15 Dec 2025, 21:34
Which catched me, you use zabbix-agent2 I do use zabbix-agent.
This works for me:
Code: Select all
systemctl edit zabbix-agent
[Service]
User=root
Group=root
misterx@TNAS:~# cat /etc/zabbix/zabbix_agentd.conf | grep -i root
### Option: AllowRoot
# Allow the agent to run as 'root'. If disabled and the agent is started by 'root', the agent
AllowRoot=1
# Only has effect if run as 'root' and AllowRoot is disabled.
User=root
Yes, I am using version 2 of zabbix-agent, the one written in Go.
I also tried running it under a different user via systemd override, but it didn't work because in the code itself, smartctl is actually called via sudo
I found a solution for myself: I just ran the agent in Docker and collect metrics in it, although the best solution would be to install the first version of zabbix-agent, but in the press release we were promised full root access
