It appears your current setup is for root/wheel to be the actual owner of the share. But keep in mind when you upload files to the share they get uploaded under the username you connect to the share with. Since I set the user/group as me/plex and to inherit permissions this caused the files I upload to be set as me/plex And since the default permissions on the share are read/write/execute for both user and group, I’ve essentially split the permissions on them.
I maintain full control, since they are under my username, but they now have the group of “plex” which is the name of an actual group on the FreeNAS system, and the Plex jail, and deliberately created with the user/group ID numbers that the plex user on the Plex jail has, so Plex Media Server can now read them (and write if I hadn’t set the mountpoint to the jail as read-only).
Just to point out, I really am not a wizard at the whole ACL thing. I had to deal with this after I upgraded to FreeNAS 11.2U7 and added a new pool to my system, because that was where IX Systems changed the default permissions for SMB shares. Here’s how they look on an older pool:
Note that everyone has read access. This is actually what FreeNAS did by default on shares created by older versions. I, too, try to set up a unversal catch-all group for access by media servers on my system, but I can’t recall how successful I was in getting that to work when I need files created by one application, and perhaps managed by another, to be readable by 2-3 more. But things were understandably easier when everyone could at least read them.
Then I got stuck with this issue and Plex with my new pool (which is meant to store only rips of my personal blu-rays for Plex’s usage), and I found this video, which tells you how to add “everyone” with FULL access, and I was like, “wtf if I can just manually add additional users like this, I should just add the one I really need here instead of leaving this wide open”, and then taking it a step further, “I could just change the default wheel group to the plex group instead” (which my username is an auxillary member of, not that I know if that’s necessary). So now when I add files they are readable by Plex but I can still rename/remove/etc them with no issue.
Edit: Here’s how a directory on the old pool, using the old FreeNAS default looks permissions-wise:
My username is assigned owner, since the files are being synced using a utility using my credentials, and the group is set to the catch-all “share_access” group which multiple apps are a part of with their usernames. But even without that they would still be able to read and open sub-folders due to the permission setup.