Run Plex under a different service account?

[HEXYEBO]

Server Version#: 1.40.4.8679
Player Version#: 4.132.2

My setup:
Ubuntu server 24.04 LTS (Noble)
OptiPlex 3040, Core 5, 8GB DDR3, 256GB SSD
Media directories are on NSF mounted NAS share.

The issue:
Every time I add a media file (movie) or folder (TV show season) to NAS, I need to manually grant access to ‘plex’ in order for the server to see the new addition.

sudo chown -R plex:plex <media_folder>

Is there a suggested/supported way to avoid having to execute this step every time? Should I change the account that governs the service to match one that copies files to NAS? Is there a better way?

Cheers,
HEX

[napolij]

Gonna make a couple presumptions here. I am guessing that when you copy a file to your NAS and do an ls, it looks something like:

-rw-r-----. 1 HEXYEBO HEXYEBO file size Aug 9 22:41 filename

to get plex to see this file, you could add the plex user to the HEXYEVO entry in /etc/group file. You’ll probably have to restart the plex service.

The /etc/group file HEXYEBO would look something like this:

HEXYEBO:x:1000:plex

That would let plex “notice” the new media. Although you wouldn’t be able to delete it from the plex interface since plex would not have write access.

[HEXYEBO]

OK, so in /etc/groups I have

…
HEXYEBO:x:1000:
…
plex:x:988:
…

Am I adding plex to HEXYEBO group for this? Ot the opposite?

Wouldn’t it be cleaner to use usermod -aG or something like this?

[napolij]

add plex to HEXYEBO. As long as the group has read permission, plex will see the new media. You’re effectively doing the same thing as the usermod command, so either way is really ok. Whatever you’re most comfortable with.

Just remember that you will need to periodically give group write permission occasionally to any media you may want to delete through the app or web interface.

[ChuckPa]

If I may add here ?

1. When you specify a different username for PMS to run as,
   – using /etc/defaults/plexmediaserver (SYSV)
   – using /etc/systemd/system/plexmediaserver.service.d/override.conf (systemd)

2. The package installer detects the User= and Group= statements.

3. It then does everything necessary to grant that username access to the hardware transcoding group

Please review:

Linux Tips

Customizing your Plex configuration on systemd based systems This information is intended for those systems where cat /proc/1/comm returns systemd. On systems which use Systemd (Ubuntu 16+, Fedora 26+, Centos 7+, Debian 8+,) you create this customization file which SystemD reads prior to launching PMS. This file is independent of the default configuration and service control mechanisms in /lib/systemd/system/plexmediaserver.service. Your customization override is preserved across updates, un…

As confirmation of your configuration changes (on DEB-based installations) it will print a configuration summary of what it will launch PMS as.

Does this help ?

[napolij]

Interesting, I had never come across that Linux tips page.

[ChuckPa]

There is another Linux Tip which you’ll find interesting

Linux Tips

Automating Linux permissions using inheritance (helps with DVR/LiveTV too) Linux has a very powerful and convenient way of automatically setting the permissions of your media files as you add more to your media directories. Linux allows only one username and one group to own a file which is somewhat of a restriction. This can be easily leveraged to accomplish what is needed for Plex. An excellent application of this is when you wish to record with Plex DVR, allowing it to write directly in…

This is how you automate the group ownership .

This way, you own the media (always) but the assigned group always gets applied (regardless how the file was written) by using the setgid function.

The best part is it’s self-propagating

[HEXYEBO]

@napolij , @ChuckPa
Thank you both. Modifying /etc/group helped. Although I had to scan the library manually (set to auto and hourly scans) to see the new file in the UI. Probably unrelated.

I will check out your other suggestions at a later time. The goal is to reduce manual intervention with the file permissions, not everyone on my house is command-line friendly.

[ChuckPa]

@HEXYEBO

I will check out your other suggestions at a later time. The goal is to reduce manual intervention with the file permissions, not everyone on my house is command-line friendly.

You set the UID/GID/ perms you want at the top.
They propagate automatically.

Play with it in /tmp and watch the magic unfold.
(Look at my example)

[napolij]

Thanks for these tips CheckPA. I’ve been working on implementing them. I created the over ride.conf file and now have plex running as me on my media server pc. That all seems to run fine. I didn’t override the group, so my files & directories are owned by me:plex. I did the setguid thing and that seems to propagate the group fine. I must be doing something wrong because the group write does not propagate. I have “UMask=0002” in the override.conf file. No matter what I do, when I try “systemctl show plexmediaserver”, it always tells me the UMask is 022. This is verified since my OTA recordings are set to 644. I’ve tried adding umask 002 to my .bashrc & .bash_profile but that doesn’t seem to do anything which makes sense since I think they only apply to login shells. My plex server is running Fedora if that makes any difference. I’m stumped why the UMask setting doesn’t seem to have any effect.

[ChuckPa]

On some systems . it’s UMask while on others, it’s Umask.

Also, some want 3 digits while others want 4.

[napolij]

I’ve tried Umask & UMask, 0002 & 002. Unfortunately, always with same result

[napolij]

Looks like I have it sorted out. I found an example UMask setting in multi-user.target.wants/rsyslog.service “UMask=0066” It made me wonder if systemd didn’t like the comment following the UMask setting. So I edited that line so that it was only “UMask=0002”. Now “systemctl show plexmediaservice” shows that as the running UMask.

I’ve got a test recording set up to verify its working properly now but I’m pretty confident it will

[napolij]

As expected, that worked perfectly. Just to verify, I re-edited the override.conf file and appended a comment character on the UMask line. After reloading the systemctl daemon, UMask reverted back to 0022. So that comment was the culprit.

Now if I can get sftp to bend the knee when I drag and drop media from my laptop to the media server, I’ll be happy. I think it tries to preserve whatever permissions a media file has on the laptop.

[HEXYEBO]

@napolij , @ChuckPa
Sorry, lost focus of this due to work stuff.
I think I resolved my initial issue by adding User=hex Group=hex to /etc/systemd/system/plexmediaserver.service.d/override.conf
Then I took back the ownership of all media directories with chown -R
Did not mess with Umask as there seems to be no need to ATM.

Let’s see how PMS behaves once the next update rolls around.

Thanks for the assistance.