System.UnauthorizedAccessException

[Wurstinator 1]

Hi.

I have Emby installed on a Raspberry Pi running openmediavault. After having the system going for quite a while, I updated to the latest version (both openmediavault and Emby). Since then, Emby doesn't work properly anymore.

For example, when I try to "Download" a movie or show with the Web UI, nothing happens and the following error is logged:

2024-06-27 22:17:14.848 Error Server: Error processing request
*** Error Report ***
Version: 4.8.8.0
Command line: /system/EmbyServer.dll -programdata /config -ffdetect /bin/ffdetect -ffmpeg /bin/ffmpeg -ffprobe /bin/ffprobe -restartexitcode 3
Operating system: Linux version 5.10.103-v7l+ (dom@buildbot) (arm-linux-gnueabihf-gcc-8 (Ubuntu/Linaro 8.4.0-3ubuntu1) 8.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #15
Framework: .NET 6.0.25
OS/Process: arm/arm
Runtime: system/System.Private.CoreLib.dll
Processor count: 4
Data path: /config
Application path: /system
System.UnauthorizedAccessException: System.UnauthorizedAccessException: Access to the path '/data/tvshows/The Bear/Season 02/The.Bear.S02E02.Pasta.mkv' is denied.
---> System.IO.IOException: Permission denied
--- End of inner exception stack trace ---
at Interop.CheckIo(Error error, String path, Boolean isDirectory, Func`2 errorRewriter)
at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String path, OpenFlags flags, Int32 mode)
at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String fullPath, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
at System.IO.Strategies.OSFileStreamStrategy..ctor(String path, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
at System.IO.Strategies.FileStreamHelpers.ChooseStrategy(FileStream fileStream, String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, Int64 preallocationSize)
at System.IO.FileStream..ctor(String path, FileStreamOptions options)
at Emby.Server.Implementations.IO.ManagedFileSystem.GetFileStream(String path, FileOpenMode mode, FileAccessMode access, FileShareMode share, Int32 bufferSize, FileOpenOptions fileOpenOptions, Int64 preAllocationSize)
at Emby.Server.Implementations.IO.ManagedFileSystem.GetFileStream(String path, FileOpenMode mode, FileAccessMode access, FileShareMode share, Int32 bufferSize, FileOpenOptions fileOpenOptions)
at Emby.Server.Implementations.IO.IOManager.GetResponse(HttpRequestOptions options, MediaProtocol protocol)
at Emby.Server.Implementations.IO.IOManager.GetResponse(HttpRequestOptions options)
at Emby.Server.Implementations.HttpServer.HttpResultFactory.GetContent(StaticFileResultOptions options, Int64 offset, Int64 length, CancellationToken cancellationToken)
at Emby.Server.Implementations.HttpServer.FileWriter.SetContentResponseHeaders(Nullable`1 reportedTotalContentLength, CancellationToken cancellationToken)
at Emby.Server.Implementations.HttpServer.HttpResultFactory.GetStaticResult(IRequest requestContext, StaticResultOptions options)
at Emby.Api.Library.LibraryService.Get(GetDownload request)
at Emby.Server.Implementations.Services.ServiceController.GetTaskResult(Task task)
at Emby.Server.Implementations.Services.ServiceHandler.ProcessRequestAsync(HttpListenerHost httpHost, IServerApplicationHost appHost, IRequest httpReq, IResponse httpRes, IStreamHelper streamHelper, RestPath restPath, String responseContentType, CancellationToken cancellationToken)
at Emby.Server.Implementations.HttpServer.HttpListenerHost.RequestHandler(IRequest httpReq, ReadOnlyMemory`1 urlString, ReadOnlyMemory`1 localPath, CancellationToken cancellationToken)
Source: System.Private.CoreLib
TargetSite: Void CheckIo(Error, System.String, Boolean, System.Func`2[Interop+ErrorInfo,Interop+ErrorInfo])
InnerException: System.IO.IOException: Permission denied
Source:
TargetSite: 

 

What I am lost at is that the docker container seems to have full access to the file from terminal:

pi@omvpi:~ $ docker ps
CONTAINER ID   IMAGE                     COMMAND   CREATED          STATUS          PORTS                                                                     NAMES
a1d7ad118cb9   emby/embyserver_arm32v7   "/init"   56 minutes ago   Up 56 minutes   1900/udp, 7359/udp, 0.0.0.0:8096->8096/tcp, :::8096->8096/tcp, 8920/tcp   emby
pi@omvpi:~ $ docker exec a1d7ad118cb9 stat -c "%A %a %n" "/data/tvshows/The Bear/Season 02/The.Bear.S02E02.Pasta.mkv"
-rwxrwxrwx 777 /data/tvshows/The Bear/Season 02/The.Bear.S02E02.Pasta.mkv
pi@omvpi:~ $ docker exec a1d7ad118cb9 cat "/data/tvshows/The Bear/Season 02/The.Bear.S02E02.Pasta.mkv" | head -c20
�Eߣ�B��B��B�B� 

 

This is the compose file to deploy the Emby container:

---
version: "2.1"
services:
  emby:
    image: emby/embyserver_arm32v7
    container_name: emby
    environment:
      - PUID=1000
      - PGID=100
      - TZ=Europe/London
    volumes:
      - /srv/dev-disk-by-label-storage/media/config:/config
      - /srv/dev-disk-by-label-storage/media/shows:/data/tvshows
      - /srv/dev-disk-by-label-storage/media/movies:/data/movies
      - /srv/dev-disk-by-label-storage/media/music:/data/music
    ports:
      - 8096:8096
      - 8920:8920 # HTTPS port
    devices:
      - /dev/vchiq:/dev/vchiq # MMAL/OMX on Raspberry Pi
    restart: on-failure

 

I have no idea why it's not working. Help is appreciated.

[Luke 42077]

Hi, does this similar topic help at all?

 

[Wurstinator 1]

Hi. Thanks, indeed it does. Mostly from the idea to use "ps -a" within the container to check which user owns the Emby process, which was "bin" in my case aka the default user, although I wanted it to be my user 1000.

In the end, the fix was to use the "UID" environment variable rather than "PUID".

This seems to have been a breaking change in the behavior of the Docker image at some point in the past.

Edited June 28, 2024 by Wurstinator
emphasize the solution