User within a group cannot chmod on local disk mounted as NTFS

Question

I have a local SSD disk, which is mounted via /etc/fstab on my Ubuntu machine:

/dev/sdb2 /media/Store ntfs-3g rw,nosuid,nodev,default_permissions,umask=0002,uid=deniss,gid=deniss 0 0

I can read and write anything on that drive. Now I have installed nginx and php-fpm, and added www-data to my group and www-data in my group so i can edit files from both groups:

$ groups deniss
deniss : deniss adm cdrom sudo dip www-data plugdev lpadmin lxd sambashare

$ groups www-data
www-data : www-data deniss

nginx user (www-data) can read and write all files on mounted share, the problem starts when it tries to chmod files on a drive:

$ sudo -u www-data chmod 644 test.txt
chmod: changing permissions of '/media/Store/file.txt': Operation not permitted

Not that I need www-data to chmod files, but there are local websites running on the drive, and chmod sometimes is integrated into libraries and frameworks and I cannot disable them.

Answer 1

NTFS is not a unix filesystem and is not capable of using unix ownership, groups, or permissions.

When an NTFS filesystem is mounted on linux, ONE user and ONE group are used to simulate ownership of ALL files and directories, and ONE set of permissions is also used for all files/dirs on the NTFS mount.

This is what the default_permissions,umask=0002,uid=deniss,gid=deniss part of your /etc/fstab entry is setting up.

Answer 2

The ntfs-3g driver can actually provide the functional equivalents of unix-style ownerships, groups and basic permissions. It does not do it by default, because the driver does not know how the Linux user and group IDs should be represented as Windows Security IDs (SIDs for short).

But if you create a mapping file that identifies a corresponding Windows SID for each relevant Linux UID and GID, and place it (in your case) at /media/Store/.NTFS-3G/UserMapping, then commands like chmod and chown will work mostly as expected (except setuid/setgid/sticky bits for files) as long as only users and groups for which a SID mapping exists are referenced.

See the USER MAPPING paragraph in man ntfs-3g for details. The ntfsusermap command can help you in creating such a mapping file by identifying files with a particular Windows user or group SID and asking you what the corresponding Linux user or group should be, and repeating the process until all the existing SIDs in the filesystem are mapped or you want to stop creating more mappings.

From https://jp-andre.pagesperso-orange.fr/ntfsusermap.html you'll find examples on using ntfsusermap, and also a Windows version of the ntfsusermap tool, in case it's more convenient for you to create the mapping file while running Windows (so you can have Windows look up the human-readable names associated with each SID that needs to be mapped).