Emby systemd service is started by a user that doesn't exist

[JWalsh]

I tried to change the cache path (from the Emby interface’s Settings page) to a directory to which the emby user (emby) and its group (media) both have full permissions (the directory owner is emby, the group is media, and permissions are set to 775), but it kept telling me that it didn’t have write access.

Turns out the media group exists, but the emby user doesn’t.

I’d checked these instructions for the initial setup and so hadn’t realized the installer wouldn’t be creating an emby user:
https://wiki.archlinux.org/title/Emby

If I go into Manjaro settings and create an emby user and assign it to the media group, what do I need to do about the password? I would think that the service would need to know it in order to start.

Or am I way off base?

[Hanzel]

The linked article does not specify the creation of a password.

Does the service work without a password?

The service will run under the context of the specified user (using systemd’s DynamicUser feature) and does not log on to the system, however I have never used Emby,

[Mirdarthos]

Hi @JWalsh,

I’m obviously not sure, but I suspect you can disable login for that user. You can do that with:

$ sudo passwd -l baeldung <userToModify>

Where, <userToModify> is, you guessed it, the user you wish to disallow login to.

Hope this helps!

---

Reference:

How to Disable User Logins on Linux | Baeldung on Linux

[JWalsh]

Aha! I wasn’t aware of the DynamicUser feature. Sounds like I don’t need to be concerned about the fact that there is no emby user listed in the system. Thank you for that.

Still there’s the mystery of why Emby (the service) is saying it can’t write to /home/media_files/temp/ when the permissions are:

drwxrwsr-x 2 emby media 4096 Jun 11 07:48 temp

Here’s the emby-server.service file contents:
[Unit]
Description=Emby brings together your videos, music, photos, and live television
.
After=network.target

[Service]
User=emby
Group=media
SupplementaryGroups=render
SupplementaryGroups=video
DynamicUser=true
StateDirectory=emby
ReadWritePaths=-/dev/dri

EnvironmentFile=/etc/conf.d/emby-server
ExecStart=/usr/bin/emby-server
RestartForceExitStatus=3

AmbientCapabilities=
CapabilityBoundingSet=
LockPersonality=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true

[Install]
WantedBy=multi-user.target

[Hanzel]

The linked article at 3 provides an example :

Then extend the unit:

/etc/systemd/system/emby-server.service.d/write-permissions.conf

[Service] 
SupplementaryGroups=media 
ReadWritePaths=/mnt/media_files 
UMask=0002

This will add the emby user to the media group, and enable write permission to the /mnt/media_files directory through systemd. Rinse and repeat for any additional media folders you might have.

I’m no expert on the filesystem but using the home folder for this could be, or cause a problem.
In a case like this I would use something like /data/media/
Edit: follow up thread: Permissions look right, but Emby says it can't write to directory