Workspace Access Problem

[Dan Rose]

Hi,

I've got eight identical systems with OS 10.5.4 and Pro Tools LE 7.4.2 on Mac Minis with 003s and external Firewire drives. All were working fine for one day, and now, none can record. Starting a new session or opening an old session brings up the error that the session needs to be on a record volume, and opening the workspace browser (to set the volume to R) results in a blank browser and an error in the task window that I do not have access to the workspace.

I've tried this with the managed user accounts I'm using, I've tried it with the Administrator account, I've tried it with a brand new Administrator account. All of them fail. The drives are all Mac OS Extended (Journaled), and the external drive is owned by the user account, who has full read and write access to everything. I've also repaired permissions on all the drives. It's not a permissions problem.
Incidentally, in trying to determine if it was a permissions problem, I enabled the root user account, figuring that if anyone has access, root does... But Pro Tools can't run as root - I get a message saying it requires an Administrator account. Come on, Digi, who's more of an administrator than root?

So, what's up? Any guesses?
I've got one other clue - these were upgrades from older systems on 10.3.9 and Pro Tools 6.7. At least one new system worked fine with a _new_ session, but after opening an old session, the workspace is now "locked" and we can't start any new ones.
I've also tried deleting the Digidesign Database folder off each drive. No help.

Digi - where is the "workspace"? Is it just /Volumes/? Would it help if I chmod'd Volumes to give anyone r+w+x? I don't want to, that's idiotic, but if it will help, I will.
Or, is the "workspace" a database stored someplace else that's maybe inheriting an access control list from a parent folder?

Urgent reply needed... I've got 8 rooms offline.

Thanks,
-Dan

[Craig F]

what are the OS permissions to the drives?

[Dan Rose]

The firewire drives are owned by the user (in this case "production"), who is a member (the only member) of the group "production", and the defaults are set - rwxrwxr-x.
Nonetheless, the drives are _also_ set to "Ignore ownership on this drive".
The system drive has the default ownership - root, admin, rwxrwxr-x.

Keep in mind that I get the same problem with the Administrator account, who has full read-write-execute on the system drive.

The /Volumes/ folder is owned by root and has permissions rwxrwxrwt (with t being the sticky bit)

As an added wrinkle, if I disconnect the Firewire drive, I _still_ can't browse the workspace.
I really don't want to try changing ownership of /Volumes/, 'cause that's insane, but I can give it a shot.

[Slim Shady]

How about just deleting the volumes folder, then see what permissions it has when PT generates a new one.

[Dan Rose]

You can't delete /Volumes/ - it's the directory that the OS stores information about all drives.

[Dan Rose]

Figured out the problem. Not sure why it started, but just in case others run into it:
The folder Macintosh HD/Library/Application Support/Digidesign/ and everything in it were owned by "system", and members of the group "unknown" had read-write access to it. It was then locked to everyone else. This is what caused the "you don't have privileges to access the workspace" problem.

There are two ways to fix it:
A) Run the recent 7.4.2 patch. In spite of it supposedly being to fix an inadvertent "pre-release" dialog box, it also runs a script that modifies that folder to make it read-write accessible to everyone, whether a user or not. This works, but is a bad piece of code, because it creates a security hole in your Library folder that non-local users have full access to.
B) Open the terminal while logged into an Administrator account, and type in:

sudo chown -R :staff /Library/Application\ Support/Digidesign/

This makes the folder accessible to all Administrators (they're part of group "staff") and non-Administrators (regular "staff" users).

If you just want to examine the folder to see if you need to fix this, open the Library folder and the Application Support folder, and get info on the Digidesign folder, then look in the privileges and ownership tab. You should have read-write access. If you don't, this could eventually cause a problem if you need to change a drive from transfer to record at some point.

Disclaimer: The terminal is very powerful, and typing the wrong thing could cause unintentional effects. Use at your own risk. The above code has been applied on eight machines with no ill effects, but your mileage may vary. I don't have any plugins installed except Soundsoap and the Ignition Pack. "sudo" allows an administrator to make system changes, "chown" changes ownership, ":staff" changes the group ownership, and "-R" makes the command recursive and apply the same change to everything within the folder, and the backwards slash in "/Application\ Support/" is so that the terminal reads the space without assuming it's the end of the command. Google can verify all of the above information.