Feature description

in: upgrade_supported.upgradeToURL()

One of the following:

copy the capabilities from the syncthing.old file to the new
on linux, always stcap CAP_CHOWN,CAP_FOWNER=+ep syncthing

Problem or use case

Situation:

on all linux systems
whenever syncthing has enabled CopyOwnershipFromParent
that does not run as root but as user which had been given write-rights using other means (i.e. by adding the syncthing user to an elevated permission/ownership group)
where the syncthing binary had been given stcap CAP_CHOWN,CAP_FOWNER=+ep syncthing because of copyOwnershipFromParent
that does an auto-upgrade using upgrade_supported.go

syncthing will

overwrite its own binary using upgrade_supported.upgradeToURL()
and then not call setcap on itself as recommended in copyOwnershipFromParent

this will lead to

syncthing binary losing ` CAP_CHOWN,CAP_FOWNER=+ep
syncthing not being able to chown files it creates during sync in folder_sendrecv.copyOwnershipFromParent()
syncthing not being able to rename files after synchronization, leaving a lot of .syncthing.<fname>.tmp files with wrong ownership in the folders
stopping the sync completly with "isn't making sync progress"
with an error
every time it auto-updates, which is every couple of weeks

Error in the log

2025-04-24 08:47:24 Puller (folder "sharename" (exampleserver-sharename), item "foldername/filename"): syncing: finishing: opening temp file: open /homes/bob/foldername/.syncthing.filename.tmp: permission denied
2025-04-24 08:47:24 "sharename" (exampleserver-sharename): Failed to sync 1 items
2025-04-24 08:47:24 Folder "sharename" (exampleserver-sharename) isn't making sync progress - retrying in 1h4m0s.
2025-04-24 08:47:43 Puller (folder "sharename" (exampleserver-sharename), item "foldername/filename"): syncing: finishing: opening temp file: open /homes/bob/foldername/.syncthing.filename.tmp: permission denied
2025-04-24 08:47:43 "sharename" (exampleserver-sharename): Failed to sync 1 items
2025-04-24 08:47:43 Folder "sharename" (exampleserver-sharename) isn't making sync progress - retrying in 1h4m0s.

Alternatives or workarounds

Add something like this to a shell-script and call it from your crontab every hour, so that it is eventually called after the auto-update, too

#!/bin/bash
# where my syncthing is stored
FILE="/volume1/@appstore/syncthing/bin/syncthing"
CHECK_CAPS="cap_chown,cap_fowner+ep"
SET_CAPS="CAP_CHOWN,CAP_FOWNER=+ep"
# Check if the file has the required capabilities
if getcap "$FILE" | grep -iq "$CHECK_CAPS"; then
    echo "Capabilities are already set on $FILE"
else
    echo "Setting capabilities on $FILE..."
    setcap "$SET_CAPS" "$FILE"
    if getcap "$FILE" | grep -iq "$CHECK_CAPS"; then
        echo "Capabilities successfully set."
        # Restart Syncthing package
        echo "Restarting Syncthing..."
        sudo synopkg restart syncthing
        # Log the action in DSM 7 log
        logger -t syncthing "Capabilities $SET_CAPS set on $FILE and Syncthing restarted."
        echo "Logged the action."
    else
        echo "Failed to set capabilities on $FILE."
    fi
fi