Tightening Access Rights for OpenClaw on a Synology NAS

Simplicity of POSIX vs. power of ACL

The starting point

When I started running OpenClaw on my Synology NAS (see my previous article), I knew I had an issue with access rights as it was failing with EACCES errors. The quick, pragmatic fix was to strip ACL support from the relevant directories entirely and fall back to plain POSIX permissions — in the most permissive case, 777.

That got things working, but it left two problems in place: every local account on the NAS could read and write files that were meant to be scoped to one service and one person, and the underlying cause of the original failure was never actually diagnosed.

Now is time to design a more robust permissions setup.

What permissions do I need?

My goal is to run an Obsidian-backed second brain, and I decided to store the Obsidian vault on the user volume, separately from the OpenClaw’s folder, because the vault and the OpenClaw configuration do not require the same access profile:

• The Obsidian vault /volume1/homes/<user>/obsidian needs RW access for both the container running OpenClaw and the user who will connect to it via the Obsidian app or otherwise.
• On the other hand…