Re: selinux and rsync backup to zfs dataset

On Sonntag, 7. Juni 2026 22:01:17 Mitteleuropäische Sommerzeit Andrei 
Borzenkov wrote:
> 07.06.2026 22:33, [email protected] wrote:
> >> You can skip security.selinux extended attribute with "--filter=-x
> >> security.selinux", but then all labels are lost.
> > 
> > That didn't help, I still get
> > 
> >>>>> rsync: [receiver] rsync_xal_set:
> >>>>> lremovexattr("<file>","security.selinux") failed: Permission
> >>>>> denied
> >>>>> (13)
> > 
> > unless I omit --xattrs!
> 
> leap16:/tmp/extfs.selinux # dd if=/dev/urandom of=test count=1
> 1+0 records in
> 1+0 records out
> 512 bytes copied, 0.000154908 s, 3.3 MB/s
> leap16:/tmp/extfs.selinux # cmp ./test ../extfs.mnt/test
> ./test ../extfs.mnt/test differ: byte 1, line 1
> leap16:/tmp/extfs.selinux # rsync -a --xattrs --verbose
> /tmp/extfs.mnt/test  ./
> sending incremental file list
> test
> rsync: [receiver] rsync_xal_set:
> lremovexattr("/tmp/extfs.selinux/.test.7T0w2R","security.selinux")
> failed: Permission denied (13)
> 
> sent 616 bytes  received 36 bytes  1,304.00 bytes/sec
> total size is 512  speedup is 0.79
> rsync error: some files/attrs were not transferred (see previous
> errors) (code 23) at main.c(1347) [sender=3.4.1]
> leap16:/tmp/extfs.selinux # rsync -a --xattrs --filter="-x
> security.selinux" --verbose /tmp/extfs.mnt/test  ./
> sending incremental file list
> 
> sent 56 bytes  received 12 bytes  136.00 bytes/sec
> total size is 512  speedup is 7.53
> leap16:/tmp/extfs.selinux # cmp ./test ../extfs.mnt/test
> leap16:/tmp/extfs.selinux #

BKUP_OPTIONS=(
  --archive --one-file-system
  --hard-links --acls --xattrs
  --numeric-ids
  --delete-excluded --delete-during
  --filter="-x security.selinux"
  --filter=${FILTERFILE}
  --exclude-from=${EXCLFILE}
  --verbose --stats --no-human-readable
)

/usr/bin/rsync "${BKUP_OPTIONS[@]}" "${FS}" "${BKUPTARGET}"

leads to

rsync: [receiver] rsync_xal_set: 
lremovexattr("<targetfile>","security.selinux") failed: Permission 
denied (13)

for the target files.

Not sure, why it works for you. Can it be a difference between local and 
remote?