Re: selinux and rsync backup to zfs dataset

On Montag, 8. Juni 2026 19:42:27 Mitteleuropäische Sommerzeit Andrei 
Borzenkov wrote:
> 08.06.2026 16:14, [email protected] wrote:
> > On Sonntag, 7. Juni 2026 22:01:17 Mitteleuropäische Sommerzeit
> > Andrei
> > 
> > Borzenkov wrote:
> >> 07.06.2026 22:33, [email protected] wrote:
> >>>> You can skip security.selinux extended attribute with
> >>>> "--filter=-x
> >>>> security.selinux", but then all labels are lost.
> >>> 
> >>> That didn't help, I still get
> >>> 
> >>>>>>> rsync: [receiver] rsync_xal_set:
> >>>>>>> lremovexattr("<file>","security.selinux") failed: Permission
> >>>>>>> denied
> >>>>>>> (13)
> >>> 
> >>> unless I omit --xattrs!
> >> 
> >> leap16:/tmp/extfs.selinux # dd if=/dev/urandom of=test count=1
> >> 1+0 records in
> >> 1+0 records out
> >> 512 bytes copied, 0.000154908 s, 3.3 MB/s
> >> leap16:/tmp/extfs.selinux # cmp ./test ../extfs.mnt/test
> >> ./test ../extfs.mnt/test differ: byte 1, line 1
> >> leap16:/tmp/extfs.selinux # rsync -a --xattrs --verbose
> >> /tmp/extfs.mnt/test  ./
> >> sending incremental file list
> >> test
> >> rsync: [receiver] rsync_xal_set:
> >> lremovexattr("/tmp/extfs.selinux/.test.7T0w2R","security.selinux")
> >> failed: Permission denied (13)
> >> 
> >> sent 616 bytes  received 36 bytes  1,304.00 bytes/sec
> >> total size is 512  speedup is 0.79
> >> rsync error: some files/attrs were not transferred (see previous
> >> errors) (code 23) at main.c(1347) [sender=3.4.1]
> >> leap16:/tmp/extfs.selinux # rsync -a --xattrs --filter="-x
> >> security.selinux" --verbose /tmp/extfs.mnt/test  ./
> >> sending incremental file list
> >> 
> >> sent 56 bytes  received 12 bytes  136.00 bytes/sec
> >> total size is 512  speedup is 7.53
> >> leap16:/tmp/extfs.selinux # cmp ./test ../extfs.mnt/test
> >> leap16:/tmp/extfs.selinux #
> 
> I noticed that the test was wrong, the second time it did not transfer
> any file at all. I repeated it and it still worked :)
> 
> > BKUP_OPTIONS=(
> > 
> >    --archive --one-file-system
> >    --hard-links --acls --xattrs
> >    --numeric-ids
> >    --delete-excluded --delete-during
> >    --filter="-x security.selinux"
> >    --filter=${FILTERFILE}
> >    --exclude-from=${EXCLFILE}
> >    --verbose --stats --no-human-readable
> > 
> > )
> > 
> > /usr/bin/rsync "${BKUP_OPTIONS[@]}" "${FS}" "${BKUPTARGET}"
> > 
> > leads to
> > 
> > rsync: [receiver] rsync_xal_set:
> > lremovexattr("<targetfile>","security.selinux") failed: Permission
> > denied (13)
> > 
> > for the target files.
> > 
> > Not sure, why it works for you. Can it be a difference between local
> > and remote?
> 
> Remote seems to work too.
> 
> leap16:/tmp/extfs.selinux # dd if=/dev/urandom of=test count=1
> 1+0 records in
> 1+0 records out
> 512 bytes copied, 0.000303926 s, 1.7 MB/s
> leap16:/tmp/extfs.selinux # rsync -a --xattrs --filter="-x
> security.selinux" --verbose /tmp/extfs.mnt/test  ./
> sending incremental file list
> test
> 
> sent 615 bytes  received 35 bytes  1,300.00 bytes/sec
> total size is 512  speedup is 0.79
> leap16:/tmp/extfs.selinux # dd if=/dev/urandom of=test count=1
> 1+0 records in
> 1+0 records out
> 512 bytes copied, 0.00073311 s, 698 kB/s
> leap16:/tmp/extfs.selinux # rsync -a --xattrs --filter="-x
> security.selinux" --verbose localhost:/tmp/extfs.mnt/test  ./
> (root@localhost) Password:
> receiving incremental file list
> test
> 
> sent 72 bytes  received 615 bytes  152.67 bytes/sec
> total size is 512  speedup is 0.75
> leap16:/tmp/extfs.selinux #
> 
> Try increasing verbosity. Also, you have a lot of other options, maybe
> some of them have this side effect. Start with a simple case and
> build up.

/usr/bin/rsync --archive --one-file-system --acls --xattrs --filter=-x 
security.selinux --verbose --verbose --stats --no-human-readable /boot/ 
backup:/var/backup/machines/client/boot/

opening connection using: ssh backup rsync --server 
-vvlogDtpAXrxe.iLsfxCIvu --stats . /var/backup/machines/client/boot/  (8 
args)
sending incremental file list
lots of:
[sender] hiding xattr security.selinux because of pattern 
security.selinux

rsync: [receiver] rsync_xal_set: lremovexattr("/var/backup/machines/
client/boot/.","security.selinux") failed: Permission denied (13)
rsync: [receiver] rsync_xal_set: lremovexattr("/var/backup/machines/
client/boot/.vmlinuz-6.19.12-1-default.hmac","security.selinux") failed: 
Permission denied (13)
rsync: [receiver] rsync_xal_set: lremovexattr("/var/backup/machines/
client/boot/.vmlinuz-7.0.1-1-default.hmac","security.selinux") failed: 
Permission denied (13)