ACLs are copied by UID rather than by Name

Chris Davies via rsync <[email protected]> Fri, 16 Jan 2026 14:49:13 +0000
Newsgroups	gmane.network.rsync.general
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--===============0463107604123358991==
Content-Type: multipart/alternative;
 boundary="------------xima9x7qFg7wYvowYiErIC23"
Content-Language: en-GB

This is a multi-part message in MIME format.
--------------xima9x7qFg7wYvowYiErIC23
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Two Linux-based systems running rsync 3.2.7. Running as a normal user, 
ACL attributes are copied by UID rather than by Name. In the case where 
UIDs do not match between the two systems this can lead to an incorrect 
copy. Running with root permissions on both sides does create a correct 
copy.

Using a normal unprivileged user account the ACLs can be recreated 
correctly, so I would suggest this is an oversight or bug in rsync.

Example. Two user accounts, "alice", running the rsync process, and 
"charlie". On the source system, alice is UID 1000 and charlie is UID 
1003. On the destination system alice is UID 1001 and charlie is UID 1000.

Destination system:

mkdir /tmp/803751
cd /tmp/803751

Source system:

mkdir /tmp/803751
cd /tmp/803751

mkdir dir
setfacl -m u:alice:rwx dir
setfacl -m u:charlie:rx dir

getfacl dir
# file: dir
# owner: alice
# group: alice
user::rwx
user:charlie:r-x
user:alice:rwx
group::r-x
mask::rwx
other::r-x

rsync -aAv ./ destinationSystem:/tmp/803751

After copying the directory, the ACLs on the destination system are as 
follows

Destination system:

getfacl dir
# file: dir
# owner: alice
# group: alice
user::rwx
user:charlie:rwx
user:1003:r-x
group::r-x
mask::rwx
other::r-x

The ACL belonging to alice has been applied to charlie, and charlie's 
ACL has been applied to a user 1003 that does not exist on the 
destination system.

Chris
--------------xima9x7qFg7wYvowYiErIC23
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    Two Linux-based systems running rsync 3.2.7. Running as a normal
    user, ACL attributes are copied by UID rather than by Name. In the
    case where UIDs do not match between the two systems this can lead
    to an incorrect copy. Running with root permissions on both sides
    does create a correct copy.<br>
    <br>
    Using a normal unprivileged user account the ACLs can be recreated
    correctly, so I would suggest this is an oversight or bug in rsync.<br>
    <br>
    Example. Two user accounts, "alice", running the rsync process, and
    "charlie". On the source system, alice is UID 1000 and charlie is
    UID 1003. On the destination system alice is UID 1001 and charlie is
    UID 1000.<br>
    <br>
    Destination system:<br>
    <br>
    mkdir /tmp/803751<br>
    cd /tmp/803751<br>
    <br>
    Source system:<br>
    <br>
    mkdir /tmp/803751<br>
    cd /tmp/803751<br>
    <br>
    mkdir dir<br>
    setfacl -m u:alice:rwx dir<br>
    setfacl -m u:charlie:rx dir<br>
    <br>
    getfacl dir<br>
    # file: dir<br>
    # owner: alice<br>
    # group: alice<br>
    user::rwx<br>
    user:charlie:r-x<br>
    user:alice:rwx<br>
    group::r-x<br>
    mask::rwx<br>
    other::r-x<br>
    <br>
    rsync -aAv ./ destinationSystem:/tmp/803751<br>
    <br>
    After copying the directory, the ACLs on the destination system are
    as follows<br>
    <br>
    Destination system:<br>
    <br>
    getfacl dir<br>
    # file: dir<br>
    # owner: alice<br>
    # group: alice<br>
    user::rwx<br>
    user:charlie:rwx<br>
    user:1003:r-x<br>
    group::r-x<br>
    mask::rwx<br>
    other::r-x<br>
    <br>
    The ACL belonging to alice has been applied to charlie, and
    charlie's ACL has been applied to a user 1003 that does not exist on
    the destination system.<br>
    <br>
    Chris
  </body>
</html>

--------------xima9x7qFg7wYvowYiErIC23--


--===============0463107604123358991==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
Please use reply-all for most replies to avoid omitting the mailing list.
To unsubscribe or change options: https://lists.samba.org/mailman/listinfo/rsync
Before posting, read: http://www.catb.org/~esr/faqs/smart-questions.html

--===============0463107604123358991==--