Restore files and ownership - the practical details

Restoring individual files is the most common restore operation. This lesson covers preserving ownership, ACLs, and special files - the practical details that determine whether a restore works.

Restore with rsync

rsync preserves ownership and permissions:

# Restore a single file - dry-run first, and keep a copy of what you replace
rsync -aAXH --numeric-ids --dry-run --itemize-changes \
      backup@backup-host:/backup/etc/nginx/ /etc/nginx/
sudo cp -a /etc/nginx /root/nginx-pre-restore-$(date +%F-%H%M)
sudo rsync -aAXH --numeric-ids backup@backup-host:/backup/etc/nginx/ /etc/nginx/

# Verify it parses before reloading anything
sudo nginx -t

The -a flag (archive) is exactly -rlptgoD:

• -r: recursive.
• -l: symlinks.
• -p: permissions.
• -t: times.
• -g: group.
• -o: owner (root only).
• -D: devices.

That list is the whole of -a. It does not include -A (ACLs), -X (extended attributes, which is what carries the SELinux context), -H (hardlinks), -S (sparse files) or -U (access times). For a restore, use:

rsync -aAXH --numeric-ids /backup/etc/ /etc/

--numeric-ids matters too: without it rsync maps user and group by name through the destination host’s /etc/passwd. Restoring onto a rebuilt host whose UIDs differ silently rewrites ownership.

Restore with tar

# List before extracting - confirm the member paths are what you expect
tar -tzf /backup/etc-2026-08-09.tar.gz etc/nginx/ | head

# Extract into a staging directory, NOT over / , so you can inspect first
mkdir -p /root/restore-staging
tar --acls --xattrs --selinux -xzf /backup/etc-2026-08-09.tar.gz \
    -C /root/restore-staging etc/nginx/
diff -r /root/restore-staging/etc/nginx /etc/nginx

# Extract a directory in place, once you have read the diff
sudo tar --acls --xattrs --selinux --numeric-owner \
     -xzf /backup/etc-2026-08-09.tar.gz -C / etc/nginx/

# Verify
ls -l /etc/passwd

tar extracts with the original owner (if running as root) or the current user (otherwise).

Preserve ACLs

For files with ACLs, use rsync or tar with the right flags:

# -a does NOT include ACLs or xattrs - add them explicitly.
# -A: POSIX ACLs. -X: xattrs (SELinux context lives here).
# -H: hardlinks. --numeric-ids: do not remap by name.
rsync -aAXH --numeric-ids /backup/etc/ /etc/

# tar needs the same treatment
tar --acls --xattrs --selinux -xzf /backup/etc-2026-08-09.tar.gz -C /

Verify ACLs and contexts:

getfacl /etc/passwd
getfattr -d -m - /etc/passwd
ls -Z /etc/passwd            # SELinux label, on RHEL-family hosts

Handle special files

• Symlinks: rsync -a preserves; tar preserves by default.
• Device files: rsync -D; tar --same-permissions.
• FIFOs and sockets: rsync preserves; tar may not.

For complex filesystems (e.g. /var/lib/docker with overlay filesystems), use the application’s own restore tool (docker restore or similar).

Verify the restore

Always verify:

# File exists
ls -l /etc/passwd

# Permissions match
stat -c '%a %U:%G' /etc/passwd

# Content matches (compare with known-good)
diff /etc/passwd /backup/etc/passwd.original

# Service starts
sudo systemctl restart sshd

A restore that “worked” but produces a file with wrong permissions or ownership can cause subtle failures.

Common pitfalls

• Wrong owner: restored as root when it should be www-data.
• Wrong mode: restored with 644 when it should be 600.
• Missing directory: parent directory does not exist.
• Wrong path: restored to a different location.
• Symbolic link broken: target missing.
• Special files: device file restored as a regular file.

Knowledge check