Rsync ACL
To preserve extended permissions during transfers, you must enable rsync acl support on both servers. The tool reads access control lists on the source and writes them to the target. Engineering teams use this feature to move shared folders between Linux hosts. Without it, fine-grained read and write rules drop off during the copy. Teams often run these transfers with broad root permissions to avoid write errors. That approach copies the right file rules, but gives the transfer user total host c
ACL: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To preserve extended permissions during transfers, you must enable rsync acl support on both servers. The tool reads access control lists on the source and writes them to the target. Engineering teams use this feature to move shared folders between Linux hosts. Without it, fine-grained read and write rules drop off during the copy. Teams often run these transfers with broad root permissions to avoid write errors. That approach copies the right file rules, but gives the transfer user total host control.
How rsync acl transfers extended file permissions
Standard Linux permissions only assign rules to one owner, one group, and everyone else. Access control lists go further by granting specific rights to many individual users and groups. When you run an rsync acl transfer, the sending process inspects every file header. It reads both the standard permission bits and the extended access entries. The sender packs these rules into the file list metadata before sending any file data.
The receiving server reads this metadata stream and checks its own local file system. Both the source and target file systems must support extended access lists at the kernel level. If the target disk lacks support, the receiving process drops the extra rules and logs errors. The tool also maps user names and group names between the two machines. If a user name exists on both hosts, the receiver translates the ID numbers. If a name is missing on the target, the tool falls back to raw numeric IDs. That fallback can grant file access to the wrong local account if IDs do not match.
Why user mapping and root rights matter
To write arbitrary ownership and access rules, the receiving process needs high privileges. A standard user account cannot assign file rights or ownership to other users on Linux. Because of this operating system limit, teams often run the sync over a root login. Some teams use daemon mode with root rights enabled on the target host instead.
Both setups create a hard operational tradeoff for security and platform engineers. You need high privileges to preserve exact folder rules across your fleet. Yet handing out root SSH keys or wide daemon rights exposes the entire host. If an engineer or script logs in as root, they can alter system files too. They can read private keys, change system settings, or wipe folders outside the backup path.
ACL: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native file sync leaves open
Native file sync tools solve the problem of keeping folder permissions identical across machines. They check that the disk state on machine B matches the disk state on machine A. They also handle network drops by sending only the changed blocks of each file. For pure data replication, the built-in permission handling works well once disks are set up.
Still, host-level login settings only decide who can start a session on the server. They do not inspect or limit the specific commands run inside that session. Once a user or script holds a valid SSH key, the server trusts the entire session. Native file rules also do not inspect the actual contents of the files moving across. If a database dump contains raw emails, phone numbers, or card numbers, the sync copies them. Teams have no built-in way to require peer approval before someone runs a sensitive transfer. They also lack a central audit log showing which human triggered a specific file sync command.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Why do my extended file permissions disappear after a transfer?
Extended permissions drop when you run a standard archive sync alone. You must explicitly enable access list preservation and ensure the target disk mounts with ACL support.
How does the tool handle user IDs that do not match across servers?
By default, the tool matches user names and group names between the source and target hosts. If a name does not exist on the target, it writes the raw numeric ID instead.
Do I need root permissions on the target server to preserve access lists?
Standard users can set access rules on files they own. Still, preserving ownership and rules for other users requires root or elevated capabilities on the destination.