Rsync -X doesn't sync SELinux context

rsync -aX --info=progress2 ~/Documents/ user@my.domain.url:/mnt/usb1/Backup/Documents/ --stats
$ stat /mnt/usb1/Backup/Documents
Context: unconfined_u:object_r:unlabeled_t:s0
$ stat ~/Documents
Context: unconfined_u:object_r:user_home_t:s0

Why is the context not synced? The owner of the files on both ends has the same name and Uid, and I can chcon those files just fine.

p.s. Though on 2nd thought I probably don’t want to label those files user_home_t

I don’t know. However, the SELinux context can be overridden by mount options. Since you appear to be mounting an external drive, you might be able to take advantage of that to get the SELinux context that you want.

Just as an example, here is the line I use in my fstab to mount my /boot@{a,b} partitions. It sets the SELinux context for all the files under those directories to system_u:object_r:boot_t:s0.

$ cat /etc/fstab 
PARTLABEL=boot@a /boot@a vfat umask=0077,shortname=lower,context=system_u:object_r:boot_t:s0,x-systemd.before=bootbind.service,nofail 0 0
PARTLABEL=boot@b /boot@b vfat umask=0077,shortname=lower,context=system_u:object_r:boot_t:s0,x-systemd.before=bootbind.service,nofail 0 0
$ sudo ls -Z /boot@a | column -t
system_u:object_r:boot_t:s0  788e20240aaf43f46f617cde4b703bdg
system_u:object_r:boot_t:s0  efi
system_u:object_r:boot_t:s0  extlinux
system_u:object_r:boot_t:s0  loader
system_u:object_r:boot_t:s0  syslinux
system_u:object_r:boot_t:s0  syslinux.cfg

P.S. You might want to be careful with editing /etc/fstab because it can cause your system to hang or fail to boot if something isn’t available at boot time. For a drive that isn’t always connected, you probably want to add noauto so it doesn’t try to automount at boot. There is also a user option to allow your normal user to mount the drive with mount <path-to-mountpoint> without having to use sudo. (See man fstab for more details.)

1 Like

It seems that root account is required[1], even though I own the file and can chcon without sudo.


  1. https://bugzilla.redhat.com/show_bug.cgi?id=458014#c17 ↩︎