Restore files and permissions

Application files are more than byte contents. Incorrect metadata can expose secrets or prevent a service from starting.

A restored private key with mode 644 instead of 600 is readable by every user on the machine — and OpenSSH will refuse to use it. An upload directory restored as root:root means the web application can no longer write to it. Both failures happen with byte-perfect file contents.

What metadata a restore must carry

• Ownership: user and group of every file.
• Modes: the permission bits, including setuid and setgid where present.
• Symbolic links: restored as links, not as copies of their targets.
• Hard links: preserved, or the restored tree silently doubles in size.
• Extended attributes and ACLs: some workloads depend on them.
• Directory structure: empty directories a service expects at startup.

Choose backup and copy tools that preserve the metadata your workload needs. For rsync, that’s this flag set:

sudo rsync -aHAX /mnt/backups/etc-nginx/ /srv/staging/etc-nginx/

-a keeps owners, groups, modes, timestamps, and symlinks. -H preserves hard links, -A ACLs, -X extended attributes. Run it as root: an unprivileged user cannot recreate other users’ ownership, so the same command without sudo silently restores everything as you.

Restore to staging, then inspect

Restore to a staging path first. Inspect owners, modes, symbolic links, and any ACLs before cutover:

ls -l /srv/staging/etc-nginx/ssl/
# -rw------- 1 root root 1704 Jul 12 03:00 flaviocopes.com.key
# -rw-r--r-- 1 root root 5834 Jul 12 03:00 flaviocopes.com.crt

The key is 600, the certificate is 644, both owned by root. That’s what I expect. Then compare the staged tree against the source mechanically:

sudo rsync -aHAXn --itemize-changes /mnt/backups/etc-nginx/ /srv/staging/etc-nginx/

The -n makes it a dry run, and --itemize-changes prints one line per difference — content, permissions, owner, or timestamps. No output means the trees match, metadata included. A line like .f....og.. flags a file whose owner or group differs: exactly the class of problem that only surfaces when the service tries to start.

Pick one configuration tree and one data tree. List the metadata each requires, restore both to staging, and compare them with the source.