repo ownership/permissions

[biot]

When backing up a set of files that have different ownership/permissions, you naturally run borg as root. No problem with that, except the repo files are all created with 0600 permissions (and 0700 for /data). This makes it impossible to copy the repo as any other use but root.

The problem is this repo cannot be rsync'ed either: rsync sensibly) does not run as root. capabilities(7) won't help either: you'd have to apply them to either the Python interpreter for borg, or to the rsync binary -- compromising system security even more.

Am I missing something here? I don't see any options to force file/group ownership or permissions when running as root, and that's what is needed here.

To summarize: AFAICS there is no way to do a remote copy of a repo that backs up files with restricted permissions.

[ThomasWaldmann]

i use rsync as root often, works for me.

also, guess you can use umask 0022 before running borg.

[jdchristensen]

Or just run chown -R ... and/or chmod -R ... after running borg.

[biot]

Note those are both workarounds for functionality borg doesn't have... doing a full system backup and keeping a copy offsite requires a workaround.

Doesn't that make the case that borg could really use a repo ownership feature?

[ThomasWaldmann]

You should always use the same user when accessing a borg repo. Then you have zero permission issues.

For non-ssh repos and running borg as root, but not having the repo owned by root, you can use the ssh://user@localhost/myrepo trick.

rsyncing a repo works the same way, just use the same user always.

or even better, don't rsync, but make 2 independent backups to different repos.

[farshidtz]

I did it by passing --umask 0022 to borg create which results into 755 directory permissions and 644 file permissions.

See https://borgbackup.readthedocs.io/en/stable/usage/notes.html?highlight=umask
I don't know why the umask flag is not documented in https://borgbackup.readthedocs.io/en/stable/usage/create.html

From borg create --help:

  --umask M             set umask to M (local and remote, default: 0077)

To know more about umask modes, see this.

[ThomasWaldmann]

Global options are only documented once, not for every command.