@sgallagh and I briefly discussed how to provide "a properly-integrated and easy to configure backup solution".
Summary of btrfs send/receive function:
btrfs send
btrfs send -p
btrfs receive
Btrfs send/receive is going to get an overhaul to support btrfs/fscrypt work that's in progress (native encryption using the kernel's fs/crypto API). Possible changes:
Various questions:
Project references:
man btrfs subvolume man btrfs send man btrfs receive
man btrfs subvolume
man btrfs send
man btrfs receive
btrbk - backup tool for btrfs subvolumes
bees - deduplication agent
Metadata Update from @chrismurphy: - Issue set to the milestone: Future Release - Issue tagged with: Desktop, Server, Utils
A liability/limitation for this idea is SELinux will prevent btrfs receive from restoring security labels it doesn't recognize.
Example: Fedora 36 has a new security label system_u:object_r:NetworkManager_dispatcher_script_t:s0 which Fedora 35 is not aware of. If a Fedora 35 Server is the destination for backups from a Fedora 36 desktop, it fails by default. While we have a way to suppress the error so receive succeeds, the received subvolume snapshot does not have the "Received UUID" set, which is a piece of metadata needed for incremental send/receive. Thus, while we have the data received, it cannot then be used as a source(or parent) in a subsequent incremental receive, thus breaking incremental receive - which is the feature of send/receive. The incremental computation on btrfs is cheap, no deep traversal is needed on either source or destination.
system_u:object_r:NetworkManager_dispatcher_script_t:s0
Relaxing the rule requiring full replication of all data and metadata before Received UUID can be set is a slippery slope. It'd take some evaluation to make sure we don't cause other problem, by allowing this metadata to be dropped while still setting the Received UUID.
Perhaps it's possible to backport these labels to earlier versions of Fedora?
Still another thought is these new security labels tend to only crop up for /usr /etc/ /var not /home. So if the feature were constrained to backing up just user /home, then that might be a suitable work around? Is there a use case for users creating and setting arbitrary security labels?
See also: send|receive ERROR: lsetxattr failed, SELINUX_ERR op=setxattr invalid_context
Login to comment on this ticket.