Output of restic version

restic 0.17.1
compiled with go1.22.5 on linux/amd64

What should restic do differently? Which functionality do you think we should add?

First off, restic is an amazing tool! Thanks for all your great work. We've been using restic in VolSync (https://github.com/backube/volsync) to perform backups in kubernetes environments.

This one is a bit complicated - Essentially we're running restic in a kubernetes pod and hit an issue with v0.17.1. I think this was always here, but the error would be ignored, but this fix means restoring xattrs as UID 0 will now fail the restore: #4958

The issue comes from the fact that we have some scenarios where we run as UID 0 so that we can restore UIDs and GIDs, but when extended attributes in the trusted. or system. namespace are restored, this will fail as we don't have the CAP_SYS_ADMIN capability. Additionally it seems that even with this capability, we may not be allowed to modify the security.selinux xattr on a file (in Openshift this is definitely an issue, perhaps it will happen on other kubernetes envs too). We don't hit this issue when not running as UID 0 as the error is ignored by restic.

Would it be possible to allow for excluding xattrs (perhaps with a pattern, or perhaps exclude specific xattr namespaces) at restore time? If it makes sense for consistency we could also do this at backup - but my main concern atm is restore.

Please let me know if you'd be open for such a change - I'd be happy to contribute a PR.

What are you trying to do? What problem would this solve?

Did restic help you today? Did it make you happy in any way?