failed LXC restore: ACL invalid

[dav77devel]

Hi,
pardon if is thread contains little information: I'm not a Proxmox PBS expert and I recreated the LXC from scratch since I was in a hurry. In any case, I still have the backup and can do some more tests if needed (pinging @fabian who I've seen involved in other similar threads).

I break an LXC container (my fault) and I wanted to restore from a sane backup from a virtualized PBS instance.

On the GUI, I got this error:

recovering backed-up configuration from 'pbs-server-ct-vm:backup/ct/121/2024-10-19T22:40:31Z'
Using encryption key from file descriptor..
Fingerprint: ce:20:da:46:f4:a8:1e:62
restoring 'pbs-server-ct-vm:backup/ct/121/2024-10-19T22:40:31Z' now..
Using encryption key from file descriptor..
Fingerprint: ce:20:da:46:f4:a8:1e:62
Error: error extracting archive - encountered unexpected error during extraction: error at entry "user-1000@000618cb0443265d-e8525b752163d9aa.journal~": failed to extract file: failed to apply acls: Error while restoring ACL - ACL invalid
TASK ERROR: unable to restore CT 103 - command 'lxc-usernsexec -m u:0:100000:1000 -m g:0:100000:1000 -m u:1000:1002:1 -m g:1000:1002:1 -m u:1001:101001:64535 -m g:1001:101001:64535 -- /usr/bin/proxmox-backup-client restore '--crypt-mode=encrypt' '--keyfd=13' ct/121/2024-10-19T22:40:31Z root.pxar /var/lib/lxc/103/rootfs --allow-existing-dirs --repository root@pam@pbs.lan:ct-vm-backup' failed: exit code 255

The configuration of the LXC:

arch: amd64
cores: 1
features: keyctl=1,nesting=1
hostname: restic
memory: 512
net0: name=eth0,bridge=br_service,gw=10.42.30.1,hwaddr=BC:24:11:27:11:7E,ip=10.42.30.60/24,type=veth
onboot: 1
ostype: ubuntu
protection: 1
rootfs: local-zfs:subvol-121-disk-0,size=8G
swap: 512
tags: proxmox-helper-scripts
unprivileged: 1
lxc.mount.entry: /storage/backups/restic mnt/restic none bind 0 0
lxc.idmap: u 0 100000 1000
lxc.idmap: g 0 100000 1000
lxc.idmap: u 1000 1002 1
lxc.idmap: g 1000 1002 1
lxc.idmap: u 1001 101001 64535
lxc.idmap: g 1001 101001 64535

Inside the backup, I have indeed that file, but I don't see anything too strange with it (group 999 exists inside the container, as systemd-journal):

> stat user-1000@000618cb0443265d-e8525b752163d9aa.journal~
  File: /var/log/journal/7a005eb26fdd4254874335a88ceb5915/user-1000@000618cb0443265d-e8525b752163d9aa.journal~
  Size: 8388608       Type: file
Access: (640/-rw-r-----++)  Uid: 0     Gid: 999 
Modify: 2024-05-19 11:00:22

My PBS is version 3.2-7 and Proxmox is version 8.2.7.

Is this due to something I did wrong, or may be a bug?

Thanks!

 

[dav77devel]

I found another LXC with a similar issue, again on a journald log file.

On the running container, I run

journalctl --vacuum-time=2d

(the file, way older, was removed) and then did a new backup.

I then restored this new backup, and it worked fine.

It's still not clear to me how the file got "corrupted" or with some strange ACL.

 

[fabian]

might be another instance of this: https://lore.proxmox.com/pbs-devel/20241008083355.181031-2-f.gruenbichler@proxmox.com/ (fix not yet applied)

 

[dav77devel]

Thanks @fabian , this seems the case!

I'll preserve one old backup and will try again on the next update.

Thanks!