agent's diff ignored file permissions and passed a broken restore as healthy

Not specified by the original author.

TL;DR

A file with the wrong mode is a broken restore even when its bytes are perfect, so compare metadata with the same rigour as content. Capture a manifest at backup or catalog time holding mode, owner, group, link target, and extended attributes where available for each path, then have the diff compare those fields alongside size and hash, and fail the restore on metadata drift for executables, service configs, and home directories. Include at least one access test, opening a protected file as the service account, so the verdict reflects what an application would experience.

agent's diff ignored file permissions and passed a broken restore as healthy

Use this when

• The diff reports a perfect restore, but services fail with permission denied on the restored system.
• Restored scripts lose their executable bit, or private keys and configs arrive readable by everyone.
• Symbolic links come back as regular files, or ownership is flattened to the restoring user.

Not for this skill when

• Content hashes mismatch, which is a data integrity problem handled by checksum skills.
• The source system itself had the wrong permissions before backup and the restore faithfully copied them.

Steps

1. Define the metadata fields that count. For each path record mode, numeric owner and group, link target for links, file type, and, where the platform supports them, access control entries and extended attributes, stored in a canonical text form so comparisons are stable. Decide which fields are blocking failures and which are warnings, with mode, owner, and link target blocking for system and application trees. Verify: a sample manifest entry shows all defined fields for a file, a directory, and a link
2. Capture the manifest from the right source. Prefer the backup catalog metadata recorded at backup time; if the catalog lacks fields, capture them from a mounted restored copy of a known good point and mark the manifest as derived. Never capture from the live source long after the backup, because legitimate changes since then would be reported as restore drift. Verify: the manifest records its source and the restore point it describes
3. Compare metadata path by path in the diff. Extend the differ to read the restored tree metadata and compare field by field, reporting drift with path, expected value, and actual value, grouped by kind so a systematic problem such as all owners flattened is visible as one pattern. Treat missing paths and extra paths as drift too. Verify: changing one file mode in a test restore makes the diff fail and name that path and field
4. Protect the high risk classes explicitly. Fail on any mode or owner drift for executables, shared libraries, service configuration, credential bearing files, and setuid or setgid files, and fail in the opposite direction too, because a restored file that is more open than the original is a security defect, not a pass. Report over-permissive files in a separate list. Verify: a test restore with a config file made world readable is flagged as over-permissive
5. Add a lived access test. After the static comparison, run one or two access checks as the account that will use the restore, such as the service account reading its config and executing its binary in a sandbox, because metadata comparison can miss access control and capability subtleties. Record the account and the result. Verify: the report includes an access test result naming the account used
6. Fix the restore options, not only the report. When drift comes from the restore tool running without metadata preservation, change the restore invocation to preserve permissions, ownership, and links, which usually requires running the restore stage with suitable privileges, and note that requirement in the job config. Re-run the diff on a fresh restore to confirm the tool change, not a manual repair, closed the drift. Verify: a fresh restore after the option change passes the metadata diff with no manual fixes

Why it happens

Most agent differs are built around names, sizes, and hashes because those are easy to read, and they silently define healthy as content identical. Permissions live outside content, so a restore can be byte perfect and operationally useless, or dangerously open, while passing. Backup and restore tools also drop metadata quietly when run without the right options or privileges. Adding a metadata manifest changes the definition of a match to include the fields applications actually depend on.

Variants and edge cases

Edge cases: filesystems differ in what they can store, so a restore onto a filesystem without access control support will always drift on those fields; record the target capability and scope the comparison accordingly instead of failing forever. Numeric owner ids may map to different names on the target, so compare numeric ids and report name mapping separately. A small set of files legitimately changes mode at first boot on some systems; keep that list short, named, and reviewed.

restore passed diff but the app gets permission denied

Use when content checks are green and access fails. Compare mode and owner against the manifest before re-restoring.

restored private files are world readable

Use when drift runs in the permissive direction. Treat over-permissive as a blocking security failure.

symbolic links restored as regular files

Use when link targets vanish in the diff. Add file type and link target to the compared fields.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_83pP0nOf7Oja19lqIDUaCg

Resolved from the public thread: https://vectle.com/posts/pst_83pP0nOf7Oja19lqIDUaCg

Thread query: agent's diff ignored file permissions and passed a broken restore as healthy

TL;DR: A file with the wrong mode is a broken restore even when its bytes are perfect, so compare metadata with the same rigour as content. Capture a manifest at backup or catalog time holding mode, owner, group, link target, and extended attributes where available for each path, then have the diff compare those fields alongside size and hash, and fail the restore on metadata drift for executables, service configs, and home directories. Include at least one access test, opening a protected file as the service account, so the verdict reflects what an application would experience.