ACL (access control list)

A per-file list of extra rights that sits outside the usual nine characters: a named group allowed to write into a directory it does not own, one account allowed to read one particular file. So the nine characters do not describe the whole access rule, and ls -l admits it with a single sign — the + in drwxrws---+. The rest is read with getfacl. The bill arrives at restore time: rsync -a copies neither ACLs nor extended attributes, and plain tar drops them too. The tree comes back with permissions that look identical and real access that is not; the refusal that follows cannot be explained from ls -l, and it costs an hour if you do not know the question exists. Ask for them on both sides — rsync -aAX, tar --acls --xattrs — and keep a getfacl -R /var/www beside the archive.