ACLs are easy. Even tar(1) knows them.
It's things like these that give you headache:
$ /sbin/getcap /bin/ping
/bin/ping = cap_net_raw+ep
# lsattr /etc/resolv.conf
----i---------e---- /etc/resolv.conf
# getfattr -d /var/log/messages
# file: var/log/messages
user.name="main system log"
# ls -alZ .bashrc
-rw-r--r--. root root system_u:object_r:admin_home_t:s0 .bashrc
If you have any of these in your source system, but don't have in target
one - your backup is invalid, consider changing tool you're using.
Note that these are just the examples, there can be other files like
this.