diff --git a/daemon/tar.c b/daemon/tar.c
index 9d2dfd0c6..4437be961 100644
--- a/daemon/tar.c
+++ b/daemon/tar.c
@@ -129,7 +129,7 @@ write_cb (void *fd_ptr, const void *buf, size_t len)
 /* Has one FileIn parameter. */
 /* Takes optional arguments, consult optargs_bitmask. */
 int
-do_tar_in (const char *dir, const char *compress)
+do_tar_in (const char *dir, const char *compress, int xattrs, int selinux, int acls)
 {
   const char *filter;
   int err, r;
@@ -160,6 +160,15 @@ do_tar_in (const char *dir, const char *compress)
   } else
     filter = "";
 
+  if (!(optargs_bitmask & GUESTFS_TAR_IN_XATTRS_BITMASK))
+    xattrs = 0;
+
+  if (!(optargs_bitmask & GUESTFS_TAR_IN_SELINUX_BITMASK))
+    selinux = 0;
+
+  if (!(optargs_bitmask & GUESTFS_TAR_IN_ACLS_BITMASK))
+    acls = 0;
+
   fd = mkstemp (error_file);
   if (fd == -1) {
     err = errno;
@@ -172,10 +181,13 @@ do_tar_in (const char *dir, const char *compress)
   close (fd);
 
   /* "tar -C /sysroot%s -xf -" but we have to quote the dir. */
-  if (asprintf_nowarn (&cmd, "%s -C %R%s -xf - %s2> %s",
+  if (asprintf_nowarn (&cmd, "%s -C %R%s -xf - %s%s%s%s2> %s",
                        str_tar,
                        dir, filter,
                        chown_supported ? "" : "--no-same-owner ",
+                       xattrs ? "--xattrs " : "",
+                       selinux ? "--selinux " : "",
+                       acls ? "--acls " : "",
                        error_file) == -1) {
     err = errno;
     r = cancel_receive ();
@@ -240,7 +252,7 @@ int
 do_tgz_in (const char *dir)
 {
   optargs_bitmask = GUESTFS_TAR_IN_COMPRESS_BITMASK;
-  return do_tar_in (dir, "gzip");
+  return do_tar_in (dir, "gzip", 0, 0, 0);
 }
 
 /* Has one FileIn parameter. */
@@ -248,7 +260,7 @@ int
 do_txz_in (const char *dir)
 {
   optargs_bitmask = GUESTFS_TAR_IN_COMPRESS_BITMASK;
-  return do_tar_in (dir, "xz");
+  return do_tar_in (dir, "xz", 0, 0, 0);
 }
 
 /* Turn list 'excludes' into a temporary file, and return a string
diff --git a/generator/actions.ml b/generator/actions.ml
index d6a8d8c63..35af98147 100644
--- a/generator/actions.ml
+++ b/generator/actions.ml
@@ -4793,22 +4793,22 @@ To get the checksums for many files, use C<guestfs_checksums_out>." };
 
   { defaults with
     name = "tar_in"; added = (1, 0, 3);
-    style = RErr, [FileIn "tarfile"; Pathname "directory"], [OString "compress"];
+    style = RErr, [FileIn "tarfile"; Pathname "directory"], [OString "compress"; OBool "xattrs"; OBool "selinux"; OBool "acls"];
     proc_nr = Some 69;
     once_had_no_optargs = true;
     cancellable = true;
     tests = [
       InitScratchFS, Always, TestResultString (
         [["mkdir"; "/tar_in"];
-         ["tar_in"; "$srcdir/../data/helloworld.tar"; "/tar_in"; "NOARG"];
+         ["tar_in"; "$srcdir/../data/helloworld.tar"; "/tar_in"; "NOARG"; ""; ""; ""];
          ["cat"; "/tar_in/hello"]], "hello\n"), [];
       InitScratchFS, Always, TestResultString (
         [["mkdir"; "/tar_in_gz"];
-         ["tar_in"; "$srcdir/../data/helloworld.tar.gz"; "/tar_in_gz"; "gzip"];
+         ["tar_in"; "$srcdir/../data/helloworld.tar.gz"; "/tar_in_gz"; "gzip"; ""; ""; ""];
          ["cat"; "/tar_in_gz/hello"]], "hello\n"), [];
       InitScratchFS, IfAvailable "xz", TestResultString (
         [["mkdir"; "/tar_in_xz"];
-         ["tar_in"; "$srcdir/../data/helloworld.tar.xz"; "/tar_in_xz"; "xz"];
+         ["tar_in"; "$srcdir/../data/helloworld.tar.xz"; "/tar_in_xz"; "xz"; ""; ""; ""];
          ["cat"; "/tar_in_xz/hello"]], "hello\n"), []
     ];
     shortdesc = "unpack tarfile to directory";
@@ -4820,7 +4820,25 @@ then the input should be an uncompressed tar file.  Otherwise one
 of the following strings may be given to select the compression
 type of the input file: C<compress>, C<gzip>, C<bzip2>, C<xz>, C<lzop>.
 (Note that not all builds of libguestfs will support all of these
-compression types)." };
+compression types).
+
+The other optional arguments are:
+
+=over 4
+
+=item C<xattrs>
+
+If set to true, extended attributes are restored from the tar file.
+
+=item C<selinux>
+
+If set to true, SELinux contexts are restored from the tar file.
+
+=item C<acls>
+
+If set to true, POSIX ACLs are restored from the tar file.
+
+=back" };
 
   { defaults with
     name = "tar_out"; added = (1, 0, 3);