shutil.copytree(src, dst, symlink=True) destroys file system permissions and open security issues. See the following python/bash session:

# ls -l /etc/shadow
 -rw-r----- 1 root shadow 1114 May  8 19:10 /etc/shadow
# su foobar
$ ln -s /etc/shadow && exit
# python -c '__import__("shutil").copytree('/home/', '/backups/home', symlinks=True)
# ls -l /etc/shadow
-rw-r----- 1 foobar Domain Users 1114 Mai  8 19:10 /etc/shadow

As you can see the file "/etc/shadow" is now owned by the user "foobar" and its primary group.

my workaround is:
import os.path
def ignore(src, names):
   return [name for name in names if os.path.islink(os.path.join(src, name))]
shutil.copytree(src, dst, ignore=ignore)

I don't understand your workaround (how is that different from just using the default value of symlinks?)

It sounds like what you are reporting is that copystat is incorrectly setting permissions on a file a symlink points to instead of on the symlink itself (in whatever sense the latter is even meaningful)?

argh. sorry. I did not read the following lines in my environment which caused this by a recursive chown.