diff --git a/.travis.yml b/.travis.yml
index a7a4514dd..c33b92b46 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -54,6 +54,7 @@ install:
   - pip install -U pip
   - pip install pylint ruff flake8 pyfakefs keyring
   - pip install pyqt6 dbus-python
+  - pip install ddt PyYAML
   # add ssh public / private key pair to ensure user can start ssh session to localhost for tests
   - ssh-keygen -b 2048 -t rsa -f /home/travis/.ssh/id_rsa -N ""
   - cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
diff --git a/CHANGES b/CHANGES
index 61d9e08de..0a98041b7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -61,6 +61,7 @@ Version 1.6.0-dev (development of upcoming release)
 * Fixed: Use LC_ALL instead of LC_TIME to set the locale
 * Fixed: Optimize subparsers and usage output (#2132)
 * Fixed: Re-design about dialog (#1936)
+* Fixed: Sort rsync include/exclude options according to specificity (#561, #1420)
 * Fixed: Stop waking up monitor when inhibit suspend on backup starts (#714, #1090)
 * Fixed: Avoid shutdown confirmation dialog on Budgie and Cinnamon desktop environments (#788)
 * Fixed: Crash in "Manage profiles" dialog when using "qt6ct" (#2128)
diff --git a/common/snapshots.py b/common/snapshots.py
index 9ac77e9d5..868160cea 100644
--- a/common/snapshots.py
+++ b/common/snapshots.py
@@ -1467,6 +1467,8 @@ def takeSnapshot(self, sid, now, include_folders):
 
         self.setTakeSnapshotMessage(0, _('Creating backup'))
 
+        self._rsync_cmd_args = cmd
+
         # run rsync
         proc = tools.Execute(cmd,
                              # TODO
@@ -2343,13 +2345,15 @@ def rsyncSuffix(self, includeFolders=None, excludeFolders=None):
 
         Returns:
             (list): Rsync include and exclude options.
-        """
-        # Create exclude patterns string
-        rsync_exclude = self.rsyncExclude(excludeFolders)
-
-        # Create include patterns list
-        rsync_include, rsync_include2 = self.rsyncInclude(includeFolders)
 
+        DEREKVEIT 2024-07-31: This method is only called in one place,
+        self.takeSnapshot, which itself is only called in one place in
+        self.backup.  The excludeFolders parameter is unused and could be
+        removed.  The includeFolders parameter is always set simply from
+        self.config.include() in self.backup, so the includeFolders parameter
+        could be eliminated too by getting it from self.config here just as the
+        excludes are.
+        """
         encode = self.config.ENCODE
 
         ret = ['--chmod=Du+wx']
@@ -2360,18 +2364,143 @@ def rsyncSuffix(self, includeFolders=None, excludeFolders=None):
                 encode.exclude(self.config._MOUNT_ROOT)
             )
         ])
-        # TODO: fix bug #561:
-        # after rsync_exclude we need to explicitly include files inside
-        # excluded folders, recursive exclude folder-content again and finally
-        # add the rest from rsync_include2
-        ret.extend(rsync_include)
-        ret.extend(rsync_exclude)
-        ret.extend(rsync_include2)
+        if getattr(self.config, "SELECTIONS_MODE", "") == "sorted":
+            # This is ignoring the includeFolders and excludeFolders arguments.
+            ret.extend([f"--{option}={path}" for option, path in self.pathSelections()])
+        else:
+            rsync_exclude = self.rsyncExclude(excludeFolders)
+            rsync_include, rsync_include2 = self.rsyncInclude(includeFolders)
+
+            # TODO: fix bug #561:
+            # after rsync_exclude we need to explicitly include files inside excluded
+            # folders, recursive exclude folder-content again and finally add the
+            # rest from rsync_include2
+            ret.extend(rsync_include)
+            ret.extend(rsync_exclude)
+            ret.extend(rsync_include2)
+
+        # Make exclusion rather than inclusion the default.
         ret.append('--exclude=*')
         ret.append(encode.chroot)
 
         return ret
 
+    def pathSelections(self):
+        """Return data for the --include= and --exclude= options of rsync.
+
+        Returns a list of (<option>, <path>) where <option> is "include" or
+        "exclude".
+
+        When rsync considers a path, the first matching include or exclude rule
+        is applied.  The order of the options matters when there is both an
+        include rule and an exclude rule with a pattern that would match.
+
+        The items are reverse sorted so that rules for more-specific paths
+        come first, e.g.:
+            /var/log/My App
+            /var/log/My*
+            /var/log
+            /var/*/something
+            /var/*.log
+            /var/*
+            /var/**
+            /var
+        """
+        selections = set()
+
+        # Some exclude patterns represent relative paths.  For these to have
+        # the correct priority in the sorted paths for rsync options, they will
+        # be converted into absolute paths.
+        relative_excludes = set()
+        for path in self.config.exclude():
+            if path == "/":
+                selections.add(("exclude", "/**"))
+            elif path.startswith("/"):
+                selections.add(("exclude", path))
+            else:
+                relative_excludes.add(path)
+
+        include_paths = set([path for path, _ in self.config.include()])
+
+        for path, path_type in self.config.include():
+            is_dir = path_type == 0
+
+            selections.add(("include", path))
+
+            if is_dir:
+                # For concatenations with a slash below.
+                if path == "/":
+                    path = ""
+
+                # For the user, including a directory implies also including
+                # anything in it, but rsync does not work that way, so here we
+                # also specify to include "anything in it".
+                selections.add(("include", f"{path}/**"))
+
+                # Add the relative paths as absolute paths.
+                for relative_path in relative_excludes:
+                    if f"{path}/{relative_path}" not in include_paths:
+                        selections.add(("exclude", f"{path}/{relative_path}"))
+                    selections.add(("exclude", f"{path}/**/{relative_path}"))
+
+            # Since we exclude by default (--exclude=*), we must ensure that
+            # each parent directory is also explicitly included. Otherwise
+            # rsync will skip the parent and not find this path. These are not
+            # being given the <path>/** pattern as above, so this does not
+            # implicitly include other contents of the parent directories.
+            while True:
+                path, tail = os.path.split(path)
+                if not tail:
+                    break
+                selections.add(("include", path))
+
+                # If the parent directory was directly excluded, let the
+                # directory itself be an exception to the "directory and its
+                # contents" implied by that, and only exclude the contents.
+                if ("exclude", path) in selections:
+                    selections.remove(("exclude", path))
+                    selections.add(("exclude", f"{path}/**"))
+
+                # Add the relative paths as absolute paths.
+                if path == "/":
+                    path = ""
+                for relative_path in relative_excludes:
+                    if f"{path}/{relative_path}" not in include_paths:
+                        selections.add(("exclude", f"{path}/{relative_path}"))
+                    selections.add(("exclude", f"{path}/**/{relative_path}"))
+
+        # Identify contradictory specifications.
+        include_paths = set(p for o, p in selections if o == "include")
+        exclude_paths = set(p for o, p in selections if o == "exclude")
+        conflicts = include_paths & exclude_paths
+        for conflict_path in list(conflicts):
+            if conflict_path.endswith("/**"):
+                # This would be the automatically-added include for a folder,
+                # which should give way to a more-directly specified exclude.
+                selections.remove(("include", conflict_path))
+                conflicts.remove(conflict_path)
+        if conflicts:
+            # XXX: Preferably, the config GUI would also alert the user about this.
+            raise ValueError(f"a path is both included and excluded: {conflicts}")
+
+        # Sort in reverse so that the more specific path rules are given first.
+        # For the sort key, replace wildcard characters to give them low sort
+        # values, corresponding to them being least specific.  For example,
+        # "/home/user" is more specific than "/home/*".
+        selections = sorted(
+            selections,
+            key=lambda item: item[1].replace("**", "\x00").translate(str.maketrans({
+                "*": "\x01",
+                "?": "\x02",
+                "[": "\x03",
+            })),
+            reverse=True,
+        )
+
+        print("\n" + "\n  : ".join(f"{o} {p}" for o, p in selections))
+
+        return selections
+
     def rsyncExclude(self, excludeFolders=None):
         """Format exclude list for rsync.
 
diff --git a/common/test/filetree.py b/common/test/filetree.py
new file mode 100644
index 000000000..71bfd562c
--- /dev/null
+++ b/common/test/filetree.py
@@ -0,0 +1,173 @@
+from pathlib import Path
+import re
+import textwrap
+from typing import Iterable, Union
+
+
+"""
+A "tree" in this module means a multi-line text representation of files and
+directories like this:
+
+    a_tree = '''
+        foo/
+            bar/
+                file-a
+            baz/
+                file-b
+            file-c
+    '''
+
+This is to help make backup tests that are easy to read and write and are clear
+in their expectations and results.
+
+Features of a tree:
+- Directories are distinguished by a trailing slash
+- Within a directory, names must be sorted with directories before files
+- Indentation increment must be 4 spaces
+- Initial indentation and leading and trailing whitespace are arbitrary
+
+Useful functions:
+- files_from_tree: Create a file structure from a tree representation
+- tree_from_files: Generate a tree representation from an existing file structure
+- normal: Normalize the indentation and whitespace of a tree string
+
+An example of how this might be used to test a backup procedure:
+    1)  empty directories A and B are created.
+    2)  tree_a is defined with a string to specify some files.
+    3)  files_from_tree(A, tree_a)
+    4)  a backup is made from directory A to directory B.
+    5)  tree_b = tree_from_files(B)
+    6)  assert tree_b == normal(tree_a)
+"""
+
+
+def files_from_tree(parent_dir: Union[str, Path], tree: str) -> None:
+    """Create in `parent_dir` the structure described by `tree`."""
+    dir_paths, file_paths = parse_tree(parent_dir, tree)
+
+    for path in dir_paths:
+        path.mkdir()
+
+    for path in file_paths:
+        path.touch()
+
+
+def parse_tree(parent_dir: Union[str, Path], tree: str) -> tuple[list[Path], list[Path]]:
+    """Return the paths described by `tree` in `parent_dir`."""
+    parent_path = Path(parent_dir)
+
+    # a stack of ancestral directories at the current line
+    parent_dirs: list[Path] = []
+    # a stack of corresponding indentation strings
+    indents: list[str] = []
+    # most recent directory name in each ancestral directory
+    prec_dirname: dict[Path, str] = {}
+    # most recent file name in each ancestral directory
+    prec_filename: dict[Path, str] = {}
+
+    # full paths of the directories
+    dir_paths = []
+    # full paths of the files
+    file_paths = []
+
+    prev_filename: str = ""
+
+    for line in tree.splitlines():
+        if not line.strip():
+            continue
+
+        indent, filename = split_indent(line)
+
+        if not re.match(r"^(?:    )*$", indent):
+            raise ValueError(f"indentation must be of 4-space increments: {line = }")
+
+        if not indents:
+            # first iteration
+            indents.append(indent)
+            parent_dirs.append(parent_path)
+        elif indent == indents[-1]:
+            # the same indentation level and same parent directory
+            pass
+        elif indent in indents[:-1]:
+            # a previous indentation level and corresponding parent directory
+            index = indents.index(indent)
+            indents = indents[: index + 1]
+            parent_dirs = parent_dirs[: index + 1]
+        elif len(indent) > len(indents[-1]):
+            # should be reading the contents of a directory just seen
+            if not prev_filename.endswith("/"):
+                raise ValueError(f"indentation without directory: {line = }")
+            indents.append(indent)
+            parent_dirs.append(parent_dirs[-1] / prev_filename[:-1])
+        else:
+            raise ValueError(f"inconsistent tree indentation: {line = }")
+
+        preceding_dirname_here = prec_dirname.get(parent_dirs[-1], "")
+        preceding_filename_here = prec_filename.get(parent_dirs[-1], "")
+        if filename.endswith("/"):
+            if not preceding_dirname_here < filename:
+                raise ValueError(
+                    f"listed out of order after {preceding_dirname_here!r}: {line = }"
+                )
+            if preceding_filename_here:
+                raise ValueError(f"directory cannot be listed after file(s): {line = }")
+
+            # add the path for this directory
+            dir_paths.append(parent_dirs[-1] / filename)
+
+            prec_dirname[parent_dirs[-1]] = filename
+        else:
+            if not preceding_filename_here < filename:
+                raise ValueError(
+                    f"listed out of order after {preceding_filename_here!r}: {line = }"
+                )
+
+            # add the path for this file
+            file_paths.append(parent_dirs[-1] / filename)
+
+            prec_filename[parent_dirs[-1]] = filename
+
+        prev_filename = filename
+
+    return dir_paths, file_paths
+
+
+def split_indent(text: str) -> tuple[str, str]:
+    """Return the indentation and the remainder of the string as 2 strings."""
+    mo = re.match(r"( *)(.*)", text)
+    indent, remainder = mo.groups()  # type: ignore [union-attr]
+    return indent, remainder
+
+
+def tree_from_files(parent_dir: Union[str, Path]) -> str:
+    """Return a tree describing the contents of `parent_dir`."""
+    parent_path = Path(parent_dir)
+    initial_depth = len(parent_path.parts)
+    tree_lines = []
+    for path in sort_paths(parent_path.rglob("*")):
+        if path == parent_path:
+            continue
+        indent = "    " * (len(path.parents) - initial_depth)
+        name = path.name + ("/" if path.is_dir() else "")
+        tree_lines.append(indent + name)
+
+    return "\n" + "\n".join(tree_lines) + "\n"
+
+
+def normal(tree_string: str) -> str:
+    """Normalize indentation depth and surrounding whitespace of the tree."""
+    return f"\n{textwrap.dedent(tree_string).strip()}\n"
+
+
+def sort_paths(paths: Iterable[Path]) -> list[Path]:
+    """Sort a list of paths.
+
+    Within each directory, subdirectories are listed before files.
+    """
+    return sorted(
+        paths,
+        key=lambda path: (
+            [(False, part) for part in path.parts[:-1]]
+            + [(not path.is_dir(), path.name)]
+        ),
+    )
diff --git a/common/test/logging.py b/common/test/logging.py
new file mode 100644
index 000000000..0763ea79d
--- /dev/null
+++ b/common/test/logging.py
@@ -0,0 +1,37 @@
+import datetime
+import os
+import pathlib
+
+"""
+A simple log facility for use in the unit tests.  This is intentionally
+independent of the stdlib-based logging used by the application.
+
+Example:
+
+    from test.logging import log
+
+    def test_foo():
+        log("some message")
+"""
+
+log_path = pathlib.Path("/tmp/bit-unittest.log")
+
+current_test = ""
+
+
+def log(message: str) -> None:
+    """Append a message to the log file.
+
+    This also writes a line of = before the first log message and a line
+    of - and the test name before each new test case.
+    """
+    global current_test
+    last_test, current_test = current_test, os.getenv("PYTEST_CURRENT_TEST", "--")
+    timestamp = datetime.datetime.now().strftime(r"%Y-%m-%d %H:%M:%S")
+    with open(log_path, "a") as f:
+        if not last_test:
+            f.write(f"\n{'=' * 80}\n")
+        if current_test != last_test:
+            f.write(f"\n{'-' * 80}\n")
+            f.write(f"\n{timestamp} {current_test}\n")
+        f.write(f"  {message}\n")
diff --git a/common/test/selection_cases.yaml b/common/test/selection_cases.yaml
new file mode 100644
index 000000000..a18590e5c
--- /dev/null
+++ b/common/test/selection_cases.yaml
@@ -0,0 +1,266 @@
+
+# Each top-level key names a test case for test_rsync_selections.py
+
+# Normal properties:
+#   includes: paths to be configured as included in the backup
+#   excludes: paths to be configured as excluded in the backup
+#   files_tree: the files to be made available for the backup (see filetree.py)
+#   expected_tree: the files that should be copied for the backup
+
+# Properties for cases expecting an exception to be raised:
+#   exception_type_name
+#   expected_message
+
+# A property to mark special cases:
+#   flags:
+#       "original_fails": The case fails for the "original" strategy.
+#       "sorted_only": The case is only applicable for the "sorted" strategy.
+#       "fs_root": The case needs to use / as an included path.
+
+single-include-dir-without-excludes:
+    includes:
+        - /var
+    excludes: []
+    files_tree: |
+        var/
+            log/
+                dmesg
+                syslog
+    expected_tree: |
+        var/
+            log/
+                dmesg
+                syslog
+
+exclude-star:
+    includes:
+        - /var
+    excludes:
+        - /var/*
+    files_tree: |
+        var/
+            log/
+                dmesg
+                syslog
+    expected_tree: |
+        NONE
+
+exclude-name:
+    includes:
+        - /var
+    excludes:
+        - log
+    files_tree: |
+        var/
+            lib/
+                foo
+                log
+            log/
+                dmesg
+                syslog
+    expected_tree: |
+        var/
+            lib/
+                foo
+
+exclude-absolute-dir:
+    includes:
+        - /var
+    excludes:
+        - /var/log
+    files_tree: |
+        var/
+            lib/
+                log
+            log/
+                dmesg
+                syslog
+    expected_tree: |
+        var/
+            lib/
+                log
+
+issue-561:
+    flags:
+        - original_fails
+    includes:
+        - /var
+        - /var/log/bar    # original: causes everything else in /var/log/ to also get included.
+    excludes:
+        - /var/log        # sorted: this is treated as /var/log/** to allow the include.
+    files_tree: |
+        var/
+            lib/
+                log
+            log/
+                bar/
+                    bar.log
+                foo/
+                    foo.log
+                syslog
+    expected_tree: |
+        var/
+            lib/
+                log
+            log/
+                bar/
+                    bar.log
+
+issue-1419-closed:
+    includes:
+        - /var
+    excludes:
+        - '[Tt]emp/*'
+    files_tree: |
+        var/
+            Temp/
+                file1
+            Temperature
+    expected_tree: |
+        var/
+            Temp/
+            Temperature
+
+issue-1420:
+    flags:
+        - original_fails
+            # With original strategy, /home/xin/.ssh gets backed up as it should,
+            # but /home/xin/.gitignore doesn't.
+    includes:
+        - /home
+        - /home/xin/.gitignore
+        - /home/xin/.ssh
+    excludes:
+        - /home/xin/.*
+    files_tree: |
+        home/
+            xin/
+                .other-dir/
+                    foo
+                .ssh/
+                    config
+                .gitignore
+                .other
+    expected_tree: |
+        home/
+            xin/
+                .ssh/
+                    config
+                .gitignore
+
+various:
+    flags:
+        - original_fails
+    includes:
+        - /
+        - /var
+        - /var/log/keep
+        - /var/log/keep/bar.log
+        - /var/log/special.bak
+        - /var/log/keep/x/x2
+    excludes:
+        - /var/log/**  # With original strategy, this supersedes the more specific includes above.
+        - '[a-c]ar.log'
+        - keep/ba*.log
+        - '*.bak'
+        - /var/log/keep/x/**
+    files_tree: |
+        var/
+            log/
+                keep/
+                    more/
+                        bar.log.bak
+                    x/
+                        x1
+                        x2
+                    bar.log
+                    baz.log
+                    car.log
+                    foo.log
+                    foo.log.bak
+                special.bak
+                syslog
+        root_file
+    expected_tree: |
+        var/
+            log/
+                keep/
+                    more/
+                    x/
+                        x2
+                    bar.log
+                    foo.log
+                special.bak
+        root_file
+
+fs-root-exclude-all:
+    flags:
+        - original_fails
+        - fs_root       # Cannot simulate "/" in a prefixed temp dir for this one.
+    includes:
+        - /
+        - /etc/issue
+    excludes:
+        - /**
+        - '*.pyc'
+    files_tree: |
+        NONE
+    expected_tree: |
+        etc/
+            issue
+
+fs-root-exclude-root:
+    flags:
+        - sorted_only   # With original selection mode, it would try to copy everything.
+        - original_fails
+        - fs_root       # Cannot simulate "/" in a prefixed temp dir for this one.
+    includes:
+        - /
+        - /etc/issue
+    excludes:
+        - /             # This has no effect in the original selection mode, so /** would be included.
+        - '*.pyc'
+    files_tree: |
+        NONE
+    expected_tree: |
+        etc/
+            issue
+
+raise-contradiction:
+    flags:
+        - original_fails
+    includes:
+        - /var
+    excludes:
+        - /var
+    files_tree: |
+        var/
+            log/
+                dmesg
+                syslog
+    expected_tree: |
+        NONE
+    exception_type_name:
+        ValueError
+    expected_message:
+        a path is both included and excluded
+
+raise-contradiction-file:
+    flags:
+        - original_fails
+    includes:
+        - /var
+        - /var/log/dmesg
+    excludes:
+        - /var/log/dmesg
+    files_tree: |
+        var/
+            log/
+                dmesg
+                syslog
+    expected_tree: |
+        NONE
+    exception_type_name:
+        ValueError
+    expected_message:
+        a path is both included and excluded
diff --git a/common/test/test_filetree.py b/common/test/test_filetree.py
new file mode 100644
index 000000000..13e57c6b2
--- /dev/null
+++ b/common/test/test_filetree.py
@@ -0,0 +1,170 @@
+from pathlib import Path
+import pytest
+
+from test import filetree
+
+
+def test_files_from_tree(tmp_path: Path) -> None:
+    tree = """
+        var/
+            log/
+                another
+                syslog
+            some_file
+    """
+    filetree.files_from_tree(tmp_path, tree)
+    assert (tmp_path / "var").is_dir()
+    assert (tmp_path / "var/log").is_dir()
+    assert (tmp_path / "var/log/another").is_file()
+    assert (tmp_path / "var/log/syslog").is_file()
+    assert (tmp_path / "var/some_file").is_file()
+
+
+def test_files_from_tree__indent_not4sp(tmp_path: Path) -> None:
+    tree = """
+       var
+    """
+    with pytest.raises(
+        ValueError,
+        match="indentation must be of 4-space increments: line = '       var'",
+    ):
+        filetree.files_from_tree(tmp_path, tree)
+
+
+def test_files_from_tree__indent_not_in_dir(tmp_path: Path) -> None:
+    tree = """
+        var
+            some_file
+    """
+    with pytest.raises(
+        ValueError,
+        match="indentation without directory: line = '            some_file'",
+    ):
+        filetree.files_from_tree(tmp_path, tree)
+
+
+def test_files_from_tree__indent_inconsistent(tmp_path: Path) -> None:
+    tree = """
+        var
+    some_file
+    """
+    with pytest.raises(
+        ValueError,
+        match="inconsistent tree indentation: line = '    some_file'",
+    ):
+        filetree.files_from_tree(tmp_path, tree)
+
+
+@pytest.mark.parametrize(
+    "text,expected",
+    [
+        ("    some text", ("    ", "some text")),
+        ("some text", ("", "some text")),
+        ("    ", ("    ", "")),
+        ("", ("", "")),
+    ],
+)
+def test_split_indent(text: str, expected: tuple[str, str]) -> None:
+    assert filetree.split_indent(text) == expected
+
+
+# fmt: off
+@pytest.mark.parametrize(
+    "tree",
+    [
+        pytest.param("""
+            var/
+                lib/
+                    libsubdir/
+                        sub_file
+                    some_lib
+                log/
+                    box/
+                        contents
+                    another
+                    syslog
+                some_file
+                temp_file
+        """, id='1'),
+        pytest.param("""
+        """, id='2'),
+        pytest.param("""
+            .hidden_file1
+            file2
+        """, id='3'),
+        pytest.param("""
+            dir1/
+        """, id='4'),
+    ]
+)
+# fmt: on
+def test_tree_from_files(tmp_path: Path, tree: str) -> None:
+    filetree.files_from_tree(tmp_path, tree)
+    result = filetree.tree_from_files(tmp_path)
+    assert result == filetree.normal(tree)
+
+
+def test_tree_from_files__raise_dir_late(tmp_path: Path) -> None:
+    tree = """
+        var/
+            foo
+            lib/
+    """
+    with pytest.raises(ValueError, match="directory cannot be listed after file.*"):
+        filetree.files_from_tree(tmp_path, tree)
+
+
+def test_tree_from_files__raise_dir_order(tmp_path: Path) -> None:
+    tree = """
+        var/
+            log/
+            lib/
+    """
+    with pytest.raises(ValueError, match="listed out of order .*"):
+        filetree.files_from_tree(tmp_path, tree)
+
+
+def test_tree_from_files__raise_file_order(tmp_path: Path) -> None:
+    tree = """
+        var/
+            foo
+            bar
+    """
+    with pytest.raises(ValueError, match="listed out of order .*"):
+        filetree.files_from_tree(tmp_path, tree)
+
+
+# fmt: off
+@pytest.mark.parametrize(
+    "input_tree",
+    [
+        pytest.param("""
+a/
+    b/
+        c/
+            c1
+    a1
+""", id='1'),
+        pytest.param("""
+    a/
+        b/
+            c/
+                c1
+        a1
+        """, id='2'),
+        pytest.param("""    a/
+        b/
+            c/
+                c1
+        a1""", id='3'),
+    ]
+)
+def test_normal(input_tree: str) -> None:
+    assert filetree.normal(input_tree) == """
+a/
+    b/
+        c/
+            c1
+    a1
+"""
+# fmt: on
diff --git a/common/test/test_logging.py b/common/test/test_logging.py
new file mode 100644
index 000000000..b98143fad
--- /dev/null
+++ b/common/test/test_logging.py
@@ -0,0 +1,43 @@
+from pathlib import Path
+import re
+
+import pytest
+
+from test import logging
+from test.logging import log
+
+
+def test_log__first_test(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test the initial log entry for a test."""
+    monkeypatch.setattr(logging, "log_path", tmp_path / "bit-unittest.log")
+    monkeypatch.setattr(logging, "current_test", "")
+
+    log("some message")
+    log("another message")
+
+    file_contents = logging.log_path.read_text()
+    assert re.search(
+        r"""\n[0-9-]+ [0-9:]+ .*/test_logging\.py::test_log.*
+  some message
+  another message
+""",
+        file_contents,
+    )
+
+
+def test_log__subsequent_test(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test a subsequent log entry for a test."""
+    monkeypatch.setattr(logging, "log_path", tmp_path / "bit-unittest.log")
+    monkeypatch.setattr(logging, "current_test", "test_other.py::test_other (call)")
+
+    log("some message")
+    log("another message")
+
+    file_contents = logging.log_path.read_text()
+    assert re.search(
+        r"""[0-9-]+ [0-9:]+ .*/test_logging\.py::test_log.*
+  some message
+  another message
+""",
+        file_contents,
+    )
diff --git a/common/test/test_rsync_selections.py b/common/test/test_rsync_selections.py
new file mode 100644
index 000000000..e93bb4b68
--- /dev/null
+++ b/common/test/test_rsync_selections.py
@@ -0,0 +1,205 @@
+from collections.abc import Generator
+import os
+from pathlib import Path
+import shutil
+import tempfile
+from typing import Any, Union
+import unittest
+
+import ddt
+
+import config
+import snapshots
+import tools
+
+from test import filetree
+from test.logging import log
+
+
+@ddt.ddt
+class RsyncSuffixTests(unittest.TestCase):
+    """Test the rsyncSuffix function.
+
+    Test cases are defined in selection_cases.yaml.
+
+    The cases are tested with two strategies for how to prepare `--include=`
+    and `--exclude=` options for the rsync command:
+
+        - "original": how Snapshots.rsyncSuffix previously worked.
+        - "sorted": a new strategy that sorts the paths.
+    """
+
+    @ddt.file_data('selection_cases.yaml')
+    def test_rsyncSuffix__original(self, **kwargs: Any) -> None:
+        """Test the cases with the "original" strategy."""
+        self.assert_backup('original', **kwargs)
+
+    @ddt.file_data('selection_cases.yaml')
+    def test_rsyncSuffix__sorted(self, **kwargs: Any) -> None:
+        """Test the cases with the "sorted" strategy."""
+        self.assert_backup('sorted', **kwargs)
+
+    def assert_backup(
+        self,
+        selections_mode: str,
+        includes: list[str],
+        excludes: list[str],
+        files_tree: str,
+        expected_tree: str = '',
+        exception_type_name: str = '',
+        expected_message: str = '',
+        flags: Union[list[str], None] = None,
+    ) -> None:
+        """Check the results of running `Snapshots.backup`."""
+        if flags is None:
+            flags = []
+
+        files_tree = filetree.normal(files_tree)
+        expected_tree = filetree.normal(expected_tree)
+
+        if selections_mode == 'original' and 'original_fails' in flags:
+            self.skipTest('expected to fail with original strategy')
+        elif selections_mode != 'sorted' and 'sorted_only' in flags:
+            self.skipTest('only applicable for the sorted strategy')
+
+        temp_dir = get_temp_dir(self)
+        bit_config = get_bit_config(temp_dir)
+        bit_snapshot = snapshots.Snapshots(bit_config)  # type: ignore[no-untyped-call]
+
+        if 'fs_root' in flags:
+            files_root = Path("/")
+        else:
+            files_root = temp_dir / 'files'
+            files_root.mkdir()
+            includes = list(prepend_paths(files_root, includes))
+            excludes = list(prepend_paths(files_root, excludes))
+            filetree.files_from_tree(files_root, files_tree)
+
+        update_config(bit_config, includes, excludes)
+        log(f'{bit_config.include() = }')  # type: ignore[no-untyped-call]
+        log(f'{bit_config.exclude() = }')  # type: ignore[no-untyped-call]
+
+        bit_config.SELECTIONS_MODE = selections_mode  # type: ignore[attr-defined]
+
+        if exception_type_name:
+            self.assert_raises(
+                bit_snapshot,
+                exception_type_name,
+                expected_message,
+            )
+        else:
+            self.assert_has_correct_files(
+                bit_snapshot,
+                files_root,
+                expected_tree,
+            )
+
+    def assert_raises(
+        self,
+        bit_snapshot: snapshots.Snapshots,
+        exception_type_name: str,
+        expected_message: str,
+    ) -> None:
+        """Assert that the expected exception is raised."""
+        expected_exception = {
+            'ValueError': ValueError,
+        }[exception_type_name]
+
+        with self.assertRaises(expected_exception) as cm:
+            # act
+            bit_snapshot.backup()  # type: ignore[no-untyped-call]
+
+        self.assertRegex(cm.exception.args[0], expected_message + ":.*")
+
+    def assert_has_correct_files(
+        self,
+        bit_snapshot: snapshots.Snapshots,
+        files_root: Path,
+        expected_tree: str,
+    ) -> None:
+        """Assert that the expected files are copied."""
+        # act
+        bit_snapshot.backup()  # type: ignore[no-untyped-call]
+
+        if hasattr(bit_snapshot, '_rsync_cmd_args'):
+            cmd = bit_snapshot._rsync_cmd_args
+            log('rsync command arguments:')
+            log('\n    '.join(arg for arg in cmd))
+
+        assert bit_snapshot.config is not None  # quiet PyRight for the following line
+        backup_path = last_backup_dir(bit_snapshot.config)
+        if backup_path is None:
+            results_tree = filetree.normal('NONE')
+        else:
+            results_path = backup_path / str(files_root).strip('/')
+            results_tree = filetree.tree_from_files(results_path)
+
+        self.assertEqual(results_tree, expected_tree)
+
+
+def get_temp_dir(testcase: unittest.TestCase) -> Path:
+    temp_dir = tempfile.mkdtemp(prefix='backintime_testing_')
+    testcase.addCleanup(shutil.rmtree, temp_dir)
+    return Path(temp_dir)
+
+
+def get_bit_config(temp_dir: Path) -> config.Config:
+    config_path = (Path(__file__) / '../config').resolve()
+    data_path = temp_dir / 'data'
+
+    bit_config = config.Config(
+        str(config_path),  # config file at backintime/common/test/config
+        str(data_path),  # real default would be ~/.local/share
+    )  # type: ignore[no-untyped-call]
+
+    snapshots_path = temp_dir / 'snapshots'
+    snapshots_path.mkdir()
+    bit_config.set_snapshots_path(str(snapshots_path))  # type: ignore[no-untyped-call]
+    tools.validate_and_prepare_snapshots_path(
+        path=snapshots_path,
+        host_user_profile=bit_config.hostUserProfile(),  # type: ignore[no-untyped-call]
+        mode=bit_config.snapshotsMode(),  # type: ignore[no-untyped-call]
+        copy_links=bit_config.copyLinks(),  # type: ignore[no-untyped-call]
+        error_handler=bit_config.notifyError,
+    )
+
+    return bit_config
+
+
+def prepend_paths(tmp_path: Path, paths: list[str]) -> Generator[str, None, None]:
+    """Prefix any absolute paths with the temporary directory path."""
+    for path in paths:
+        if path == "/":
+            yield f"{tmp_path}"
+        elif path.startswith("/"):
+            yield f"{tmp_path}{path}"
+        else:
+            yield f"{path}"
+
+
+def update_config(
+    config: config.Config,
+    include_paths: list[str],
+    exclude_paths: list[str],
+) -> None:
+    # Partly adapted from MainWindow.btnAddIncludeClicked
+    includes = []
+
+    for item in include_paths:
+        if os.path.isdir(item):
+            includes.append((item, 0))
+        else:
+            includes.append((item, 1))
+
+    config.setInclude(includes)  # type: ignore[no-untyped-call]
+    config.setExclude(exclude_paths)  # type: ignore[no-untyped-call]
+
+
+def last_backup_dir(config: config.Config) -> Union[Path, None]:
+    snapshots_path = config.get_snapshots_path('1')  # type: ignore[no-untyped-call]
+    last_snapshot = snapshots.lastSnapshot(config)  # type: ignore[no-untyped-call]
+    try:
+        backup_path = next(Path(snapshots_path).glob(f'**/{last_snapshot}/backup'))
+    except StopIteration:
+        return None
+    return backup_path