[PATCH proxmox-backup] docs: mention restricted privileges required for local pull sync jobs

[PATCH proxmox-backup] docs: mention restricted privileges required for local pull sync jobs

[Christian Ebner]

Since commit c43aa6ac (""sync: pull: check source datastore/namespace
read access) stricter privilege checks are in place for users which
create/modify a pull sync job with local source.

Mention these restrictions also in the documentation, and
discriminate more clearly between pull sync jobs with local and
remote source datastore.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 docs/managing-remotes.rst | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/docs/managing-remotes.rst b/docs/managing-remotes.rst
index f1e0ffaa8..0396a9ef1 100644
--- a/docs/managing-remotes.rst
+++ b/docs/managing-remotes.rst
@@ -102,8 +102,14 @@ trusted remote backup server.
 
 To set up sync jobs, the configuring user needs the following permissions:
 
-#. ``Remote.Read`` on the ``/remote/{remote}/{remote-store}`` path
-#. At least ``Datastore.Backup`` on the local target datastore (``/datastore/{store}``)
+* (Remote Source): ``Remote.Read`` on the ``/remote/{remote}/{remote-store}``
+  path for sync jobs when pulling from a remote datastore.
+* (Local Source):``Datastore.Audit`` on the local source datastore
+  ``/datastore/{store}`` and either ``Datastore.Read`` or access to owned backup
+  groups via ``Datastore.Backup``. For the latter case, if the configuring user
+  is not the owner of the sync job, ``Datastore.Modify`` is required as well as
+  this implies changing group ownership.
+* At least ``Datastore.Backup`` on the local target datastore (``/datastore/{store}``)
 
 .. note:: A sync job can only sync backup groups that the configured remote's
   user/API token can read. If a remote is configured with a user/API token that
-- 
2.47.3

applied: [PATCH proxmox-backup] docs: mention restricted privileges required for local pull sync jobs

[Fabian Grünbichler]

On Mon, 19 Oct 2026 16:46:49 +0200, Christian Ebner wrote:
> Since commit c43aa6ac (""sync: pull: check source datastore/namespace
> read access) stricter privilege checks are in place for users which
> create/modify a pull sync job with local source.
> 
> Mention these restrictions also in the documentation, and
> discriminate more clearly between pull sync jobs with local and
> remote source datastore.
> 
> [...]

Applied, but rephrased a bit more in a follow-up and copied it to the push part
of the same file, thanks!

[1/1] docs: mention restricted privileges required for local pull sync jobs
      commit: c7fe49614dcd18e7304b50a9f870f1543438dcf1

Best regards,
-- 
Fabian Grünbichler <f.gruenbichler@proxmox.com>