[PATCH proxmox-backup] docs: mention restricted privileges required for local pull sync jobs

[PATCH proxmox-backup] docs: mention restricted privileges required for local pull sync jobs

[Christian Ebner]

Since commit c43aa6ac (""sync: pull: check source datastore/namespace
read access) stricter privilege checks are in place for users which
create/modify a pull sync job with local source.

Mention these restrictions also in the documentation, and
discriminate more clearly between pull sync jobs with local and
remote source datastore.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 docs/managing-remotes.rst | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/docs/managing-remotes.rst b/docs/managing-remotes.rst
index f1e0ffaa8..0396a9ef1 100644
--- a/docs/managing-remotes.rst
+++ b/docs/managing-remotes.rst
@@ -102,8 +102,14 @@ trusted remote backup server.
 
 To set up sync jobs, the configuring user needs the following permissions:
 
-#. ``Remote.Read`` on the ``/remote/{remote}/{remote-store}`` path
-#. At least ``Datastore.Backup`` on the local target datastore (``/datastore/{store}``)
+* (Remote Source): ``Remote.Read`` on the ``/remote/{remote}/{remote-store}``
+  path for sync jobs when pulling from a remote datastore.
+* (Local Source):``Datastore.Audit`` on the local source datastore
+  ``/datastore/{store}`` and either ``Datastore.Read`` or access to owned backup
+  groups via ``Datastore.Backup``. For the latter case, if the configuring user
+  is not the owner of the sync job, ``Datastore.Modify`` is required as well as
+  this implies changing group ownership.
+* At least ``Datastore.Backup`` on the local target datastore (``/datastore/{store}``)
 
 .. note:: A sync job can only sync backup groups that the configured remote's
   user/API token can read. If a remote is configured with a user/API token that
-- 
2.47.3