syncing to a namespace only requires privileges on the namespace (and potentially its children during execution). Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>