I presume root is need for tar, as it need file permissions ?

On the client a compiled, wrapper program, "runtar" is used
to call tar.  runtar is installed owned by root and setuid'ed.

Ah, thanks Jon !