World Writable Mounts Need Sticky Bit

##### ISSUE TYPE
* Bug Report

##### COMPONENT NAME
component:api

##### CLOUDSTACK VERSION
~~~
4.17
4.18
~~~

##### OS / ENVIRONMENT
Ubuntu
Rocky Linux 8

##### SUMMARY
In java code, NFS mounts are not consistently set to 1777 to prevent world writable issues.

References to correct setting
```
./server/src/main/java/org/apache/cloudstack/storage/NfsMountManagerImpl.java: script.add("1777", mountPoint);
./plugins/hypervisors/vmware/src/main/java/com/cloud/hypervisor/vmware/manager/VmwareManagerImpl.java: script.add("1777", mountPoint);

```

#### Change 777 to 1777

#### ./services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/LocalNfsSecondaryStorageResource.java
```java
@Override
protected void mount(String localRootPath, String remoteDevice, URI uri, String nfsVersion) {
ensureLocalRootPathExists(localRootPath, uri);

if (mountExists(localRootPath, uri)) {
return;
}

attemptMount(localRootPath, remoteDevice, uri, nfsVersion);

// Change permissions for the mountpoint - seems to bypass authentication
Script script = new Script(true, "chmod", _timeout, s_logger);
script.add("777", localRootPath);
String result = script.execute();
if (result != null) {
String errMsg = "Unable to set permissions for " + localRootPath + " due to " + result;
s_logger.error(errMsg);
throw new CloudRuntimeException(errMsg);
}
s_logger.debug("Successfully set 777 permission for " + localRootPath);

// XXX: Adding the check for creation of snapshots dir here. Might have
// to move it somewhere more logical later.
checkForSnapshotsDir(localRootPath);
checkForVolumesDir(localRootPath);
}

```
#### ./plugins/hypervisors/hyperv/src/main/java/com/cloud/hypervisor/hyperv/manager/HypervManagerImpl.java
```java
protected String mount(String path, String parent, String scheme, String query) {
String mountPoint = setupMountPoint(parent);
if (mountPoint == null) {
s_logger.warn("Unable to create a mount point");
return null;
}

Script script = null;
String result = null;
if (scheme.equals("cifs")) {
String user = System.getProperty("user.name");
Script command = new Script(true, "mount", _timeout, s_logger);
command.add("-t", "cifs");
command.add(path);
command.add(mountPoint);

if (user != null) {
command.add("-o", "uid=" + user + ",gid=" + user);
}

if (query != null) {
query = query.replace('&', ',');
command.add("-o", query);
}

result = command.execute();
}

if (result != null) {
s_logger.warn("Unable to mount " + path + " due to " + result);
File file = new File(mountPoint);
if (file.exists()) {
file.delete();
}
return null;
}

// Change permissions for the mountpoint
script = new Script(true, "chmod", _timeout, s_logger);
script.add("-R", "777", mountPoint);
result = script.execute();
if (result != null) {
s_logger.warn("Unable to set permissions for " + mountPoint + " due to " + result);
}
return mountPoint;
}

```

Commencez par LocalNfsSecondaryStorageResource.java et HypervManagerImpl.java, puis comparez leur gestion des permissions de montage avec les références NfsMountManagerImpl.java et VmwareManagerImpl.java. Mettez à jour les paramètres incohérents des montages accessibles en écriture par tous pour utiliser le sticky bit et vérifiez que les chemins de montage concernés n'utilisent plus 777.

Rédigé par le modèle d'indexation à partir du texte de l'issue.