[Virtio-fs] [virtiofsd] MR opened: keep `DAC_OVERRIDE` after changing the uid/gid

[virtiofs-bot at sinrega.org]

Currently, the FUSE protocol doesn't send the process supplementary
groups. This causes some use cases to fail, for instance
(user belongs to "wheel"):

    # mkdir -m 0770 testdir
    # chgrp wheel testdir
    # su user -c "touch testdir/file"

it should succeed but fails with "Permission denied".

The Kata team also reported a database init failure due to lack of
support of supplementary groups:

"kata database failed due to permission issue in mssql/mariadb/pssql:
cannot create directory '/var/lib/mysql/data': Permission denied"

Although the actual solution requires a modification of the FUSE
protocol, and Miklos is working on a solution. In the meantime,
to work around this, we can set the `DAC_OVERRIDE` in the effective set
after changing the credentials. We are allowed to set the capability
because we only change the effective user ID, so we still have the
'DAC_OVERRIDE' in the permitted set.

An alternative workaround is to set `SECBIT_NO_SETUID_FIXUP` to avoid
clearing the caps effective set, but it has the disadvantage that we
must be careful and drop `FSETID` (and probably a few others) or we
risk introducing some security bugs, like CVE-2022-0358 [0].

The biggest drawback of this workaround, it will not work on top of
NFS (and probably also CEPH) and might be limited to local
filesystems.

[0] https://gitlab.com/virtio-fs/virtiofsd/-/merge_requests/77

This is a workaround for #59 

closes #30
---
https://gitlab.com/virtio-fs/virtiofsd/-/merge_requests/142