Also prevent provisioning arbitrary overlays in secure mode

Signed-off-by: David McFarlane <54093156+Prepultrue@users.noreply.github.com>

CHANGELOG.md

@@ -32,6 +32,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Systems with no SMBIOS (Raspberry Pi) will create a UUID from
   `/sys/firmware/devicetree/base/serial-number`
 - Replace slice in templates with sprig substr. #1093
+- Block unprivileged requests for arbitrary overlays in secure mode.
 
 ## v4.5.2, unreleased
 

internal/pkg/warewulfd/provision.go

@@ -47,7 +47,7 @@ func ProvisionSend(w http.ResponseWriter, req *http.Request) {
 
 	wwlog.Recv("hwaddr: %s, ipaddr: %s, stage: %s", rinfo.hwaddr, req.RemoteAddr, rinfo.stage)
 
-	if rinfo.stage == "runtime" && conf.Warewulf.Secure {
+	if (rinfo.stage == "runtime" || len(rinfo.overlay) > 0) && conf.Warewulf.Secure {
 		if rinfo.remoteport >= 1024 {
 			wwlog.Denied("Non-privileged port: %s", req.RemoteAddr)
 			w.WriteHeader(http.StatusUnauthorized)