From 41535cb8f92e05d636d6220ad9a7a55d965a91a2 Mon Sep 17 00:00:00 2001
From: David McFarlane <54093156+Prepultrue@users.noreply.github.com>
Date: Wed, 8 May 2024 11:23:18 +1000
Subject: [PATCH] Also prevent provisioning arbitrary overlays in secure mode

Signed-off-by: David McFarlane <54093156+Prepultrue@users.noreply.github.com>
---
 CHANGELOG.md                        | 1 +
 internal/pkg/warewulfd/provision.go | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 24f96688..83841c15 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,6 +32,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Systems with no SMBIOS (Raspberry Pi) will create a UUID from
   `/sys/firmware/devicetree/base/serial-number`
 - Replace slice in templates with sprig substr. #1093
+- Block unprivileged requests for arbitrary overlays in secure mode.
 
 ## v4.5.2, unreleased
 
diff --git a/internal/pkg/warewulfd/provision.go b/internal/pkg/warewulfd/provision.go
index 035cd95e..0d544d69 100644
--- a/internal/pkg/warewulfd/provision.go
+++ b/internal/pkg/warewulfd/provision.go
@@ -47,7 +47,7 @@ func ProvisionSend(w http.ResponseWriter, req *http.Request) {
 
 	wwlog.Recv("hwaddr: %s, ipaddr: %s, stage: %s", rinfo.hwaddr, req.RemoteAddr, rinfo.stage)
 
-	if rinfo.stage == "runtime" && conf.Warewulf.Secure {
+	if (rinfo.stage == "runtime" || len(rinfo.overlay) > 0) && conf.Warewulf.Secure {
 		if rinfo.remoteport >= 1024 {
 			wwlog.Denied("Non-privileged port: %s", req.RemoteAddr)
 			w.WriteHeader(http.StatusUnauthorized)