kelvin/warewulf
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

use secure overlay dir

Browse Source 
If there is a user writeable file in the host overlay, a user can
create arbitrary files on the host root file system. Although these
files will belong to this user, this might allow users to modify
any files.
So this patch restricts the access to the host overlay to root and
produces a warning if this was changed.
This commit is contained in:
Christian Goll
2022-04-01 11:47:45 +02:00
committed by Christian Goll
parent 2567246067
commit 95d1b23921
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Makefile
View File

@@ -179,6 +179,7 @@ files: all
chmod 755 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/$(WWCLIENTDIR)/wwinit
chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*
chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*.pub.ww
chmod 750 $(DESTDIR)$(WWOVERLAYDIR)/host
install -m 0755 wwctl $(DESTDIR)$(BINDIR)
install -m 0644 include/firewalld/warewulf.xml $(DESTDIR)$(FIREWALLDDIR)
install -m 0644 include/systemd/warewulfd.service $(DESTDIR)$(SYSTEMDDIR)

8
internal/pkg/overlay/overlay.go
View File

@@ -92,6 +92,14 @@ func BuildHostOverlay() error {
wwlog.Printf(wwlog.INFO, "Building overlay for %s: host\n", hostname)
idEntry.Set(hostname)
host.Id = idEntry
hostdir := OverlaySourceDir("host")
stats, err := os.Stat(hostdir)
if err != nil {
return errors.Wrap(err, "could not build host overlay ")
}
if !(stats.Mode() == os.FileMode(0750|os.ModeDir) || stats.Mode() == os.FileMode(0700|os.ModeDir)) {
wwlog.Printf(wwlog.WARN, "Permissions of host overlay dir %s are %s (750 is considered as secure)\n", hostdir, stats.Mode())
}
return BuildOverlayIndir(host, []string{"host"}, "/")
}