From 95d1b23921ecf45169243e314c3916a14bdd224c Mon Sep 17 00:00:00 2001
From: Christian Goll <cgoll@suse.de>
Date: Fri, 1 Apr 2022 11:47:45 +0200
Subject: [PATCH] use secure overlay dir

If there is a user writeable file in the host overlay, a user can
create arbitrary files on the host root file system. Although these
files will belong to this user, this might allow users to modify
any files.
So this patch restricts the access to the host overlay to root and
produces a warning if this was changed.
---
 Makefile                        | 1 +
 internal/pkg/overlay/overlay.go | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/Makefile b/Makefile
index a5a9835e..c7c42693 100644
--- a/Makefile
+++ b/Makefile
@@ -179,6 +179,7 @@ files: all
 	chmod 755 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/$(WWCLIENTDIR)/wwinit
 	chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*
 	chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*.pub.ww
+	chmod 750 $(DESTDIR)$(WWOVERLAYDIR)/host
 	install -m 0755 wwctl $(DESTDIR)$(BINDIR)
 	install -m 0644 include/firewalld/warewulf.xml $(DESTDIR)$(FIREWALLDDIR)
 	install -m 0644 include/systemd/warewulfd.service $(DESTDIR)$(SYSTEMDDIR)
diff --git a/internal/pkg/overlay/overlay.go b/internal/pkg/overlay/overlay.go
index 82eccf6a..663c7d11 100644
--- a/internal/pkg/overlay/overlay.go
+++ b/internal/pkg/overlay/overlay.go
@@ -92,6 +92,14 @@ func BuildHostOverlay() error {
 	wwlog.Printf(wwlog.INFO, "Building overlay for %s: host\n", hostname)
 	idEntry.Set(hostname)
 	host.Id = idEntry
+	hostdir := OverlaySourceDir("host")
+	stats, err := os.Stat(hostdir)
+	if err != nil {
+		return errors.Wrap(err, "could not build host overlay ")
+	}
+	if !(stats.Mode() == os.FileMode(0750|os.ModeDir) || stats.Mode() == os.FileMode(0700|os.ModeDir)) {
+		wwlog.Printf(wwlog.WARN, "Permissions of host overlay dir %s are %s (750 is considered as secure)\n", hostdir, stats.Mode())
+	}
 	return BuildOverlayIndir(host, []string{"host"}, "/")
 }