use secure overlay dir

If there is a user writeable file in the host overlay, a user can
create arbitrary files on the host root file system. Although these
files will belong to this user, this might allow users to modify
any files.
So this patch restricts the access to the host overlay to root and
produces a warning if this was changed.

internal/pkg/overlay/overlay.go

@@ -92,6 +92,14 @@ func BuildHostOverlay() error {
 	wwlog.Printf(wwlog.INFO, "Building overlay for %s: host\n", hostname)
 	idEntry.Set(hostname)
 	host.Id = idEntry
+	hostdir := OverlaySourceDir("host")
+	stats, err := os.Stat(hostdir)
+	if err != nil {
+		return errors.Wrap(err, "could not build host overlay ")
+	}
+	if !(stats.Mode() == os.FileMode(0750|os.ModeDir) || stats.Mode() == os.FileMode(0700|os.ModeDir)) {
+		wwlog.Printf(wwlog.WARN, "Permissions of host overlay dir %s are %s (750 is considered as secure)\n", hostdir, stats.Mode())
+	}
 	return BuildOverlayIndir(host, []string{"host"}, "/")
 }