5

I would like to set up WSL (Ubuntu) in such a way that the root user in WSL doesn't have access to all the drives in windows. Ideally they're able to do everything within the linux world, but aren't able to mount the c: or any other drives. They should, of course, have access to the linux root folder and everyhing else therein (wherever that is mounted in windows).

WSL by default mounts all drives on /mnt/c etc.. at startup. I can of course create a task to unmount these. But I don't think that's enough since root can mount them again of course. So it seems this would have to be some sort of windows solution. I create a restricted account in ubuntu or put user in chroot jail, but that's not what I am looking for.

1 Answer 1

4

Completely turning off the ability for root to get access to the Windows drives might be a bit tough. WSL really is designed for Windows/Linux interop.

The mechanism for disabling automounting and interop is through the /etc/wsl.conf file, but, of course someone with root access to the WSL instance can still edit that and undo your changes. That said, I'd definitely start with a /etc/wsl.conf that includes:

[automount]
enabled=false

[interop]
enabled=false
appendWindowsPath=false

Disabling interop will be important for preventing a root user from calling the wsl.exe command from inside WSL. That at least prevents the root user from being able "restart" the WSL instance.

However, even with automounting turned off, if I recall correctly, the Windows drives can still be manually mounted since that functionality is provided by the WSL /init.

Ultimately I do believe you'll have to create a chroot jail. However, you can launch WSL directly into this jail with something like:

wsl -u root -e sh -c "cd /newroot; exec /usr/sbin/chroot /newroot/" su - username

... and the user shouldn't be able to escape it. It's been a while since I tried it out, but I had it working for this answer for a different purpose. Note that that particular answer also has the chroot setup instructions.

3
  • 1
    I would argue it’s impossible to prevent root access to the Windows environment since any protection you implement could be reversed by root itself. By default the default user would also have access to the windows user’s files which might or might not be root. This answer might work, problem with trying to restrict root, is that it’s bloody root
    – Ramhound
    Mar 25, 2022 at 11:50
  • 1
    Perhaps - I'm not totally sure either way yet. I haven't researched, but can root escape a chroot jail? How about a PID namespace? I think, if WSL is started with the chroot or namespace, that it would be "safe." Of course, a Windows user could always start another WSL instance that wasn't in that jail/namespace, but the root user inside that jail/namespace wouldn't be able to get access to /init, which is needed to mount drives (and run interop, et. al.). Right? Mar 25, 2022 at 13:10
  • thx this answer worked for me 2
    – BARIS KURT
    Apr 2, 2022 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .