microsoft / microsoft/WSL

Add an option which only root user can execute Windows binary in WSL

Open
#11,481 3 comments 0 reactions 0 assignees View on GitHub
feature
Dominant language
C++
Stars
33.7k
Forks
1.8k
Avg merge
3d 17h
Merged PRs (30d)
116

Description

**Is your feature request related to a problem? Please describe.**
I want that only root user is able to execute Windows binary in WSL.

**Describe the solution you'd like**
There is an option like `rootOnly` to enable this feature in `wsl.conf`. For example,
```service
[interop]
rootOnly = true
```
And when WSL non-root user execute Windows binary will produce proper error message.
```sh
firejox@DESKTOP-2BCQGK7:~$ xxx.exe
xxx.exe permission denied
```

**Describe alternatives you've considered**
Currently, I can use `chmod o= /run/WSL` to forbid non-root user execute Windows binary. However, it produces ugly error message.
```sh
firejox@DESKTOP-2BCQGK7:~$ choice.exe
<3>WSL (841) ERROR: UtilConnectUnix:513: connect failed 13
firejox@DESKTOP-2BCQGK7:~$
```

Contributor guide

Open the contributing guide

Research direction

Start by reading the [interop] settings in wsl.conf and tracing the current Windows-binary execution path, including the /run/WSL alternative mentioned in the issue. Define how rootOnly should be parsed and enforced, then verify that non-root execution produces a clear permission-denied result while root execution remains supported.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
operating-systems, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.