Override mount and interop options for all distributions in .wslconfig
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 33.7k
- Forks
- 1.8k
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 116
Description
**Is your feature request related to a problem? Please describe.**
As an enterprise admin, i want to provision WSL2 to my users but because of security constraints i need to disable the ability to mount the windows drives inside any of the distributions and also disable interop so that windows programs cant be called inside the VM.
Currently we can set these options in /etc/wsl.conf but if the VM account has sudo rights they can be undone.
Also we need to disable the DriveFS connection from the VM to windows, the automount option only disables automounting, it does not disable the ability to issue mount commands. Security team will not allow the distribution of WSL2 if the VM can reach into the secure corporate build. being able to go the other way is fine so the "Linux Drive" function is ok
**Describe the solution you'd like**
suitable options in .wslconfig that allow interop and driveFS operation in all Distributions to be disabled, and make sure that the /etc/wsl.conf options cant override them. we can set permissions on the .wslconfig file to require admin rights to edit.
**Describe alternatives you've considered**
We cannot find an alternative other than not allowing sudo inside the VM, and that would defeat the purpose of having WSL in the first place.
**Additional context**
We are a very large corporate with a flat network, so we do not allow developers to have admin rights, this severely restricts their abilities, WSL2 provides a process boundary where we can sandbox a space that has admin rights inside the VM
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the existing .wslconfig and /etc/wsl.conf configuration behavior, especially the mount, DriveFS, automount, and interop options described in the issue. Determine where system-wide settings are applied relative to distribution settings; done means administrator-controlled options can disable these capabilities across distributions and cannot be overridden by /etc/wsl.conf.
Written by the indexing model from the issue text.
Assessment
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100