A couple of questions

[unrooted]

Hello all, I've got a couple of questions, to which I couldn't find straightforward answers to, or maybe I haven't experimented that much with the WSL yet

1. As far as I know - every WSL distro works inside a namespace of the 'main' distro, is the 'main' one what's found when we access the --system distro? If the --system one is the backbone of all the others under which they operate in namespaces, where is the .vhdx for it stored? where is it located in the Windows filesystem? 'Regular' WSL distros can be found under \\wsl$\<distro name> and their .vhdx files are in %appdata%, but this doesn't seem to be the case with the --system one. If the --system one is not the 'main' distro, under which others run in namespace of, where is the 'main' one? Is it possible to access and interact with it? No matter whether the --system one is the 'main' one, I always thought that WSL is running under Hyper-V, yet Get-VM cmdlet doesn't return a thing about any WSL distro, and I can't find any references to the --system distro in the registry (HKCU:\Software\Microsoft\Windows\CurrentVersion\Lxss)

2. Speaking of --system distro, it has the default user 'wslg', yet I'm unable to find a password for it anywhere in the docs. I know that I can use -u root to gain root access to it and basically any other distro, however, I wonder, is the password for 'wslg' user described anywhere in the docs? I was unable to find it, but I suppose I can always run /mnt/c/Windows/system32/wsl.exe --system -u root when I'd need it in the same 'session'...

3. ...and that 'session' leads me to another question - how exactly does the --system distro operate? whenever I tried to install any package or create/modify any files, the changes/files/packages are gone after I restart the WSL via wsl --shutdown. My wildest guess so far is that it uses some kind of a golden image from which it's being regenerated from after the restart? I was unable to find anything on the net on this topic. Would it be possible to create persistent changes to it?

4. What exactly is /boot/systemd.cfg used for in the --system distro? I've noticed it's the only non-empty /boot directory across all WSL distros. Is it for the systemd support? What if I install only distros which don't do it? Or will it force them to use systemd? There's a comment in that file - # GRUB Environment Block, is WSL using GRUB under the hood?

5. There is one other thing related to the --system distro I don't quite get. There's /etc/wsl.conf, which contains the following line:

[boot]
command=/usr/bin/WSLGd

What is that WSLGd exactly? What is it responsible for? What is more, generally speaking across different distros, what is /mnt/wslg actually used for? Is it just for the sake of supporting PulseAudio and so on? I noticed that in general under /mnt/wslg/distro there is mounted root fs of the default WSL distro. I noticed that the /mnt/wslg is also gone from the wsl --debug-shell box (if that's a different box than the --system one ofc, but I'll get to that in a moment). Also, what is /mnt/hgfs used for? This directory seems to be mounted only on the --system and the --debug-shell, but yet it has always been empty (at least in my case, but please note that I might have not yet gotten to this point of experimenting with WSL and learning about it) and I know that this is usually used for VMware shared folders, is this the same concept used in here?

6. What is the --debug-shell? Is it the same box as --system but just logins automatically as root? I've noticed that when it's left for a while after shutting down other distros, sitting at idle, it will return the error: No process is on the other end of the pipe. Error code: Wsl/DebugShell/ERROR_PIPE_NOT_CONNECTED, yet I never experienced such thing using --system distro, which makes me wonder if it's the same box just with different settings (also the default distro 'boots up' when '--system' is started and the '--debug-shell' can't be started prior (at least that's what I noticed) to starting any WSL distro at all and hence the procedure would be somewhat different (such as - first start any WSL distro, then start --debug-shell, as opposed to starting --system which automatically starts the default WSL distro as well)). I also noticed it's CBL Mariner as well.

7. Are there any known methods of running auditd now? I've seen one blogpost from almost 2 years ago, which stated that auditing is not supported from the kernel perspective, but in my /proc/config.gz I can find the following line: CONFIG_AUDIT=y. Is it anyhow doable? I keep on getting errors related to 'operation not permitted'. Also, what are the known limits of systemd which is now shipped together with for example Ubuntu? Are the limitations related mainly to running in a namespace, rather than full fledge Linux (virtual) machine? What init system is used as backbone of everything (such as in --system)? What if I import a distro manually which doesn't usually support systemd? Can I use other init systems to the extent of managing services inside WSL distro? Will the WSL try to enforce usage of systemd? I have no idea whether it's possible to use different init systems between namespaces at all.

8. Are there any methods of managing the name of the WSL distro? I know one which involves changing /etc/wsl.conf as well as /etc/hostsfile, but maybe there is some nicer and more elegant way of doing so? maybe even the possibility to apply 'custom' names to how the WSL distros are displayed when usingwsl -l`?

9. Is it possible to access filesystems of WSL distros from within another WSL distro? I know that with the recent releases and with usage of systemd it's pretty easy to create mountpoints, or I can always re-generate /etc/fstab file, or even just using stdin/stdout (which seems to work even if the other distro isn't running), but maybe there is a cleaner way of doing so (ofc, not via explorer.exe, that would be too boring)?

10. Seems like installing WSL also adds bash.exe to the host system, however, it seems to direct the execution to the default WSL distro - is there a cleaner approach to use different distros? Or am I left with only wsl --exec flag and using shell from other distros that way? Just curious if there are any settings associated with bash.exe somewhere on the system

11. Now, the hardening perspective - would it be doable, from the Windows point of view, to block installation, import and export functionality of the WSL to make it harder to tamper with? I'd just block wsl.exe, but that'd prevent me from launching any WSL distros at all I suppose. Are there any general WSL-specific hardening tips on both Windows and WSL sides of things?

12. Are there any articles or resources in general that deep dive into, let's call it, 'WSL internals' territory? I had issues when looking for some answers, and the best source of information as of right now is the following dev blog: https://devblogs.microsoft.com/commandline/learn-about-windows-console-and-windows-subsystem-for-linux-wsl/

Thanks in advance for all the answers.

[github-actions[bot]]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The scipt will output the path of the log file once done.

Once completed please upload the output files to this Github issue.

Click here for more info on logging
If you choose to email these logs instead of attaching to the bug, please send them to [email protected] with the number of the github issue in the subject, and in the message a link to your comment in the github issue and reply with '/emailed-logs'.

View similar issues

Please view the issues below to see if they solve your problem, and if the issue describes your problem please consider closing this one and thumbs upping the other issue to help us prioritize it!

Closed similar issues:

• UAC elevated / basic level of wslhost.exe cause different mount "namespaces" (#9690), similarity score: 0.72

Note: You can give me feedback by thumbs upping or thumbs downing this comment.

[unrooted]

/question

[github-actions[bot]]

Diagnostic information

Found '/question', adding tag 'question'

[zcobol]

1. The system distro virtual driver is located at C:\Program Files\WSL\system.vhd
2. The entry into /etc/shadow for user wslg is wslg:!:19815:7:99999:7::: meaning you can't user a password to login. Notice the ! in the 2nd field.
3. For the debug-shell to work you need a WSL distro to be running.

Keep in mind that the system distro exports a read-only filesystem. It is highly recommended not to mess with it! If you want to experiment build your own system distro, instructions at https://github.com/microsoft/wslg/

More info at https://learn.microsoft.com/en-us/windows/wsl/. Scroll to the bottom of the page for some WSL DEEP DIVES links.

[unrooted]

@zcobol hi, thanks for the reply
the link you've pasted also answers another one of my questions, such as what WSLGd is

do you have some ideas on other questions? Also sorry for posting them in an issue, not a discussion, I've just noticed this repo supports discussions, sorry for that