Control the permissions for drvfs to mount host hard drives

[inschrift-spruch-raum]

Is your feature request related to a problem? Please describe.
Fact 1 (Requirement): As we all know, AI Agents may damage the host system, and using WSL can provide a trustworthy sandbox environment to a certain extent.
Fact 2 (Current Issue): However, drvfs can mount the host system's disk without requiring any permission from the host.
Viewpoint 1 (Counter-argument): Some might argue that root permissions solve this problem to some degree.
Viewpoint 2 (Rebuttal to Viewpoint 1): But in reality, it is common practice to grant AI temporary root privileges.
Viewpoint 3 (Rebuttal to Viewpoint 1): Furthermore, operations on the host file system should inherently require confirmation from the host.

Describe the solution you'd like
There must be some way to impose restrictions,
such as setting a password in the global configuration file.

Describe alternatives you've considered
Or pop up a UAC window, save the password in the Windows Credential Locker, etc.

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use .\collect-wsl-logs.ps1 -LogProfile networking instead, following the instructions in Collect WSL logs for networking issues

Once completed please upload the output files to this GitHub issue.

See Collect WSL logs (recommended method).

If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.

[inschrift-spruch-raum]

/feature

[github-actions]

Diagnostic information

Found '/feature', adding tag 'feature'

[chemwolf6922]

Hi @inschrift-spruch-raum, You could disable the auto mount behavior follow instructions here: https://learn.microsoft.com/en-us/windows/wsl/wsl-config#automount-settings.
Root permission inside WSL won't change it's access to the host drives. However, the host side user permission used to run wsl.exe will.

[inschrift-spruch-raum]

You could disable the auto mount behavior follow instructions here: https://learn.microsoft.com/en-us/windows/wsl/wsl-config#automount-settings.

Thank you for your reply. However, what I'm discussing here is not how to auto-mount, but rather the need for refined permissions for manual mounting.

Root permission inside WSL won't change it's access to the host drives. However, the host side user permission used to run wsl.exe will.

The reason I'm discussing root permissions here is: manual mounting requires root privileges.

Moreover, I also wrote later: root privileges cannot refine the permissions for manual mounting.

[chemwolf6922]

Hi @inschrift-spruch-raum , sorry for the misunderstanding. There is an existing undocumented .wslconfig option that disables drvfs mount completely:

[wsl2]
hostFileSystemAccess=false

You'll need to wsl --shutdown and restart wsl to make the changes effective.

[inschrift-spruch-raum]

It would be best if it could be completely disabled.
However, I'd also like to ask whether this would affect the Windows host's access to WSL.

[inschrift-spruch-raum]

Then, inevitably, perhaps the scenario I mentioned—"host authorizing WSL to mount disks (or requiring more granular permissions for manual mounting)"—does indeed exist. In that case, this configuration might merely be a transitional solution that fails to address the underlying issue.