How to prevent access to WSL1/2 distributions in Windows 10/11

[JeongJaecheol]

I don't want access to the WSL1/2 distribution other than deleting it from Windows 10/11. (For example, changing the root account password of the distribution, accessing the distribution directory, etc.)
For these, are the 3 methods below possible?

1. Always request login when accessing distribution shell from Windows terminal, etc.
2. wsl2's vhdx file encrytion
3. Block access to \wsl$ in File Explorer or require distribution login or password.

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The scipt will output the path of the log file once done.

Once completed please upload the output files to this Github issue.

Click here for more info on logging
If you choose to email these logs instead of attaching to the bug, please send them to [email protected] with the number of the github issue in the subject, and in the message a link to your comment in the github issue and reply with '/emailed-logs'.

[JeongJaecheol]

/question 2024년 4월 12일 (금) 19:53, github-actions[bot] ***@***.***>님이 작성:

…

Logs are required for review from WSL team If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'. *Otherwise please attach logs by following the instructions below*, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine. How to collect WSL logs Download and execute collect-wsl-logs.ps1 <https://github.com/Microsoft/WSL/blob/master/diagnostics/collect-wsl-logs.ps1> in an *administrative powershell prompt*: Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1 Set-ExecutionPolicy Bypass -Scope Process -Force .\collect-wsl-logs.ps1 The scipt will output the path of the log file once done. Once completed please upload the output files to this Github issue. Click here for more info on logging <https://github.com/microsoft/WSL/blob/master/CONTRIBUTING.md#8-collect-wsl-logs-recommended-method> If you choose to email these logs instead of attaching to the bug, please send them to ***@***.*** with the number of the github issue in the subject, and in the message a link to your comment in the github issue and reply with '/emailed-logs'. — Reply to this email directly, view it on GitHub <#11455 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AF5EVMQDCPTTV272K3QKV2LY464LDAVCNFSM6AAAAABGD5PGDKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANJRGUZTANZUHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[github-actions]

Diagnostic information

Found '/question', adding tag 'question'
Found '/feature', adding tag 'feature'
Found '/emailed-logs', adding tag 'emailed-logs'

[OneBlue]

@JeongJaecheol: This is unfortunately impossible by design. Even if let's say WSL added a form of password protection, the place where the distribution files are themselves stored is accessible to the user (Either %appdata%\Local\lxss for WSL1, or ext4.vhdx for WSL2).

If you want additional protection for your linux distribution, the easiest way would be to have a dedicated Windows account that would own the distributions, and then elevate / switch to that account when you want to access WSL.