Hi folks

Beware system admins with WSL !!!

Just removing the view from file explorer really doesn't achieve much BTW.

Anybody once the WSL for Linux subsystem is installed can set themselves up as root (sudo) and this is independent of the user account they have on Windows.

Now with a little bit of trickery one can add a lot of Linux GUI desktop tools to the WSL (you need to install an X-Server that runs on Windows (VcXsrv or XMming -- I prefer VcXsrv though) and then install samba --- now you can access any HDD on the local windows system whatever your privilege level (that's a security loophole that needs to be fixed) or even across the network -- although shared HDD's on a network will need proper privilege level for read / write.

It's really easily done -- I was utterly surprised that it actually worked -- the only difficulty I encountered was in configuring the X-server. Admins ought to be aware of what one can do with WSL --it's hideously more powerful than one might have supposed.

Here's access to Local C drive and entire network via SAMBA from WSL using Dolphin (a Linux Windowed file manager -- nautilus or any other one could be used as well).




here's getting a GUI on WSL


Attachment 224980

Cheers
jimbo

If you truly want to be secure your just going to have* to implement a proper mechanism that is compatible with windows Active Directory, EG Novel Networks or something. Eww I know. But they have* been doing it for Unix since windows 3.1.

SLES SUSE has a solution that may work, its been a few years since I tried that solution, but it should offer Administrator lockout on windows local machines over a domain, and Linux subsystems connected to a domain.

Thats just the software solution, I dont know the whole WSL story and how its accessed from windows. If there is an insecure method of accessing it from the command line eg wsl -u root, is allowed then, "All Bets Off".

hmmm. seems adding that key doesnt add linux to the navigation pane on a pre 196xx build (19041). however adding the key to remove does hide it on a 196xx build where it already exists by default

Brink said:

Hello mate,

Linux can only be added to the navigation pane in File Explorer if you enabled Windows Subsystem for Linux (WSL).

Did you already have WSL enabled?

Yes. It’s enabled on all 4 systems I have. The two on 196xx I can disable with the above reg key. (And re add by modifying the dword or removing the key altogether)

those on 19041 adding the clsid via the reg key does nothing. Searching for that clsid comes up empty, yet I can open wsl just fine via bash/ubuntu as I use it fairly regularly.

im guessing something must have changed in preparation for baking it in perhaps?

i feel like I pester you a lot.

huh, i literally just checked both my main pc's (19041) and they dont have those keys, yet have WSL enabled and working.

I checked my 196xx pc's and they DO have those keys (and the nav pane item by default)

are we.... sure that older builds are supposed to have those and thats not added with the newer insider builds?

if so can we hypothesize as to how I have wsl installed and working, yet dont have those? I have been using these installs for awhile, is it possible i perhaps enabled wsl before those keys were added/used or something?

would the proper course of action be to merge the above then? even on 19041? wish i had a clean older build to check myself unfortunately i dont, so gonna have to "in-brink-we-trust" it :P

Brink said:

Interesting. It should be there by default even in that build unless something has changed.

You could try creating a .reg file with the above and merge it as a test to see if it may add Linux to the navigation pane. If not, you can just delete the key to remove/undo it.

Sorry, was away cutting the grass. fun!

so if that key is there by default, even in the older builds - what is stopping it from appearing in the navigation pane by default until 196xx?

is the only thing microsoft "switched" on, the modification of the IsPinned dword? o.O