1

Does adding a non-root user do anything except hinder your own ability to make mistakes? Given the new updates on file perms in WSL2 (docs on file perms, more docs), doing everything as root on linux might actually be more secure (maybe I'm wrong here though).

Relevant conversation on the WSL github: https://github.com/Microsoft/WSL/issues/53

Improve this question

2 Answers 2

Reset to default
1

Yes.

Imagine an attack which allows arbitrary code execution, escape to shell, etc. Would you want this attacker to have root privilege or the privileges of a user which only has access to what is needed to run the service?

For most the answer is limited privileges.

Improve this answer
2
  • Ah I wasn't thinking, thanks. The information available on how perms (on files and execution) transfer over between the windows host and WSL was a bit unclear and I was under the impression that there wouldn't be a difference between, for example, popping a shell from a root vs user account. But I can see how arbitrary code execution within the environment has potential to do damage in much the same way as on a native Linux install
    – belkarx
    Commented Mar 10, 2022 at 0:30
  • I think WSL does not actually protect against this type of attack, as long as the attacker has access to a Windows shell. You can become root with the wsl command with the -u option. And you can run cmd.exe or powershell.exe from within WSL, too. I'm not sure if a nested wsl command would work, though. Limiting privileges is still a good protection against more simplistic threats.
    – Kevin Keane
    Commented Aug 26, 2023 at 18:39
0

As @foreverska already said, running things as root unnecessarily is not a great idea.

WSL is a bit special here, though, because you can easily become root without any password at all, directly from Windows (the -u root option to the wsl command will do that).

So the protection root offers in WSL is actually fairly limited (there still are security benefits, just not as robust as in bare-metal Linux).

The main reason for this setup is that WSL uses (slightly modified) standard Linux distributions. When the underlying distribution segregates root (and they all do), you want to replicate this setup to avoid unexpected behavior differences.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .