Implement WSLC container group policies by benhillis · Pull Request #40466 · microsoft/WSL

benhillis · 2026-05-08T16:23:43Z

Implement WSLC container group policies

Adds enforcement for two group policies whose ADMX templates landed in #40422:

AllowWSLContainer (DWORD): master switch for wslc.exe and the WSLCSessionManager COM API. Enforced inside WSLCSessionManagerFactory so CoCreateInstance returns WSL_E_CONTAINER_DISABLED directly when the policy is off; every caller (wslc.exe, WslcSDK, plugins) fails fast through one code path rather than getting a manager whose every method errors out individually.
WSLContainerCLIRegistryAllowlist: ADMX <list valuePrefix=\"AllowedRegistry\"> policy stored as a sub-key whose REG_SZ value data is each allowed registry hostname. Enforced in PullImage and PushImage via a shared helper. BuildImage is currently rejected outright when an allowlist is configured. This will be addressed in a follow-up change.

Adds two new HRESULTs:

WSL_E_CONTAINER_DISABLED (0x33)
WSL_E_REGISTRY_BLOCKED_BY_POLICY (0x34)

Adds PolicyTests covering disabled-state, CLI surfacing, allowlist denial, build rejection, and pure-function unit tests for the allowlist evaluator.

Copilot

Pull request overview

Implements enforcement for new WSLC-related group policies across the WSLC COM service boundary and CLI, including new HRESULTs and localized user-facing error messages, plus policy-focused tests.

Changes:

Enforce AllowWSLContainer at WSLCSessionManager COM activation time so clients fail fast with WSL_E_CONTAINER_DISABLED.
Implement WSLContainerCLIRegistryAllowlist evaluation and enforce it for image pull/push; block image builds when an allowlist is configured.
Add new HRESULTs and localized messages, plus new policy tests (including pure-function allowlist evaluator tests).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/windows/PolicyTests.cpp	Adds WSLC policy tests for container disable + registry allowlist behavior, including CLI coverage and evaluator unit tests.
src/windows/wslcsession/WSLCSession.cpp	Enforces registry allowlist for Pull/Push and blocks BuildImage when allowlist is active.
src/windows/service/inc/wslservice.idl	Defines `WSL_E_CONTAINER_DISABLED` and `WSL_E_REGISTRY_BLOCKED_BY_POLICY`.
src/windows/service/exe/WSLCSessionManagerFactory.cpp	Gates COM factory creation on `AllowWSLContainer` policy.
src/windows/inc/wslpolicies.h	Adds allowlist subkey constants and helper functions to read/evaluate the registry allowlist.
src/windows/common/wslutil.cpp	Registers new HRESULTs in common error mapping and adds a localized string for `WSL_E_CONTAINER_DISABLED`.
localization/strings/en-US/Resources.resw	Adds localized strings for the new policy-related user-facing error messages.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Adds enforcement for two group policies whose ADMX templates landed in PR #40422: - AllowWSLContainer (DWORD): master switch for wslc.exe and the WSLCSessionManager COM API. Enforced inside WSLCSessionManagerFactory so CoCreateInstance returns WSL_E_CONTAINER_DISABLED directly when the policy is off; every caller (wslc.exe, WslcSDK, plugins) fails fast through one code path rather than getting a manager whose every method errors out individually. - WSLContainerRegistryAllowlist: ADMX `<list valuePrefix=\"AllowedRegistry\">` policy stored as a sub-key whose REG_SZ value data is each allowed registry hostname. Enforced in PullImage and PushImage via a shared helper. BuildImage is rejected outright when an allowlist is configured, since the in-VM docker daemon fetches FROM base images through its own pull mechanism and cannot be reliably gated per-registry. The policy is fail-open: an absent or empty sub-key is treated as no restriction, and registry I/O errors fall through to allow rather than break all container operations on a transient hiccup. Adds two new HRESULTs: - WSL_E_CONTAINER_DISABLED (0x33) - WSL_E_REGISTRY_BLOCKED_BY_POLICY (0x34) Adds PolicyTests covering disabled-state, CLI surfacing, allowlist denial, build rejection, and pure-function unit tests for the allowlist evaluator. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

dkbennett

I like blocking at the session level, though should we also have the CLI check the container disabled policy at the beginning of any execution for user friendliness? Most commands do use the session, but some don't, like "--help". IMO, it would be nice for user friendliness and to not give the illusion to the user that the CLI may be functional and when anything of value is disabled by policy.

benhillis · 2026-05-11T17:54:25Z

I like blocking at the session level, though should we also have the CLI check the container disabled policy at the beginning of any execution for user friendliness? Most commands do use the session, but some don't, like "--help". IMO, it would be nice for user friendliness and to not give the illusion to the user that the CLI may be functional and when anything of value is disabled by policy.

Yep we definitely could, I'm not against belt and suspenders, we can tweak the UX of wslc.exe in a follow-up.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

src/windows/common/wslutil.cpp:1

WSL_E_REGISTRY_BLOCKED_BY_POLICY is added to g_commonErrors, but GetErrorString does not map it to a user-friendly message. If this HRESULT ever surfaces without a user-error payload (e.g., different caller path), users may see a generic HRESULT string. Consider adding a generic localized message for this HRESULT (without requiring the registry hostname placeholder) and returning it here.

/*++

* SetRegistryAllowlist: delete the WSLContainerRegistryAllowlist sub-key before recreating it so stale AllowedRegistryN values from a previous (possibly interrupted) test run can't leak into the current test. * GetWslcExePath: avoid std::optional::value() throwing bad_optional_access; use THROW_HR_IF_MSG with a clear diagnostic when the MSI install location can't be read from the registry. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

benhillis · 2026-05-12T15:30:27Z

@OneBlue - I loaded up the .admx file and verified that this multi subkey format is correct.

OneBlue

LGTM, minor comments

OneBlue · 2026-05-13T00:05:46Z

+
+    std::wstring nameBuffer(static_cast<size_t>(maxValueNameChars) + 1, L'\0');
+    std::wstring dataBuffer(maxValueDataBytes / sizeof(wchar_t) + 1, L'\0');
+    for (DWORD index = 0;; ++index)


nit: We could simplify this a bit by using wsl::windows::common::registry::EnumValues() like PluginManager::LoadPlugins() does for instance

It might also be worth creating a helper that load everything and returns a map of name -> value

yeah I considered that, but the rest of the policies header was using raw registry apis so I kept it like that. Let me look at this in a follow-up.

OneBlue · 2026-05-13T18:57:55Z

 cpp_quote("#define WSL_E_DISTRIBUTION_NAME_NEEDED MAKE_HRESULT(SEVERITY_ERROR, FACILITY_ITF, WSL_E_BASE + 0x30) /* 0x80040330 */")
 cpp_quote("#define WSL_E_INVALID_JSON MAKE_HRESULT(SEVERITY_ERROR, FACILITY_ITF, WSL_E_BASE + 0x31) /* 0x80040331 */")
 cpp_quote("#define WSL_E_VM_CRASHED MAKE_HRESULT(SEVERITY_ERROR, FACILITY_ITF, WSL_E_BASE + 0x32) /* 0x80040332 */")
+cpp_quote("#define WSL_E_CONTAINER_DISABLED MAKE_HRESULT(SEVERITY_ERROR, FACILITY_ITF, WSL_E_BASE + 0x33) /* 0x80040333 */")


These new error codes should be added to wslcsdk.h

Good call, will address in a follow-up.

OneBlue · 2026-05-13T19:01:17Z

+        auto [stdoutText, stderrText, exitCode] = LxsstuLaunchCommandAndCaptureOutputWithResult(cmd.data(), nullptr, nullptr);
+
+        VERIFY_ARE_NOT_EQUAL(0, exitCode);
+        const std::wstring combined = stdoutText + stderrText;


nit: I'd have a preference towards validating the exact error message, and which HANDLE it was written to, so the behavior is locked in

Good call will address in a follow-up.

@OneBlue

Three items @OneBlue flagged in the merged PR were tagged "follow-up"; this change addresses all of them. 1. Refactor EnumerateRegistryAllowlist to use shared registry helpers - Add wsl::windows::common::registry::EnumStringValues(HKEY) returning a name->value map for REG_SZ/REG_EXPAND_SZ values (skipping other types). Mirrors the suggestion to centralise the EnumValues+ReadString pattern used by PluginManager::LoadPlugins. - wslpolicies.h's EnumerateRegistryAllowlist now calls EnumStringValues instead of hand-rolling RegQueryInfoKeyW + RegEnumValueW. Empty-entry filter and fail-open catch are preserved. - wslpolicies.h now explicitly includes registry.hpp instead of relying on precomp include order. 2. Surface new HRESULTs in wslcsdk.h - Declare WSL_E_CONTAINER_DISABLED and WSL_E_REGISTRY_BLOCKED_BY_POLICY in wslcsdk.h so SDK consumers can reference them by name. Definitions are guarded with #ifndef and use the exact MAKE_HRESULT replacement text from wslservice.idl, so co-existence with the generated wslservice_h.h is safe in either include order. 3. Tighten WSLContainerDisabledCli test - Validate stdoutText is empty (locks down which HANDLE the disabled message goes to). - Validate stderrText equals exactly MessageWSLContainerDisabled() + "\r\nError code: WSL_E_CONTAINER_DISABLED\r\n" using the localization helper, so the message text and the error-code mapping are both locked in. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

@OneBlue

Three items @OneBlue flagged in the merged PR were tagged "follow-up"; this change addresses all of them. 1. Refactor EnumerateRegistryAllowlist to use shared registry helpers - Add wsl::windows::common::registry::EnumStringValues(HKEY) returning a name->value map for REG_SZ/REG_EXPAND_SZ values (skipping other types). Mirrors the suggestion to centralise the EnumValues+ReadString pattern used by PluginManager::LoadPlugins. - wslpolicies.h's EnumerateRegistryAllowlist now calls EnumStringValues instead of hand-rolling RegQueryInfoKeyW + RegEnumValueW. Empty-entry filter and fail-open catch are preserved. - wslpolicies.h now explicitly includes registry.hpp instead of relying on precomp include order. 2. Reclassify the new HRESULTs as WSLC_E_* and surface them in wslcsdk.h - Move WSL_E_CONTAINER_DISABLED / WSL_E_REGISTRY_BLOCKED_BY_POLICY out of wslservice.idl and redefine them as WSLC_E_CONTAINER_DISABLED (0x8004060C) and WSLC_E_REGISTRY_BLOCKED_BY_POLICY (0x8004060D) in wslc.idl alongside the rest of the WSLC_E_* block. - Mirror the definitions in wslcsdk.h so SDK consumers can reference them by name without depending on the generated wslservice_h.h. - Update the service factory, wslcsession, wslutil error-code map, and PolicyTests to use the new names. 3. Tighten WSLContainerDisabledCli test - Validate stdoutText is empty (locks down which HANDLE the disabled message goes to). - Validate stderrText equals exactly MessageWSLContainerDisabled() + "\r\nError code: WSLC_E_CONTAINER_DISABLED\r\n" using the localization helper, so the message text and the error-code mapping are both locked in. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

@OneBlue

Three items @OneBlue flagged in the merged PR were tagged "follow-up"; this change addresses all of them. 1. Refactor EnumerateRegistryAllowlist to use shared registry helpers - Add wsl::windows::common::registry::EnumStringValues(HKEY) returning a name->value map for REG_SZ/REG_EXPAND_SZ values (skipping other types). Mirrors the suggestion to centralise the EnumValues+ReadString pattern used by PluginManager::LoadPlugins. - wslpolicies.h's EnumerateRegistryAllowlist now calls EnumStringValues instead of hand-rolling RegQueryInfoKeyW + RegEnumValueW. Empty-entry filter and fail-open catch are preserved. - wslpolicies.h now explicitly includes registry.hpp instead of relying on precomp include order. 2. Reclassify the new HRESULTs as WSLC_E_* and surface them in wslcsdk.h - Move WSL_E_CONTAINER_DISABLED / WSL_E_REGISTRY_BLOCKED_BY_POLICY out of wslservice.idl and redefine them as WSLC_E_CONTAINER_DISABLED (0x8004060C) and WSLC_E_REGISTRY_BLOCKED_BY_POLICY (0x8004060D) in wslc.idl alongside the rest of the WSLC_E_* block. - Mirror the definitions in wslcsdk.h so SDK consumers can reference them by name without depending on the generated wslservice_h.h. - Update the service factory, wslcsession, wslutil error-code map, and PolicyTests to use the new names. 3. Tighten WSLContainerDisabledCli test - Validate stdoutText is empty (locks down which HANDLE the disabled message goes to). - Validate stderrText equals exactly MessageWSLContainerDisabled() + "\r\nError code: WSLC_E_CONTAINER_DISABLED\r\n" using the localization helper, so the message text and the error-code mapping are both locked in. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

@OneBlue

* Address WSLC policy review follow-ups from #40466 Three items @OneBlue flagged in the merged PR were tagged "follow-up"; this change addresses all of them. 1. Refactor EnumerateRegistryAllowlist to use shared registry helpers - Add wsl::windows::common::registry::EnumStringValues(HKEY) returning a name->value map for REG_SZ/REG_EXPAND_SZ values (skipping other types). Mirrors the suggestion to centralise the EnumValues+ReadString pattern used by PluginManager::LoadPlugins. - wslpolicies.h's EnumerateRegistryAllowlist now calls EnumStringValues instead of hand-rolling RegQueryInfoKeyW + RegEnumValueW. Empty-entry filter and fail-open catch are preserved. - wslpolicies.h now explicitly includes registry.hpp instead of relying on precomp include order. 2. Reclassify the new HRESULTs as WSLC_E_* and surface them in wslcsdk.h - Move WSL_E_CONTAINER_DISABLED / WSL_E_REGISTRY_BLOCKED_BY_POLICY out of wslservice.idl and redefine them as WSLC_E_CONTAINER_DISABLED (0x8004060C) and WSLC_E_REGISTRY_BLOCKED_BY_POLICY (0x8004060D) in wslc.idl alongside the rest of the WSLC_E_* block. - Mirror the definitions in wslcsdk.h so SDK consumers can reference them by name without depending on the generated wslservice_h.h. - Update the service factory, wslcsession, wslutil error-code map, and PolicyTests to use the new names. 3. Tighten WSLContainerDisabledCli test - Validate stdoutText is empty (locks down which HANDLE the disabled message goes to). - Validate stderrText equals exactly MessageWSLContainerDisabled() + "\r\nError code: WSLC_E_CONTAINER_DISABLED\r\n" using the localization helper, so the message text and the error-code mapping are both locked in. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove unused CreatePoliciesKey helper from wslpolicies.h Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 8, 2026 16:23

Copilot started reviewing on behalf of benhillis May 8, 2026 16:24 View session

benhillis requested a review from craigloewen-msft May 8, 2026 16:27

Copilot AI reviewed May 8, 2026

View reviewed changes

Comment thread test/windows/PolicyTests.cpp Outdated

Comment thread src/windows/inc/wslpolicies.h Outdated

Comment thread test/windows/PolicyTests.cpp

benhillis commented May 8, 2026

View reviewed changes

Comment thread src/windows/inc/wslpolicies.h Outdated

benhillis commented May 8, 2026

View reviewed changes

Comment thread src/windows/inc/wslpolicies.h Outdated

benhillis force-pushed the user/benhill/wslc-policies branch from 08e7ed9 to cf811de Compare May 8, 2026 16:40

benhillis requested a review from Copilot May 8, 2026 16:42

Copilot started reviewing on behalf of benhillis May 8, 2026 16:43 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

Comment thread src/windows/service/exe/WSLCSessionManagerFactory.cpp Outdated

Comment thread src/windows/inc/wslpolicies.h

benhillis force-pushed the user/benhill/wslc-policies branch from cf811de to 5891de1 Compare May 8, 2026 17:31

Copilot AI review requested due to automatic review settings May 8, 2026 21:09

benhillis force-pushed the user/benhill/wslc-policies branch from 5891de1 to 753c107 Compare May 8, 2026 21:09

Copilot started reviewing on behalf of benhillis May 8, 2026 21:10 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

Comment thread src/windows/inc/wslpolicies.h

Comment thread test/windows/PolicyTests.cpp

Comment thread src/windows/wslcsession/WSLCSession.cpp

Comment thread src/windows/wslcsession/WSLCSession.cpp

benhillis force-pushed the user/benhill/wslc-policies branch from 753c107 to 8a6fcae Compare May 8, 2026 22:46

dkbennett previously approved these changes May 11, 2026

View reviewed changes

benhillis marked this pull request as ready for review May 11, 2026 17:57

Copilot AI review requested due to automatic review settings May 11, 2026 17:57

benhillis requested a review from a team as a code owner May 11, 2026 17:57

Copilot AI reviewed May 11, 2026

View reviewed changes

Comment thread test/windows/PolicyTests.cpp

Comment thread test/windows/PolicyTests.cpp

Comment thread src/windows/inc/wslpolicies.h

Comment thread src/windows/inc/wslpolicies.h

Copilot started reviewing on behalf of benhillis May 11, 2026 18:06 View session

benhillis dismissed dkbennett’s stale review via da638e3 May 11, 2026 19:52

OneBlue approved these changes May 13, 2026

View reviewed changes

benhillis merged commit aa585a2 into master May 13, 2026
11 checks passed

benhillis deleted the user/benhill/wslc-policies branch May 13, 2026 19:43

benhillis mentioned this pull request May 13, 2026

Address WSLC policy review follow-ups from #40466 #40529

Merged

Conversation

benhillis commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dkbennett left a comment

Choose a reason for hiding this comment

Uh oh!

benhillis commented May 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

benhillis commented May 12, 2026

Uh oh!

OneBlue left a comment

Choose a reason for hiding this comment

Uh oh!

OneBlue May 13, 2026

Choose a reason for hiding this comment

Uh oh!

benhillis May 13, 2026

Choose a reason for hiding this comment

Uh oh!

OneBlue May 13, 2026

Choose a reason for hiding this comment

Uh oh!

benhillis May 13, 2026

Choose a reason for hiding this comment

Uh oh!

OneBlue May 13, 2026

Choose a reason for hiding this comment

Uh oh!

benhillis May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

benhillis commented May 8, 2026 •

edited

Loading