I’ve just recently become aware of Multipass and made a few attempts to use it on a Windows test machine.
I have a few problems and questions revolving around the required permissions for installing and using Multipass.
For instructions demonstrating
- Why does Multipass run as admin? Do
sshfs_server.exehave to run as
multipassd.exe basically performs the various
multipass.exe commands (
exec, etc.). All of them can be performed as a non-admin. I don’t know about VirtualBox, but I can do all those things with Hyper-V from a non-admin account as long as I’m a member of
Hyper-V Administrators, which I am.
I don’t run as admin things that don’t have to run as admin.
This is a major issue for me and a major reason that prevents me from using Multipass outside of the test machine, even before comparing features in Multipass and alternatives.
Note: I’m not saying that there’s no reason to exploit Hyper-V to get admin privileges from being a member of
Hyper-V Administrators. I honestly don’t know. But it obviously doesn’t matter.
There’s a difference between the ability of malicious code to use the
Hyper-V Administrators permissions to do bad things and being a standard admin/SYSTEM that can completely mess up my system by mistake.
If I trust Multipass to not be malicious and not try to get system control from being a member of
Hyper-V Administrators, it doesn’t mean that I trust Multipass not to have bugs that can cause harm to my machine by accident, when everything runs as
There are already examples of this today: Putting Multipass’ data in
C:\Windows\System32\config for starters. You’re not Windows developer so you don’t know how wrong it is to put your stuff in there. Fine. But without admin rights you wouldn’t be able to do that nonsense in the first place.
The same problems happens with mounts: Since
sshfs_server.exe runs as
NT AUTHORITY\SYSTEM it’s too easy to mount a privileged directory into the guest and corrupt it from within. There’s no reason for that either.
The principle of least privlege is important not only for security but also for stability and safety.
- Why does installing Mutipass require admin permissions?
Let’s ignore the previous issue and say Multipass has to run as admin. Why does the installer has to run as admin?
There are countless programs that really need admin permissions to run, but still provide binaries in ZIP files etc. The installer adds the stuff in
HKLM\SYSTEM\CurrentControlSet\Services\Multipass? That’s the big deal? I’ll do it myself, and if you want so much to save me the time give me PowerShell script that does that.
Docker is actually a very good candidate for comparison. It’s the same kind of tool, but I cant download a Docker ZIP and “install” it using a tiny PowerShell script from Mirantis, or even do everything myself, since it’s so simple.
Why can’t I do that with Multipass?
- There’s still no way to build Multipass for Windows.
Even if I were inclined to fix all of that myself, there’s still now way to do it.
A GitHub issue from April 2020 (#1465) was closed with:
the macOS and Windows parts of Multipass are currently closed source, the lack of build instructions is the result of that.
And basically the same on May 2021 (#2087):
I’m afraid those bits are currently closed source.
I’ll dupe this to #1851.
But #1851 itself, titled “Add README message indicating that windows and Mac are unbuildable due to closed source components” is still open and we’re left to wonder what are those components.
While searching for information I came across this message regarding macOS:
The reason why we currently require admin privileges is that through Multipass you can circumvent file permissions (because you can mount arbitrary paths from the host into the instance).
Multipass itself, generally, needs to run with admin privileges to be able to use the hardware features.
As it stands, there’s no reliable way for Multipass to know what your user has access to, and what should be prevented.
Long-term we have some ideas on how to work around that:
- the socket will be world-accessible, but you’ll need an access token
- “server side” mounts will become privileged
- we’ll introduce “client side” mounts, where the source side of the mount runs with your user’s privileges
- for VM drivers that don’t require admin privileges, we’re thinking of introducing a “user” instance of Multipass
Even if that’s true for macOS it’s not for Windows. A simple way to realize this is to Frankenstein a Multipass installation the following way:
- Install Multipass the usual way. I used
multipass-1.8.0+win-win64.exeon Windows 10 Enterprise 21H1 (19043.1348).
C:\Foo(which is accessible by all users).
- Create a standard, non-admin, user and add it to the
- Give that user full control over
C:\Windows\System32\config\systemprofileand all it’s subitems. That’s because even with
multipassd.confin there and expects it to be writable. Maybe other stuff too.
- Change the Multipass service to run as that user instead of as
- Restart the Multipass service.
Everything mostly works with Multipass (both
sshfs_server.exe) running as non-admin.
mount work. Yes, mount works as non-admin. If I try to mount a folder that the non-admin Windows user doesn’t have access to I get an error:
PS C:\Users\AdminUser> multipass.exe mount .\AppData\Local\ primary:/mnt/foo
mount failed: source "C:/Users/AdminUser/AppData/Local" does not exist
Not the best error message, but certainly better than having complete access to everything.
if I mount
System32 it works, but respect permissions in the sense that the guest can only read but not write to the mount (since
sshfs_server.exe on the host can’t write there).
This is how it’s supposed to work.
There is a small issue with the
start command. When installing a new image using
launch is start automatically, but starting a stopped image gives a silly error:
PS C:\> multipass.exe start primary
start failed: Cannot determine if Hyper-V is available on this system.
PS C:\> Start-VM -Name primary
PS C:\> multipass.exe info primary
info failed: ssh connection failed: 'Timeout connecting to primary.mshome.net'
PS C:\> multipass.exe info primary
Release: Ubuntu 20.04.3 LTS
Image hash: 939be728cbc7 (Ubuntu 20.04 LTS)
Load: 0.88 0.22 0.07
Disk usage: 1.3G out of 4.7G
Memory usage: 150.9M out of 916.9M
PS C:\> multipass.exe shell primary
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-90-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Wed Nov 10 23:52:54 GMT 2021
System load: 0.68 Processes: 116
Usage of /: 27.7% of 4.67GB Users logged in: 0
Memory usage: 21% IPv4 address for eth0: 172.31.183.15
Swap usage: 0%
1 update can be applied immediately.
To see these additional updates run: apt list --upgradable
Last login: Wed Nov 10 23:11:01 2021 from 172.31.176.1
This would be trivial to fix. I’d love to tell you where the problematic check is, but your sources are secret so I can’t do that.
In summary, Multipass is an interesting project and I’d love to have alternatives to WSL2, but as it stand today it’s not a viable alternative on Windows.
The behavior on Windows is subpar, the hogging of unnecessary and dangerous permissions is completely unjustified, the distribution method is hostile to power users, and the project isn’t even open source so I can’t fix any of those issues.
I may be interested in using Multipass in a future where these issue are resolved.
If you’d like technical assistance regarding specific issues with your top secret source code you may contact me privately and we’ll if I am able to help.