search

microsoft / WSL

Issues found on WSL
https://docs.microsoft.com/windows/wsl
MIT License
17.46k stars 821 forks source link

OS Deployment fails due to permissions on lxss files #1636

Open rcpadrick opened 7 years ago

rcpadrick commented 7 years ago

I am attempting to develop a solution in which I can deploy Windows 10 with WSL installed and configured with pre-defined apps. I created a Windows image with WSL installed and Firefox loaded inside it. Tests in the VM were successful. After I sysprep the VM and prepare it for deployment via SCCM, the task sequence fails on the applying image step with the following error:

C:\Users\Administrator\AppData\Local\lxss\rootfs\lib\xtables\libip6t_HL.so. Permissions on the requested may be configured incorrectly. Access is denied. (Error: 80070005; Source: Windows)

When I changed the permissions on that file (to 777) and went through the whole process again, it failed again on another file. My guess is that there are a ton of files that will give me problems.

Ultimately, I need to be able to deploy a Windows 10 image with WSL installed with pre-installed apps that is in the default profile so all new users will get the setup ready to go. Assistance is appreciated.

Steps Taken

  1. Create Hyper-V VM (configuration 8) with 8GB RAM (dedicated) AND 80gb drive space
  2. Installed Windows 10 1607 from Microsoft ISO
  3. Installed all updates to OS
  4. Installed Developer Features
  5. Installed Windows Subsystem for Linux
  6. Setup BASH
  7. Used apt-get to install Firefox
  8. Installed Xming
  9. Tested Firefox opening in Xming Window
  10. Restarted and made Hyper-V checkpoint
  11. Ran sysprep from inside Windows with Generalize and Shutdown options set
  12. Upon completion, booted to DVD with WinPE ISO attached
  13. Opened command prompt and performed a dism command: Dism /Capture-Image /ImageFile:N:\BASHTEST.wim /CaptureDir:C:\ /Compress:fast /CheckIntegrity /Name:"BASHTEST" /Description:"BASH for Windows TEST"
  14. When completed, created Operating System Image in SCCM from wim
  15. Distributed OS Image
  16. Created Task Sequence to deploy image (attached)
  17. Deployed image to Dell Optiplex 7020 with 8GB RAM and 250GB HDD, Intel i7 CPU
  18. Deployment completes image download and fails on Applying Image step. Error: WIM error:C:\Users\Administrator\AppData\Local\lxss\rootfs\lib\xtables\libip6t_HL.so. Permissions on the requested may be configured incorrectly. Access is denied. (Error: 80070005; Source: Windows)
  19. Rebooted into WinPE and gathered smsts.log (attached)

Details Windows Build: 14393.693 Ubuntu Build: 14.04.5 LTS

BASHTEST_TS.zip

smsts.txt

sunilmut commented 7 years ago

@rcpadrick - Thanks for your post. It looks like a cool scenario to enable. But, unfortunately, due to some limitations around case sensitivity (with filenames) while taking the snapshot, this scenario is not yet supported. This is a known issue and something we are fully aware of. We want to support this, but this won't make it for the Creators Update release, unfortunately.

rcpadrick commented 7 years ago

Do you have any ideas/methods to make a customized WSL available to all users? I've tried copying the lxss folder in both Windows and Linux, and neither seemed to work. As soon as I launched BASH in another user's profile, it asked to be setup.

bitcrazed commented 7 years ago

@rcpadrick: Also:

One thing to note here is that Ubuntu instances are downloaded/unpacked & configured on a per-user basis but when you sysprep an image, all user accounts, folders & files are removed.

Thus, you should probably omit step 6-9 - these steps should be carried out after the sysprepped image has been deployed onto a target machine, by the end-user.

benhillis commented 7 years ago

There isn't an officially "supported solution" but this should work:

  1. Copy your entire %localappdata%\lxss directory on your old computer to a backup NTFS drive.
  2. Install WSL on your new machine (lxrun /install /y).
  3. Delete the %localappdata%\lxss directory on your new machine.
  4. Copy your saved lxss directory to %localappdata%\lxss
  5. run lxrun.exe /setdefaultuser oldusername
  6. Launch bash.
rcpadrick commented 7 years ago

In our unattend file, we specify a profile to be copied as the default. It was my hope that by setting up WSL on that profile before sysprep, that would carry over to the default profile, and thus to all new users. This is how the vast majority of applications work -- although I know Windows Store Apps do not work this way.

Ultimately, I am looking for a way to deploy a customized WSL/Ubuntu with installed apps for any user on the machine. Whether that occurs when I create the image or if it can be done after image is applied on the device does not matter.

Any ideas on how to accomplish this? Perhaps the product is still too young to do it.

bitcrazed commented 7 years ago

Another thing to consider is that if you snapshot a particular distro now, then it'll fall behind in terms of pre-applied updates: Note that Canonical are going to be updating their distro's approx' once per quarter so it likely makes sense to NOT snapshot any given distro, but install when the user first runs the Bash.

It may be worth putting a link on your user's desktops which, when opened, calls bash.exe -c setup.sh (or similar) which, after the latest distro is installed via Bash setup, automates the installation of whatever Linux tools you want via apt, after which, the user should be up and ready to go.

fpqc commented 7 years ago

@benhillis Pretty sure that won't work without using robocopy with some special flags rather than the copy in Windows explorer (unless something has changed), at least it didn't in the past.

benhillis commented 7 years ago

@fpqc - Copy in explorer should maintain extended attributes as long as you don't move it a filesystem type that doesn't support them.

fpqc commented 7 years ago

@benhillis That's so strange that it works now. Maybe I was doing something different before, like copying with cp inside of to drvfs, then copying back to %localappdata%\lxss. That's great then!

rcpadrick commented 7 years ago

@benhillis Those steps worked, thank you. However, in practical terms, this is not an efficient method of deployment. The installation of WSL and the copy of 1GB (at least) of data to the profile made BASH unavailable for nearly 10 minutes on the machine. In a classroom environment where we only have 50 minutes, that's too much time.

It seems to me the only way to make this a viable solution for deployment on machines with multiple users is to move the lxss install location to a non-user directory. Even if we could get the entire lxss folder available in the default profile, the copy of more than 1GB of data to every new profile would make login times jump through the roof -- and Windows 10 new user logins are already painful.

I think I may try to create a specific local user with the customizations I need and then sysprep, capture, and image a machine that way. I'll let you know how that goes.

For now, dual booting seems the best solution, though I absolutely see this product replacing that eventually. If you have any other ideas or suggestions, please let me know as I want to avoid dual-booting like the plague.

In the meantime, please keep up the fantastic work. I will be watching this product closely!

bitcrazed commented 7 years ago

@rcpadrick The Bash/WSL root folders and files aren't stored in roaming profiles so should have no impact on login times; they're stored in %localappdata%\lxss .

But, yes, each user gets their own copy of Ubuntu and whatever else they decide to install on top. But then, this is pretty much the same if you wanted to use VM's or Containers.

rcpadrick commented 7 years ago

@bitcrazed They will have effect on login times because if they are included in the local Default Profile (the folder from which new profiles are created), the more data is in there, the longer it takes to copy during login. We don't use roaming profiles (not sure many orgs do anymore).

benhillis commented 7 years ago

@rcpadrick - I agree it isn't a great solution.  For a little more context on this: The issue isn't coming from WSL but from is a larger issue with how NT handles case-sensitive files. Windows has a long way to go in this area and we in the WSL team are trying to push the needle in the right direction.

rcpadrick commented 7 years ago

@benhillis Understood. Well, count me onboard for any future testing. Let me know if there's anything I can do to assist.

KptnKMan commented 7 years ago

@benhillis I followed your instructions exactly, but I get the following error when I set my default user: Error: 0x8007001f

I'm trying to migrate my lxss installation to a new system, fully updated as old system.

Any idea how I can get around this?

imakiro commented 7 years ago

Trying to deploy and mount a DISM image where Lxss is present result in a systematic failure,

2017-03-16 08:40:52, Info DISM API: PID=3308 TID=3424 DismApi.dll: - DismShutdownInternal [980] [0x80070005] RestoreFileNodeList:(2136): Access is denied. [980] [0xc144012e] 2017-03-16 08:41:50, Error DISM DISM WIM Provider: PID=980 E:\WinWin\Users\XXXXXXXX\AppData\Local\lxss\rootfs\usr\share\perl\5.18.2\Pod\Checker.pm (HRESULT=0x80070005) - CWimManager::WimProviderMsgLogCallback

DanielW10001 commented 5 years ago
DanielW10001 commented 5 years ago

Ran into the same situation here. I made a wim image with WSL inside as a back up. However, I get Error.5: Access Denied while proccessing WSL related file when try to apply the image.

Update:

Next, I will try the method described at this post

DanielW10001 commented 5 years ago

Ran into the same situation here. I made a wim image with WSL inside as a back up. However, I get Error.5: Access Denied while proccessing WSL related file when try to apply the image.

Update:

  • Confirm that /EA does not work
  • Try to remove WSL files from wim image with wimlib-imagex update delete, yet run into "Ignoring children of non-directory file" warnings. Next, I will try the method described at this post

Update:

Hope this can be helpful for someone who is as upset as myself.😀

DanielW10001 commented 5 years ago

Ran into the same situation here. I made a wim image with WSL inside as a back up. However, I get Error.5: Access Denied while proccessing WSL related file when try to apply the image.

Update:

  • Confirm that /EA does not work
  • Try to remove WSL files from wim image with wimlib-imagex update delete, yet run into "Ignoring children of non-directory file" warnings. Next, I will try the method described at this post

Update:

  • Did not found the exact way in post
  • Workaround: Continue with warrnings and restore ignored files manually after image apply

Update:

Biswa96 commented 5 years ago

You can export the installed distribution in a tarball with wsl.exe --export command and install it another machine with wsl.exe --import command.