UGOW v0.1.0-beta

Unix Grant Overlay for Windows drives in WSL2

First public beta — per-user write control for /mnt/c, /mnt/d, and beyond.

What's included

FUSE backend (stable)

• Overlay-based enforcement via userspace FUSE mount
• Full W-bit gating: open, create, truncate, mkdir, unlink, rmdir, rename, symlink, link
• Permission inheritance — a grant on a directory covers all descendants
• Multi-drive support (C:, D:, E:, ...)
• Optional NTFS ACL mirroring via PowerShell/icacls

BPF LSM backend (beta)

• Kernel-level enforcement via eBPF on stock WSL2 6.6+ kernels
• Near-zero overhead, full bypass resistance
• Some minor bugs still being worked out

Kernel module backend (experimental)

• Source included but not yet tested against a real WSL2 kernel build
• Requires custom kernel compilation — not recommended for use yet

Unified CLI

• ugow allow, deny, check, status, list
• Works the same across all backends
• Auto-detects active backend

Installer

• One-command setup via ./setup.sh
• --mode fuse (default) or --mode bpf

Requirements

• WSL2 on Windows 10/11
• Ubuntu (or compatible distro) inside WSL2
• For BPF mode: WSL2 kernel 6.6+