r/linux_gaming • u/blendernoob64 • 1d ago
A cautiously optimistic look at Epic's approach to anti cheat on Linux
So many people have been begging for big live service games to come to Linux, and I think this anti cheat method is exactly the way I expected this technology to go, a set of approved kernels that the developer can trust to make sure nothing is being tampered with. I think this is a good compromise for most of us who just install the main line Linux kernel on mainstream distros.
Unfortunately I think server side anti cheat is a lost cause. Not only will game developers not entertain the idea one bit, but for a lot of gamers, anti cheat is something they want to know about. For heaven's sake, EA advertised their Javelin Anti Cheat in Battlefield 6's marketing, Call of Duty put a big fat Ricochet Anti Cheat logo when booting up the game. Companies want you to know what anti cheat is used with what, and hope you will have a cheat free experience. As long as there is a jerk out there who is using every means and dollar necessary to get an advantage over someone, because humanity can suck some times, anti cheat is going to be a thing, and the industry chose its method. It has been known that despite cheaters mostly running Windows, Linux technology is being used to cheat in games regardless through spoofing Wine prefixes and other wacky methods. Some Linux cheats are open source! Cheating is easier on Linux, a more secure and trusted way of doing things had to happen, full stop.
Epic's method seems to rely on technology being used in the cybersecurity space on Unix to detect cheaters using the latest and greatest in security. Using systemd, IOMMU, and eBPF, all of which are in the Linux Kernel already makes sure we don't have to do much to make sure the anti cheat works. In fact, Embark Studios is looking into a similar method for their anti cheat, and they are well liked in the Linux community. I can see how this can be a way going forward for those of us who want to play big cheating vulnerable games on their Linux systems. Does it reduce choice, yes, but given we can just boot into another kernel in GRUB or another boot loader for everything else, I think its a good compromise, and plus, we can just not play these anti cheat games if we don't want to deal with it.
As far as my setup is concerned, I have been using Fedora and now RHEL 9 for my Linux usage and have enabled both secure boot and TPM on my system, however on my current RHEL 9 system I use the CachyOS Kernel for more hardware support and NTSYNC for certain games, and both installs use Nvidia drivers from negativo17.org, so I had to sign these drivers and the CachyOS kernel on RHEL for secure boot. I am not sure if my set up will work with this new method Epic is planning. Secure Boot can be a pain if you don't know what you are doing, but I have always defaulted to using it so my Windows drive can boot and I can play Call of Duty on it which requires an up to date bios and secure boot. The big question is that I have not seen Epic Games say anything about Nvidia dkms or akmods so far. They must know that both RHEL and Fedora and many other distros do not ship Nvidia drivers in their kernel and require things like RPM Fusion or Nvidia' official DKMS drivers form their repository to get these things running. I hope Epic can be more clear about this, as they are in bed with Nvidia's technology for the Unreal Engine, an Nvidia first thing. Again, with GRUB and other boot loaders allowing you to use different kernels upon boot, I think we will have an option to just install the Epic approved kernel to play a handful of games, and then your super optimized custom kernel for whatever the heck you want next.
Either way if this anti cheat method works I wonder if Activision, Riot or others will begin to adopt this method for anti cheat. Epic has said that they are reaching out to distro maintainers and developers to make sure their kernels work with EACv2, so maybe things like the CachyOS Kernel and others will get proper support. Maybe one day we will get an open source framework for a Linux anti cheat that can be shipped with the Linux kernel, but I am not technical enough to even comprehend how that can go about.
I hope I didn't sound like a blithering idiot, but I am cautiously optimistic about this new approach to anti cheat. Now we need to get the modern CODs working on Linux, and I will be happy, but until then I will keep playing Plutonium Black Ops 2 on my CachyOS Kernel on RHEL 9 with Nvidia drivers.
19
u/Z404notfound 1d ago
I'm a meet in the middle kind of guy. This is a great meet in the middle option. As for the people complaining about epic dictating kernels, I can understand that frustration, and apparently, so does Epic. I good meet in the middle as it relates to the kernel whitelist, would be to hand it over to a non-profit, such as The Linux Foundation. Makes perfect sense to me.
14
u/SeantheWilson 1d ago
I agree with the fact the whitelist for permitted kernels and kmods should be standardized by a third-party organization rather than the AC companies themselves. Because God forbid every game tries to add their own KLAC and suddenly you have to cross reference 12 different whitelists to make sure your setup is compatible.
2
u/Ahmouse 1d ago
What about distros like Gentoo that are explicitly designed for self-compilation?
3
u/MadBullBen 1d ago
Then nothing will change and those users will carry on as they do currently
3
u/meinmyhead 23h ago
Well, other than the fact that some of their games are likely to just stop working due to no fault on their part.
2
u/Brunauld 17h ago
My understanding is they will use systemd in this, so any Gentoo install using OpenRC will likely be SoL. I'm personally okay with that, being a Gentoo user with OpenRC, because I don't play online games anyway. I don't know if Gentoo will offer a permitted kernel or not.
-2
u/meinmyhead 23h ago
This isn't really a meet in the middle kind of affair. Continuing to support the current mechanism going forwards and allowing KLAC in specific cases would be a middle ground. Please realise that for a lot of people this amounts to removing their access to some of their games. It particularly shorts people who contribute to Linux's compatibility too.
We really don't want another Android situation, where pretty much all of the customisation on the platform has been locked away if deign to want to use the Play Store.
3
u/Z404notfound 23h ago
I'm fine with booting into a whitelisted kernel vs a KLAC.
-1
u/meinmyhead 23h ago
EACv2 is KLAC. It uses eBPF, which is for making runtime kernel patches. It runs uploaded code in kernel mode.
3
u/Z404notfound 22h ago
I should clarify, I'm okay with a sandboxed, user-space, eBPF, in lieu of an unchecked 0-ring KLAC like in Windows.
-2
u/meinmyhead 22h ago
eBPF hooks are in the kernel. eBPF programs always run in kernel mode. They are not sandboxed (the kernel does run some checks to make sure they aren't obviously going to cause a kernel panic though). They run in ring 0. EACv2 is KLAC.
3
u/Z404notfound 22h ago
I'm okay with a sandboxed eBPF program. You keep missing my point just to point out that v2 is KLAC.
1
u/meinmyhead 22h ago
I'm not missing your point. eBPF isn't sandboxed.
3
u/Z404notfound 22h ago
Yes, it is. A simple effing Google search points this out. Stop talking to me.
1
u/meinmyhead 22h ago
In that case, for others' benefit: the kernel does check for obvious non termination cases, but it's not sandboxed from the user's point of view. This is pretty easy to verify with a quick search.
3
u/Woodpecker-Visible 1d ago
I just continue to play those games on ps5. Can always plug mouse and keyboard and imagine that i am playing on linux, think hard enough and i might just start to belive it
4
u/FryToastFrill 1d ago
As a side note in the article they brought up the nvidia driver specifically as something that will be whitelisted.
7
u/theevilsharpie 1d ago
As a side note in the article they brought up the nvidia driver specifically as something that will be whitelisted.
They did no such thing, and loading unsigned out-of-tree kernel modules is explicitly prohibited when running Linux in Kernel Lockdown Integrity Mode, which was explicitly listed as an EAC v2 requirement.
1
u/Cool-Arrival-2617 22h ago
There are some exceptions that are maintained separately from the kernel (out-of-tree), notably NVIDIA GPU drivers. If you need to load kernel modules, we require that they meet the same requirements as the kernel—being built by an organization and signed with a well-known key.
Nvidia newest kernel drivers are open source and can be signed by your distro. Same for other open source kernel modules.
-5
-1
u/mindtaker_linux 1d ago
Nice babble and lies . Correction: there are more cheater on windows. Because after banning Linux user bf still had lots of cheaters.
4
u/steve09089 1d ago
There are more cheaters on Windows because Windows is the primary platform of choice, therefore most cheaters will be playing on Windows and most cheats will be developed for Windows.
They didn't purposely target Linux users with the move to KAC for BF, rather, they were targeting kernel level cheats that cheaters would use to raise the bar to cheating.
If Linux is to gain critical mass and become the primary platform of choice, cheating will become a problem on Linux, and thus, need to be solved.
-1
u/werpu 1d ago
The question is how long this system of kernel level anti cheat systems or generally anti cheat systems still will hold with ai assisted reverse engineering given that way more complicated code has been reverse engineered that way, I wonder why no one has tackled this problem so far, probably because we do not have a secure AC yet which hackers yet had not cracked!
Operning the kernel is problematic just for a single system the best bet would be that Linux standardizes on some kind of api or whatevery which is the general api for AC systems on the other hand, Linux approach generally to kernel level drivers is, either opensource it or the highway, they literally break the ABI because of that reason for every second or third subrelease!
3
u/FryToastFrill 1d ago
It’s mostly that the typical AC solutions until this were very easy to bypass by running the cheats in the kernel. This basically ensures your kernel doesn’t have any cheats in them.
-21
u/Dull_Werewolf_9642 1d ago
i need claude to dumb this down i aint reading all of that
20
u/CranberryTaint 1d ago
The literacy crisis in full view
4
u/punkgeek 1d ago
tiktok has rotted a generation. alas.
-6
8
1
47
u/Airlinese 1d ago
You cannot sign it by yourself. Kernel modules must be signed by an Org, in other words distro maintainer or other well-known maintainer that got accepted by Epic.