r/NixOS • u/Academic_Swan8609 • 12h ago
Easy Anti-Cheat v2 will require a signed kernel, signed kernel modules, and secure boot with attestation. What does that look like for NixOS?
https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v234
4
u/eikenberry 7h ago
So you will need a separate install or a dedicated box for games using this. Running proprietary kernel modules make the system untrustworthy for anything else.
6
u/Leseratte10 5h ago
EAC isn't running proprietary kernel modules. They just say that IF you want to use your own modules they need to be signed.
2
u/duckofdeath87 3h ago
Can I compile and then sign it myself?
4
u/Leseratte10 3h ago
No, the modules need to be signed with a trusted key on the list that they posted, so, they need to be signed by the distribution. If they'd allow everyone to sign and load their own kernel modules you could again just load cheats into the kernel.
3
u/Krutonium 2h ago
So in other words you're fucked if you also have any kind of custom hardware or need, for example, a kernel module to control your fans. Or own an nVidia GPU. Yeah no fuck that.
1
u/duckofdeath87 2h ago
Then it's not "they need to be signed" it's "they need to be on an approved list"
17
u/Capetoider 9h ago
The ideal solution for a cheat-free gaming environment is one where the operating system provides assurances to players that their data remains isolated from both anticheat and game companies while also ensuring that the gameplay cannot be tampered with.
NO. its server side anti cheat. use fucking AI at slices of game data stream, a fine tuned decision model can "watch" a little here, a little there and not even real time. then if someone reports someone, then turn on the heat on there.
9
u/Chouris_ 11h ago
lanzaboote is the solution right ?
10
u/Upstairs-Category571 11h ago
Lanzaboote uses custom keys for secure boot. Some anti-cheat systems only work with legitimate Microsoft keys, at least that’s what I’ve heard.
-7
u/Chouris_ 11h ago
idk, i've been using lanzaboote for about 3 months and i play valorant and faceit without issues
6
u/adamkex 11h ago
I feel pretty stupid asking this but how is this possible if the anti-cheat software doesn't exist on Linux? It just runs with Proton?
3
u/Chouris_ 10h ago
Sorry, I thought it went without saying, but both of these systems work a treat in a dual-boot setup with Windows and NixOS. I use Lanzaboote so I don’t have to manually re-enable Secure Boot every time I boot into Windows, and then disable it when I want to use Linux.
1
1
u/ElvishJerricco 9h ago
Epic's announcement does specifically say they will use the TPM2 to authenticate that the system is running a kernel signed by a key that they (Epic) trust. You're able to play anti-cheat games on Windows because they don't use this level of boot security scrutiny on Windows. In principle the boot loader you're signing with lanzaboote could completely bypass their anti-cheat.
11
3
u/BedroomHistorical575 9h ago
I think the biggest barrier here is that NixOS doesn't sign its kernel with their own CA. Tbh, I'm not sure if that's even possible, since the signing process must happen outside the Nix build process.
I guess in the mean time NixOS users can install kernels from other distros?
Maybe in the future NixOS can publish official pre-built pre-signed kernels that the users can opt-in to.
1
1
15
u/EarlMarshal 9h ago
Well nope. I let nobody touch my kernel.
13
u/Azazel_Rebirth 9h ago
Is that not the whole point? They're signing the kernel, not changing it
8
u/EarlMarshal 8h ago edited 8h ago
You know there are some people using Linux because of the freedom it brings. Being able to compile everything yourself is one of the basic principles of this. Having to have signed kernels by someone else destroys this. And all of this just because some game developers/publishers aren't able to get a hold on hackers, because their software sucks. They sell it to you as a problem of security and the solution is to have trust someone, but it's a problem they have created. I don't have a problem playing world of tanks for example. World of tanks also doesn't have a problems with hackers. It's because they designed their game so that a hacker cannot get information he should not have at that point in time. Fuck Epic. Fuck Anti-Cheat. Fuck secure boot. Fuck TPM. Just stop trying to sell fake expensive trust where none should be given.
2
u/LiPo_Nemo 1h ago
Nobody is forcing anyone to use signed kernels. You only need to do that if you play competitive multiplayer games, which is a fair game. Between playing with cheaters, kernel level anti cheat and enforcing signed kernels, I would pick signed kernels every time
3
u/AdventurousFly4909 7h ago
nothing changes it's not like libreoffice will require this
6
u/EarlMarshal 5h ago
Sure, sure, Companies really hate walled gardens and would never try to lure you into their ones. Shit goes done faster than you think and you enabled the same shit they have done somewhere else already. Don't give them an inch.
1
u/a-frog-with-no-name 7h ago
nothing open source will require this thank god, though i feel like other programs might get cocky and try to require this as well.
it does seem like on the windows side, it's only a thing with multiplayer games. I can see other games doing this but yeah it's the kind of games which you couldn't play on linux anyway
2
u/Upstairs-Category571 11h ago
NixOS Secure Boot Support is being tracked in this issue:
https://github.com/NixOS/nixpkgs/issues/549372#issuecomment-6172089685
2
u/skyb0rg 4h ago edited 4h ago
NixOS doesn’t maintain any runtime patches (all patches are for reproducibility) so you should be able to use a Fedora/openSUSE kernel in NixOS (via binary import).
I can’t imagine Epic ever whitelisting NixOS’s signed kernels (if it ever does that) because it’s a community project.
6
u/Schnickatavick 10h ago
Huh, nice. I know a lot of people in the linux community will probably have a knee jerk reaction against this, but it's honestly a really great way of handling it, and is way less invasive than windows anti-cheat. Seems like a total win for linux
13
u/JuJunker52 9h ago
I don't like it. It opens the door for requiring this stuff for things like widevine or remote attestation for banking websites in Google Chrome only. Android already does this.
4
u/ElvishJerricco 9h ago
To be clear, those things are already possible on the distros that implement distro-signed secure boot. And IIUC Widevine is also already able to do this sort of stuff regardless of the distro / secure boot using similar hardware in the GPU to keep the video stream encrypted all the way until it hits your display.
1
u/lack_of_reserves 2h ago
Simple: I have no interest in those games and I'm not gonna boot using secure boot which may fail when Microsofts keys gets outdated.
The atrocity of depending on Microsoft signed anything when running Linux is ridiculous and these gaming companies need to get better at bot detection instead of this invasive shit, but that costs server cpu cycles, much more practical to turn all computers into potential privacy nightmares.
56
u/Upstairs-Category571 11h ago
Secure boot is currently in the works for being implemented on NixOS using Microsoft keys similar to Ubuntu and Fedora.