r/linux • u/mattdm_fedora Fedora Project • 17h ago
Discussion Never mind new launcher: Epic's new approach to anti-cheat on Linux is the big news
https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2134
u/AiwendilH 17h ago
So..no more arch linux for gaming unless you install a debian, fedora or opensuse bootloader and kernel? No more optimized kernels for cachy?
116
u/ShadowFlarer 17h ago
I saw some comments from devs on cachyos sub, they are talking with Epic, so there's a chance cachyos kernel will work too.
28
u/wolfannoy 17h ago
We don't know for now from I can tell on the cachy discord. They're trying to contact epic games to elaborate a bit more.
34
u/FafnerTheBear 16h ago
Or jusy not play Fortnight
40
u/Patatus_Maximus 15h ago
It's not just Fortnite, it's all futures games that will use EAC v2.
19
1
u/todo_code 9h ago
I have already cut windows out of my life, and any games that ran only on it. It was a hard choice. So, I can just also cut out EA games. Not that I'm playing a single one right now anyways.
8
1
→ More replies (3)29
u/svenska_aeroplan 16h ago
Weird to include openSUSE but not Arch. I don't play Fortnight, but as a SUSE user, it's nice to be included for once. lol.
53
u/AiwendilH 15h ago
Not really weird...opensuse has an official key certified by MS for their bootchain as far as I know. I think that is true for all the distros in the list...so it makes sense to exclude distros like arch, gentoo or cachy which instruct their users to self-sign their bootchain. (also having some offical company or organization behind a distro is a huge help in getting a boot certificate...those keys relay shouldn't get in the wrong hands and much easier to hold an organization responsible for that than a bunch of voluntary devs)
26
u/Ok-Eggplant-7569 13h ago
Not really weird. SUSE worked to get their Kernel signed to properly support Secure Boot, Arch did not. So the boot chain on SUSE is easily verifiable, while on Arch it is not, and now SUSE gets support for software which needs a verifiable boot chain.
246
u/mattdm_fedora Fedora Project 17h ago
I was fortunate to briefly meet the engineering team behind this, and they clearly genuinely want to advance gaming on Linux and want to do the right thing for users, while meeting the very-real need to combat the cheating industry. It's a hard thing to balance because anti-cheating measures need to be invasive by their very nature, but this feels to me personally like a reasonable approach.
No proprietary or out-of-tree kernel modules; uses modern Linux infrastructure and capabilities instead. Cross-distro support. Only runs when it has a job to do. And most importantly, they're really interested in collaboration with the distro communities.
70
u/mattdm_fedora Fedora Project 17h ago
15
u/fuzzydogdog 12h ago
Do you know if Epic will be releasing more details on their use of eBPF? Seems like a really interesting use of the technology and honestly Iâm surprised someone hasnât proposed it as an anticheat solution before.
1
u/Kevin_Kofler 10h ago
Sad to see the FPL officially endorse this Treacherous Computing scheme voiding our freedom. What has happened to the "4 Fs", in particular, "Freedom"?
7
u/proexterminator 9h ago
if you don't like it, you don't need to install it. If you like it, you have the 'freedom' to install it.
8
u/SoilMassive6850 8h ago
Yeah, just like Play Protect is a very "optional" DRM scheme on Android
→ More replies (2)19
u/KazutoOKirigay 17h ago
Let's see how they handle the well known list, and if they monopolize it...
18
124
u/C0rn3j 17h ago
anti-cheating measures need to be invasive by their very nature,
No, they fucking don't.
Look at literally any game not using invasive malware under the guise of anticheat.
"But those games have cheaters" - Yeah, they do, and so do the ones that push a rootkit into your system.
but this feels to me personally like a reasonable approach ... No proprietary or out-of-tree kernel modules
Just a proprietary eBPF module with kernel-level access.
So exactly the same fucking problem, and you have no way to sandbox the game as a result.
111
u/Apprehensive_Lake698 17h ago
I gotta tell you, the number of cheaters in games with more invasive anticheat is significantly less. You can complain that itâs not 100% effective, but nothing ever will be. It does make a difference though, noticeable enough that games that use it are more enjoyable at high ranks because of it.
The only people I see discounting its effectiveness are people who never got deep into games that developed a large cheating player base.
18
14
u/bastardoperator 15h ago
This is an insane take. Cheating is at an all time high, especially with games that run EAC.
-7
u/Apprehensive_Lake698 15h ago
âInsane takeâ you gotta be so emotional about it dude?
19
→ More replies (2)4
14
u/C0rn3j 17h ago
The number of cheaters in games with more invasive anticheat is significantly less
Do you have any verifiable source for this claim, which is a really poor tradeoff for people's security, even if completely true?
Getting cheaters every X games versus getting them in every X+Y games is really not the improvement you seem to believe it is.
→ More replies (3)16
u/Gran_Duma 16h ago
If Y is a significantly larger number than X I would imagine that most players in any semi-competitive community would think it to be a large improvement. Going from experiencing cheating once a day vs. increasing to only once a week could influence a playerâs perception quite a bit.
13
u/C0rn3j 16h ago
Going from experiencing cheating once a day vs. increasing to only once a week could influence a playerâs perception quite a bit.
But that is not what we are talking about.
In your example, we are talking about experiencing cheating once a day, versus a megacorp being in control of your device and experiencing cheaters once a week.
Your still gets shafted by cheaters, and now you're also running privileged code the company refused to publish, that is vibecoded to boot (Epic's statements about forcing their programmer to use it, not mine).
You just gave up your security and privacy, just to have cheaters in the game anyways.
4
u/Izisery 12h ago edited 12h ago
To change this perception though you wouldn't even need anti-cheat at all, you would just need a queue system that prioritizes putting people at risk of cheating in a separate queue from other players, which is exactly what a lot of these companies pushing Kernel level anti chat do in their games.
Twitch streamers have commented openly about how once they spend a certain amount of currency in a game, 200$ - 300$, their game queues change drastically enough for them to notice they're no longer in the same queue with cheaters and bots.
That's not actually anti-cheat, it's not actually stopping anyone from cheating, the number of cheaters remains the same, but now gamers have a perception that cheaters are being banned by the anti-cheat. Its all just Propaganda to make it seem like you -have- to have Kernel Level Anti-cheat for a fair game.
2
u/loozerr 11h ago
Overwatch doesn't really have a cheating problem.
5
u/Saxasaurus 11h ago
Overwatch's anti-cheat is very good given how non-invasive it is, but it definitely does have cheaters. Also, cheating is less impactful in OW compared to other games. There are lots of abilities that can outplay a cheater with perfect aim but terrible positioning.
2
u/the_abortionat0r 10h ago
No cheater problem != No cheaters.
There is always going to be some amount of cheaters in EVERY GAME regardless of AC method or platform but the point is being made that KLAC isn't necessary to make an effective AC.
1
19
u/Lmaoboobs 17h ago
Yes, you do.
The cheaters are essentially running rootkits on their systems to bypass the less invasive anticheats.
35
u/C0rn3j 17h ago
You cannot bypass server-side anticheat, it will always run, because you're not letting the player control it.
You cannot bypass something as simple as human review either.
You cannot bypass a trust system score that determines matchmaking.
There are so many solutions you can implement to fight cheaters without ever needing full access to their system.
The multibillion corporation absolutely does not need to have unfettered access to the machine I use my bank account on to prevent people cheating in their pew-pew.
Also, nothing is preventing Timmy from open sourcing the eBPF module, but hey, no mention about open sourcing anything other than a list of signing keys.
6
u/steve09089 15h ago
Server-side anti-cheat isnât as easy as just saying âmake it server-sideâ.
For one, it doesnât exactly solve the aimbotting issue. Aimbots have gotten very good at disguising their shot profiles as âlegitâ, and human reviewers canât be everywhere to ensure every match is uninfected, or even a significant amount of them.
They could use machine learning, but machine learning isnât exactly a foolproof method, is difficult to train and is computationally expensive.
Also, how would a trust system matchmaker even solve this problem? Do we rely on player reports? This essentially runs into the problem of bad players not being able to distinguish good players from cheaters.
11
u/C0rn3j 15h ago
Server-side anti-cheat isnât as easy as just saying âmake it server-sideâ.
Neither is client-side anticheat.
machine learning isnât exactly a foolproof method
Nothing is foolproof. As evident by the fact that the games making use of rootkits still have cheaters.
how would a trust system matchmaker even solve this problem
By not letting low-trust players play with high-trust players.
4
u/steve09089 15h ago
But how are you determining whoâs low trust and high trust? A trust system needs a method to determine that, and youâve yet to give any answer to how to determine that.
And sure, nothing is foolproof, but so far, the rootkits have proven to be far more effective than machine learning based methods, as evidenced by the fact FaceIt has less cheaters than base CS2 that uses VacNet.
10
3
u/porkminer 9h ago
FWIW, you prior description of server side is pretty much exactly what VacNet is. It's a massive machine learning system that constantly reviews player inputs. It's used in conjunction with the client side VAC.
It is far better at finding things after the fact rather than during the game.
1
u/UnrealHallucinator 15h ago
I mean going off number of reports and prior cheating activity will allow you to have a good high/low trust system. Higher trust players reports could be valued more as well. False reports will obviously be a thing but it's easy enough to correct/detect if you're not actually cheating.
5
u/steve09089 15h ago
This would catch blatant cheaters, but I donât think it will help with the more subtle ones.
The average player isnât going to be terribly good at determining a pro vs a very dedicated cheater.
Itâs going to be very difficult sifting through what is noise and whatâs real.
1
u/UnrealHallucinator 15h ago
Yeah that's where server side ml assisted review would come in. It's probably easier than patching patch guard and have a custom page handler + custom cow mechanics. Vanguard actually does this btw.
→ More replies (6)1
u/Ok-Eggplant-7569 13h ago
You cannot bypass server-side anticheat, it will always run, because you're not letting the player control it.
You can't have perfect server-side anticheat though, because latency exists and you do not live in a data center. So the client always needs more information than is currently required, and needs to hide that information from the player.
You need client-side anticheat for competitive games, and it either needs to be invasive or have a trusted base to be effective and not easily circumvented. Windows has incredibly invasive AC, Linux (had) ineffective AC. Now Linux has a trusted base, on top of which we can build effective AC without undermining user privacy. This is a win-win in my book.
7
u/C0rn3j 13h ago
You can't have perfect server-side anticheat though
You can't have perfect client-side anticheat either.
You need client-side anticheat for competitive games
You do not, as proven by huge games that do not use it.
7
u/TypicalCringe 14h ago
Valorant is the most invasive evil anti cheat there is and it's the most cheater filled game I've seen besides TF2
7
u/LogSpecialist24 16h ago
> no they freaking don't.
ok study how anti-cheat works and then publish a showcase of a non invasive anti-cheat or something.
Because until then this just saying "nuh uh"
5
u/C0rn3j 16h ago
publish a showcase of a non invasive anti-cheat or something
Use a search engine or something and create such a showcase yourself if you believe it is needed.
this just saying "nuh uh"
Are you talking about your comment, or something else?
9
u/LogSpecialist24 16h ago
> dude use a search engine bro
the industry has decided kernel based anti-cheats are where its at.
You're the odd one out.
You have to prove it.6
u/OhMyHowLewd 15h ago
The industry has all the incentive to take the easiest and most intrusive decision here, it doesn't speak at all to its merits.
→ More replies (1)→ More replies (3)0
u/oromis95 17h ago
You can dual boot a different Linux distro at least.
15
u/C0rn3j 17h ago
You can dual boot Windows, what's your point?
Either way, it's effectively giving full access to your hardware to a megacorp.
18
u/oromis95 17h ago
My point is today is better than yesterday. If you live for for Fortnite, you no longer need Windows at all. I'd rather see a bunch of kids using Linux with this crap installed than kids running Windows with all the crap installed. It's a silver lining. One day at a time.
11
u/C0rn3j 17h ago
What's the difference?
You need proprietary software with full access to your device to play the game in either case.
5
1
u/UARTman 14h ago
I hope you do realize a security vulnerability in proprietary software with user-level access to your device (the multiplayer game itself or the user-mode anticheats) is not that better than a vulnerability in a proprietary eBPF module. Especially since eBPF does not, in fact, allow you to do whatever you want.
If anything, relying primarily on measured boot and a eBPF script is less invasive than what I'd expect from a Linux KLAC solution, and a lot more "respectful" to the integrity of the ecosystem. Also, less invasive than a kernel module/driver on Windows, though it's a low bar.
Also, if you are against proliferation of anti-cheat on Linux, it's entirely possible that the same sectors of gamedev that have boycotted usermode Linux EAC will do the same to this, and this initiative fizzles out without becoming an industry standard.
2
u/C0rn3j 14h ago
I hope you do realize a security vulnerability in proprietary software with user-level access to your device (the multiplayer game itself or the user-mode anticheats) is not that better than a vulnerability in a proprietary eBPF module.
Where are you getting that from?
If you throw the game into a Flatpak (which you won't be able to do with Epic garbage), the malware gets access... to the Flatpak container contents.
As opposed to getting kernel-level access to your entire system.
How is that not better?
eBPF does not, in fact, allow you to do whatever you want
https://github.com/pathtofile/bad-bpf
I suppose, for example, executing anything as root by abusing sudo is not bad enough in your book?
How much worse can it get?
→ More replies (2)1
u/Tranceravers 9h ago
Did you ask themif they even thought about having this on Steam OS? It is Arch based so this sucks.
→ More replies (1)1
u/Riemanns-Mycologist 4h ago
Respectfully, while I really appreciate the work you and the team have done, please consider the potential consequences of allowing software like this to become widespread on linux. This doesn't sound like a big deal right now because it's just anticheat for games. What I'm worried about is these sorts of checks becoming the norm in other software years down the line. Imagine if chrome or chromium started requiring software like this to check that the computer has a "verified" kernel. Just look at what has happened to Android banking apps with google play integrity checks blocking ROMs like Graphene OS. I think the linux community needs to reject this before it becomes a problem and restricts user freedom.
38
68
u/Haunting_Assignment3 17h ago
Jesus thats something brewing there:
1. Signed Kernel & Kernel Modules
2. TPM 2.0
3. Secure Boot
4. Measured Boot
5. Input-Output Memory Management Unit (IOMMU)
6. Kernel Lockdown Integrity Mode
7. Kexec Disabled
8. Linux Security Module BPF
→ More replies (4)60
u/Wyciorek 17h ago
That's pretty much the defaults for any modern distro
9
u/a-frog-with-no-name 11h ago
I was going to come in here and say that secure boot is not the default in most distros and doesn't work out of the box but. it does? Debian 10, Ubuntu 24.04, Fedora 18. damn
I've been using arch and nixos recently. these two do not support it by default.
Arch is a big one though, cachyos is being recommended to beginners more and more for some reason. Perhaps cachyos could add some stuff to make it work out of the box maybe, i don't know.
I don't think base arch ever will due to its "set up everything yourself" nature, but thats what Arch users signed up for and makes sense
3
u/Possibly-Functional 4h ago
It should be mentioned that it's easy to setup secure boot on CachyOS already.
âą
u/AiwendilH 11m ago
The "problem" is the "Installing sbctl and Enrolling Keys" part of that guide. By using your own keys you can make sure that everything in your boot chain is approved by you...so completely fine for secure boot.
But not fine for anti-cheat. They are not interested in your security...they are interested in only allowing approved kernels. So any setup running with self enrolled keys isn't acceptable for them. That why they have that list of supported kernels/boot loaders in their post...those aren't signed by the user but rather the distro (and as far as I can see with microsoft certified keys) so they user can't run a modified kernel with exactly those keys.
Meaning...yes, you can easily run secure boot on cachy but as long as it's based on self-signing it's doubtful an anti-cheat system will accept those keys. Secure boot alone is not enough, it must be done with the right keys to prevent users from tempering with their kernels/bootchain/modules.
And cachy has an additional problem...the kernel modules must be singed with those "official" keys as well. So each nividia driver update must be singed correctly as well.
10
u/SoilMassive6850 17h ago
Yeah, have fun reporting issues when you can't even bisect the kernel.
20
64
u/merb 17h ago
Yeah bisecting kernels, what most Linux users do , ah and of course they play Fortnite. At least that would explain the behavior of some people.
→ More replies (7)3
17
u/PM_ME_UR_DMESG 16h ago
Add this to the list of things I've never had to do while daily driving Linux on my laptop(s) for the past 6 years...
3
u/battler624 11h ago
i've been using linux for around the same time as you, and honestly this is the first time i even hear about bisecting.
-1
u/SoilMassive6850 16h ago
"We dont need freedom to do things because I don't do them"
Nice, I would guess this line of thinking extends to your views on privacy?
13
u/PM_ME_UR_DMESG 16h ago
You still have the freedom to do whatever you want. You just won't be able play games that need kernel anti cheat, so for you nothing will really change.
It's a compromise I'm willing to take to getting one step closer to nuking Windows off my desktop. I would love to live in a theoretical world where nobody cheats in online games and thus these systems would not be needed, however that's not the world we live in.
8
u/SoilMassive6850 16h ago
No. Games that previously worked fine will no longer work in the future unless you comply with these restrictions. Just a loss of freedom all around.
4
u/madness_of_the_order 16h ago
Whatâs the point of nuking windows if you turn the replacement into windows?
14
u/274Below 17h ago
There's nothing stopping you from turning that off and bisecting the kernel, and then turning it back on when you want to play a game that requires that anti-cheat.
→ More replies (1)9
u/Wyciorek 17h ago
Again, go complain to distro maintainers then
2
u/SoilMassive6850 17h ago
About what? Seems like you don't understand the issue here.
9
u/Wyciorek 17h ago
Preferably about nothing, since you can always boot with secure boot, etc. disabled. But you seem to be very determined to have 'an issue'.
2
u/Ok-Eggplant-7569 13h ago
Yes, bisecting kernels while in a match of Fortnite. Completely reasonable use case that all users are in all of the time.
Epic writes in the blog post above (which I assume you've read) that you can turn any of the above off at any time if you want, you just need to turn them back on again if you want to start the game.
2
u/IAm_A_Complete_Idiot 12h ago
I reported a bug once for intel arc's driver, and regularly was testing their fork of the kernel to see if it fixed the issues I was seeing in a game. That wouldn't have been possible without a non-signed kernel.
This will make doing things like testing kernel driver fixes for games harder - and that might be something you don't care about... but I'd venture it is something plenty of devs do. After all, how do you know if an issue is fixed if you can't run the game with the fix in it, without a signed release first with the fix?
4
u/SoilMassive6850 12h ago edited 12h ago
Yes, it also helps bug reports if you can pin down which commit specifically caused an issue by bisecting, also using pre-release bugfixes by grabbing patches from the kernel mailing list. If the problematic game has EAC? Tough luck.
And of course its way too optimistic to assume this stops at EAC. Next comes Widevine, Denuvo etc. refusing to run without an approved build. The end game is similar to Android where software vendors control who is allowed to build the system that is used to run their software.
Anyone not seeing how horrendous this direction of development is long term is dumb.
24
u/rmyworld 8h ago
I don't like anti-cheat software on my machines. But if this allows more games to be ported on Linux. And thus, more users moving from Windows. I think it's good to have the option.
14
u/Riemanns-Mycologist 5h ago edited 4h ago
I don't like the precedent this sets. Anticheat isn't a big deal but we need to think of what happens in the future if this type of software becomes accepted in the linux community. Imagine if chrome or chromium started requiring software like this to check that the computer has a "verified" kernel. This doesn't sound like a big deal now because it's just anticheat for games. I'm worried about these sorts of checks becoming the norm in other software years down the line. I think we need to be wary of this. Furthermore, suddenly deciding to announce this, after refusing to support linux for years, as age verification laws are being rolled out in multiple countries is extremely suspicious to me.
→ More replies (2)4
2
u/BigHersh14 7h ago
I also believe its a good option. I personally wont be using it for fortnite but itll be nice to have the option for future games and having full gaming compatability on linux
13
u/KindaSuS1368 4h ago
I guess I kinda see the point the people opposing this are making
This sets a precedent for more games and software to require trusted (or treacherous) computing, which has many flaws for the end user https://www.cl.cam.ac.uk/archive/rja14/tcpa-faq.html
I am a victim of treacherous computing, my nation is becoming heavily reliant on online payments through phone apps and some physical vendors and service providers don't carry cash change anymore or are reluctant to accept cash payments. (Apparently, many EU nations' citizens would face a similar issue with digital ID applications also relying on this technology, and thus being finnicky on "insecure" devices)
These phone apps work only on devices passing play integrity, on the android side, and I've had to buy a second cheap phone just to make frequent daily payments reliably (my main phone uses a custom rom and fails play integrity without fragile hacks)
Users can be expected to be locked out of online games (upcoming and also ones currently working, if they choose to increase their security) and perhaps more general software that wants security, if they deviate from these strict allowed configurations.
Though, I must ask, what's a better method for this? Are reliable anticheat and other security protection tools simply not possible in a "freedom respecting" way?
→ More replies (2)6
u/Frosty_Complaint_703 3h ago edited 3h ago
You need to verify the kernel and everything up the stack is not modified in anyway
That is sadly a logical requirement to prevent cheats. To do that we need a way of verifiying it hasnt been tampered with. Thats about it really. The only otherway is to allow that, and give cheaters ways to do things
To do this, epic needs trusted signed system that that is therefore verified to nog be tampered with. A major point of debate is secure boot, as it already is a fragmented topic in the Linux space, mainly because it has microsofy in the loop. And microsoft is not a neutral party theoretically
The solution i personally see forward for secure boot is designing something better than secure boot. A modern better secure boot, and setup a non profit authority to manage the signing etc that is open, neutral etc etc. Be done with secure boot entirely, as they.
4
u/SoilMassive6850 1h ago
That is sadly a logical requirement to prevent cheats. To do that we need a way of verifiying it hasnt been tampered with. Thats about it really. The only otherway is to allow that, and give cheaters ways to do things
So you need to give up freedom so that some random person somewhere can't use an aimbot? Fuck that.
5
u/Frosty_Complaint_703 1h ago
If u some better way if verification for the above things, please share them with us and epic . That would he a big deal
3
u/SoilMassive6850 1h ago
Software vendors have no business trying to verify the OS or system they run on. That's the way. Software vendors demanding this and user wanting those software vendors should go use another operating system.
An operating system being open source has no value if software vendors control who is allowed to build the system. We can already see this happening with Android.
2
u/Gl33D 1h ago
and so we are back at the beginning with no anti cheat support on linux, causing linux as a gaming platform to continue struggling to grow. You cant have it both ways and if you dont like the implementation you can simply not play the games, these games already require kernel verification on windows after all so i doubt you would play them under windows either. The thing that makes linux special is the open system and choice. You can choose to build you system in a verifiable manor that can work with anti cheat, or you can choose to break out of those limitations and build you system however you want. You have that choice, and you will always have that choice.
→ More replies (1)
20
u/renchuwang 17h ago
Is the simple(r) measures suffice I don't get why they were doing it the"windows" way before...
23
u/ZuriPL 16h ago
I'm not very into EAC's inner workings, but it sounds like the opposite?
Anticheats on Windows were using TPM, Secure Boot, etc. for quite some time now, and it's only now that a Linux anti-cheat takes this approach. Previously they were basic and simple to circumvent.
→ More replies (1)11
u/Ok-Eggplant-7569 13h ago
On Linux, with Epics current (new) approach to AC, you and Epic both agree on some trusted computing base (like Fedora or Debian) and then the AC can audit that this trusted computing base is currently running unaltered, using regular off-the-shelf tooling (Secure Boot, verifiable boot chains, TPM2, ...).
Really like this as in contrast to Windows, the AC does not need to run in the kernel itself, it only needs to audit that the kernel is unaltered.
37
u/LogSpecialist24 16h ago
finally an excuse for archlinux and nix to start signing their kernels. about freaking time.
7
u/gravgun 10h ago
Nixpkgs will not. Third party signed kernels aren't reproducible and therefore not trustable and impure, and you can't realistically build a Nix kernel outside of Nix itself like you can yoink prebuilt binaries of proprietary userland software (think Steam etc).
→ More replies (2)âą
7
u/deadbeef_enc0de 16h ago
I mean on arch it's really easy to use sbctl to self-sign and add the cert to your EFI and turn on secure boot (I have this setup on my machines)
My guess is they will only allow the Microsoft signed kernels (like the major distros use)
24
u/LogSpecialist24 16h ago
from the article:
What keys are considered well-known?Here is a current list of keys that are considered well-known for use as Secure Boot signature database (db) keys and Machine Owner Keys (MOKs), which we plan to expand over time:
- Canonical Ltd. Master Certificate Authority - used by Ubuntu and derived distros like Linux Mint
- Fedora Secure Boot CA - used by Fedora and derived distros like Silverblue
- Universal Blue - used by Bazzite, Bluefin, Aurora, and derived distros
- Debian Secure Boot CA - used by Debian and derived distros
- openSUSE Secure Boot CA - used by openSUSE and derived distros
- SUSE Linux Enterprise Secure Boot CA
- Rocky Linux Secure Boot Root CA
- Microsoft UEFI CA - used to sign non-Microsoft components like the Linux bootloader shim project
- AlmaLinux Secure Boot CA
Can I generate and enroll my own Secure Boot keys to use with other boot options?
Yes, EAC Linux v2âs well-known key requirement only applies to the keys used to verify the boot chain and kernel modules for the boot session where a protected game runs. This means you can easily toggle between an anti-cheat compatible boot path for playing protected games and one that you control yourself using your own keys for any other situation.
Note: If you boot via shim and want to use custom keys for other boot options, enroll them in the Secure Boot signature database (db) instead of enrolling them as Machine Owner Keys (MOKs). Because all enrolled MOKs are typically trusted for kernel module signature verification regardless of whether they were used in the boot chain or not, EAC Linux v2 requires that they are all well-known.
7
5
u/scythe-3 12h ago
Pardon my ignorance, but does this mean you would be able to use a single distro (e.g. Arch) with different Secure Boot keys? Or would you still have to dual boot if your main distro is unsigned (e.g. Arch primary / Bazzite secondary)?
2
u/yukeake 7h ago
My understanding is that with this, they'd give you a list of "acceptable" operating systems. If the one you want to run isn't on that list, tough luck. Change your OS, jump through all of our configuration hoops, and install our nanny software or don't play.
I'm well past my time of playing competitively, so it likely won't affect me directly. That said, I'm not a fan of anyone dictating what I may or may not run on my machine. I certainly won't install nanny software on my machine to ensure I don't overstep someone else's bounds on my own machine.
6
u/Mr_Engineering 15h ago
My guess is they will only allow the Microsoft signed kernels (like the major distros use)
That's correct.
They talk about using attestation in the post, which means they will be using TPM 2.0 and PCR measurements to determine the status of the Secure Boot DBs and boot loader signatures to make sure that only trusted signatures are in use.
1
u/SoilMassive6850 2h ago
Why? Secure boot and measured boot are intended to give software vendors security from you, the user. There's no benefit in user security from it, it's just spreading your ass for corporations and DRM.
âą
u/LogSpecialist24 41m ago
Unsigned modules... aren't loaded. Thus security
Now i would get it if you were developing the kernel, then secureboot becomes a slight annoyance because you don't want to sign your modules and kernel all the time.
âą
u/SoilMassive6850 37m ago
Sorry, secure boot with non self signed keys.
You get the benefits by self signing, anything else is handing over control to corporations.
âą
u/LogSpecialist24 20m ago
Might as well not play fortnite. And I don't play fortnite either this is just the base requirement i have from everything. On my system, i want it hardened and secure.
Also from the article:
What keys are considered well-known?
Here is a current list of keys that are considered well-known for use as Secure Boot signature database (db) keys and Machine Owner Keys (MOKs), which we plan to expand over time:
- Canonical Ltd. Master Certificate Authority - used by Ubuntu and derived distros like Linux Mint
- Fedora Secure Boot CA - used by Fedora and derived distros like Silverblue
- Universal Blue - used by Bazzite, Bluefin, Aurora, and derived distros
- Debian Secure Boot CA - used by Debian and derived distros
- openSUSE Secure Boot CA - used by openSUSE and derived distros
- SUSE Linux Enterprise Secure Boot CA
- Rocky Linux Secure Boot Root CA
- Microsoft UEFI CA - used to sign non-Microsoft components like the Linux bootloader shim project
- AlmaLinux Secure Boot CA
There's also a passage on self signing right bellow it, what are even complaining about.
As for me I'll just use Microsoft keys. Because Microsoft isn't actively trying to sabotage my drivers.(why the fuck...)
63
u/Historical_Move6359 16h ago
I moved to Linux to avoid spyware
49
u/Ok-Eggplant-7569 13h ago
In contrast to AC on Windows, which is full of rootkits, this new AC proposed by Epic is specifically designed to protect against all rootkits though.
You and Epic both agree on a trusted, auditable, verified bootloader and kernel (e. g. by running regular Fedora or Debian), and then Epic just uses regular tooling (Secure Boot, TPM2, verifiable boot chains) to ensure the environment is unaltered.
This specifically avoids rootkits and makes the distro maintainers (who you've been trusting anyways) a shared root of trust which both you and Epic can agree on are not messing with you, your hardware or any software (like games) you are running.
10
3
u/magnusmaster 6h ago
Any shared root of trust will inevitably be corrupted by Big Tech, the government or both once enough developers trust it.
5
u/Historical_Move6359 13h ago
Okay this sounds like a very reasonable explanation. Does their anti cheat have root acces trough tpm?
→ More replies (1)18
4
u/ficoplati 15h ago
Have you considered not using it? Or are we all dependent on what Historical_Move6359 considers okay to be on Linux?
14
u/Linuxologue 14h ago
I suggest you do what works for you but better if you do it silently next time
so that others can share their opinions, too, without being accused
5
u/ficoplati 14h ago
The point is that every time kernel AC or similar is discussed on Linux there's an army of people that somehow take offense at that fact that it could even be considered.
Just don't use it and let people that are okay with it enjoy their games without being forced to use windows?
There is no universe in which this is not a net positive for linux even if you dislike kernel anticheat. Especially if other developers follow suit. It will lead to more adoption of the os and better market share which means better support overall.
Yet if you were to look at this thread it's like the end of the world is coming.
5
u/magnusmaster 7h ago
Epic may have good intentions but the powers that be will inevitably ban any Linux distro that isn't willing to get enshittified just like they're banning GrapheneOS and other Android forks. See https://www.cl.cam.ac.uk/archive/rja14/tcpa-faq.html
1
u/Linuxologue 14h ago
I think someone that shares their feeling with an I statement does not deserved to be treated like that. You don't like their opinion, sure, but they have certainly not forced it on you with their comment.
Had they say something more general like "The linux community" or "Everyone on Linux" then sure, go ahead and blast them.
1
u/gavff64 14h ago
I get the annoyance. Kernel level anticheat is obviously horrendous, but ultimately I have to support it because this is basically the main blockage for the majority of regular people switching to Linux permanently.
It sucks and is not a good solution. But if thatâs what it takes to hurt Microsoftâs market share and encourage companies to start fixing their operating systems, then so be it.
Controversial and likely has negative side effects/implications. But thatâs my 2 cents.
1
u/Linuxologue 14h ago
very valid opinion, not criticizing. I think everyone starting with an "I" statement has a good point, unfortunately i don't have a solution for that.
I want multiplayer games without cheaters with no spyware/kernel level snitch. I'm afraid that is not currently possible :(
2
u/AdventurousFly4909 12h ago
Exactly my thoughts. No one is forcing you to install it, on windows tho, spyware baked baked in.
30
u/Possibly-Functional 17h ago
That's much more reasonably designed than I expected. Kudos.
1
u/UltraCynar 11h ago
Itâs not reasonable at all
7
u/Possibly-Functional 11h ago
I expected proprietary kernel modules like on Windows. Here it's just using built in features of the Linux kernel.
It's still problematic as it allows them to act as a gatekeeper of what kernels and modules are allowed, but at least they seem to be in talks with a wide variety of maintainers and willing to discuss with the community.
So from my consumer perspective it's not ideal, but it's a lot better than I expected. I'd much rather reboot into an unmodified kernel to play a game than boot into Windows.
2
u/SoilMassive6850 2h ago
It's using eBPF LSM features to filter syscall permissions. This is very different from using a kernel module to use ObRegisterCallbacks to filter handle operations (it is not).
19
29
u/Kevin_Kofler 16h ago
This is effectively the first large-scale deployment of Treacherous Computing on GNU/Linux. (On the Linux kernel, it has already been done with "Play Integrity" on Android, this is now the desktop equivalent.) Not good news at all!
→ More replies (2)
23
u/hff0 16h ago
Valve never needed that much lock down with VAC
8
u/EmpireBuilderBTW 13h ago
Yet for some bizarre reason people voluntarily install faceit kernel anti cheat instead of playing on the notoriously cheater free premier servers.
28
u/Lmaoboobs 15h ago
Yes and vac is a joke.
VACnet is better but is still wanting compared to vanguard.
→ More replies (1)5
u/Even-Confidence-4495 14h ago
Vanguard is top of the line even EAC doesnât beat it donât expect anything to beat vanguard
3
u/trichocereal117 6h ago
Itâs also super invasive. Iâd rather deal with the occasional hacker than give my computer AIDS
→ More replies (3)7
4
u/Ok-Eggplant-7569 13h ago
VAC (along with most other AC on Linux) is mostly ineffective though, as it doesn't do much more than asking the kernel nicely "please don't let other software debug me".
So you need something stronger to actually protect against cheating.
2
u/mdedetrich 2h ago
And because of that VAC has much weaker guarantees than EAC. Have you played TF2 lately? Itâs full of bots and cheaters.
Measures like EAC or what Riot Games does with Vanguard is the only proper way to prevent cheating
1
→ More replies (1)2
u/ficoplati 15h ago
VAC, known as a functioning anticheat.
Same with the server side AC cope most of the people here keep repeating, as we can see cs2's server side AC has been working wonders and is not absolutely useless as well.
This is amazing news for Linux and I can only hope more AC manufacturers like RIOT and faceit will follow in epic's footsteps.
→ More replies (1)
16
u/total-depravity 14h ago
Hard pass. I donât need what they are selling. They donât care about me or my system to pony up if they compromise my rig. They want access they havenât earned.
5
→ More replies (4)1
13
u/AmarildoJr 15h ago
Oh god, this shit is coming to Linux too.
1
u/PacmanAteMyRAM 6h ago
It was always coming to Linux. The question was how much popularity do we need until it does.
31
u/RealSharpNinja 17h ago
The nature of Linux is 100% opposed to the needs of anti-cheat. The boot process alone can never be locked down without ending the openness of Linux.
26
u/adoodle83 16h ago
for those that want to play/use these games/softwares. iâm not opposed to this so long as itâs optional and not a manufactured excuse for a global change
9
u/SnooCalculations3614 15h ago
Right. The people who just want to play Fortnite and don't really know or care about differences in OS or even what anti-cheat does are the ones who will need to switch to make any sort of dent in market share
1
3
u/Sorry-Committee2069 11h ago
Even if I wanted to play Fortnite on my Linux machine (I don't) I'd likely have to reinstall, because Bedrock Linux probably breaks this process, and also I'd lose my fancy $200 10Gb NIC because it needs out-of-tree drivers. This WILL end up being a huge change as other devs are going to follow suit, and it's going to cause issues.
1
17
u/clericc-- 16h ago
i assume what this amounts to is that measured boot ensures that the boot process is clean distro-default. You can of course do what you want to that process, but then the validation fails. Valid compromise i'd say.Â
6
u/ghost103429 15h ago edited 10h ago
Agreed. Ebpf is already used by EDR software to enforce runtime integrity, an anti-cheat can hook into this to lock out cheating tools with a measured boot to ensure that ebpf remains in place to do this.
8
u/HomsarWasRight 15h ago
I mean, I think this looks more like booting Linux in an appliance-like manner with a number of pre-configured things locked down. I think it makes perfect sense for something like SteamOS to be able to boot as needed on known hardware to support Linux anticheat. The only real new thing happening here is a systemd service to check that these things are true to allow the anticheat to run.
Nothing here stops anyone from using Linux as they see fit, it just means that anticheat wonât work. Basically exactly the current situation.
But if this all works out, it means devices like handhelds and Steam-machine-like consoles can work out of the box, which is how most users are playing on them.
10
u/Kevin_Kofler 16h ago
And this does exactly the latter! That is the real big news here, not Fortnite becoming available.
1
u/Mds03 14h ago edited 14h ago
Yes. There seems to be concessions to this, or a middle ground. Seems like we can use this system with âkernels signed by a trusted distroâ, though Iâm not 100% clear on the selection process(they list a lot of the big ones, Ubuntu, Fedora, Bazzite, probably SteamOS etc), or how it will affect unofficial âspinâ of popular distros like say, Nobara or Ubuntu Studio, which have customized kernels. Will they be able to become âa trusted developer» in a reasonable way?(seems necessary for a gaming focused distro like Nobaraj. I suspect the âclosest cousinsâ like Kubuntu will work even if not explicitly named.
I suspect this concession will be fine for many âregular desktop gamersâ who only want to run a few games and a web browser. Itâs sad if it will lead to people not daring to experiment with their software in fear of getting banned though.
There is another component to this. I have a PC which works for all games, but wonât pass some EAC games cause of a physical memory error(that doesnât seem to affect anything I do, but I think it might look like tampering?). For people like me, I am wondering if this might make it so games that currently work for me, wonât. Once again, I am unclear on the technical details of this.
→ More replies (2)-1
u/Ok-Eggplant-7569 13h ago
It can be locked down, without undermining security guarantees or openness, which is the entire beauty of open source in its best light.
Because of open source and verifiable boot chains, we now have a trusted, shared base of components (bootloader and kernel) that users and software developers alike can audit to be safe and trusted, and build on that trusted base how they want.
You can still install any software you want on that trusted base. You can also change the trusted base and replace anything below if you like, just be aware that then software of course can't verify that it is trusted anymore.
→ More replies (11)
15
u/SoilMassive6850 17h ago
This is bullshit, and will obviously lock down previously working games behind these requirements in the near future. Might as well move to Windows if I can't even compile my own kernel lol.
→ More replies (4)9
u/DRZBIDA 15h ago
I genuinely can't comprehend how people can't see how this will apply to games that are currently running without all these requirements, not only games that currently do not support linux. So no, it is not as simple as just not playing Fortnite - your favorite online game will most likely also not work in a 1-3 years if this were to happen. But I guess nobody uses their brain anymore.
5
u/magnusmaster 6h ago
Not just games. Eventually this will apply to anything and everything. It's already a big issue in Android and it will get worse considering governments are pushing digital IDs with hardware attestation
2
u/ficoplati 14h ago
Why do you believe that developers base their decision on utilizing kernel or non kernel AC on Linux?
Do you think there's thousands of games out there that are not using kernel AC just because Linux doesn't support it? As if somehow Linux is holding the floodgates of the kernel level AC wave?
Whether devs stick kernel AC or not on their games has absolute no relationship with Linux support because Linux is a complete irrelevancy when it comes to market share. The reason most games don't have kernel AC is because they don't need it.
Most of those that do require that level of protection already have it and those who don't are completely unplayable on official servers (see CS2).
5
u/DRZBIDA 13h ago
Why do you believe that developers base their decision on utilizing kernel or non kernel AC on Linux?
I donât, and I never said that. Read Epicâs own post. Games that already run EAC on Proton will be able to choose between keeping the old implementation for "maximum compatibility" or switching to v2 for "better cheat protection". This isnât about adding kernel AC to new games, it is a toggle on games that work today.
Do you think thereâs thousands of games out there that are not using kernel AC just because Linux doesnât support it?
No. I think there are games running on Linux right now through a weaker opt-in mode, and Epic just handed every one of them a "secure" alternative. Who do you think keeps the "insecure" mode on once the "secure" one exists?
Linux is a complete irrelevancy when it comes to market share
Which is exactly why nobody will keep the compatibility mode around for it. Flipping to v2 costs the dev nothing; no new AC, no new integration, just a setting. Irrelevant platforms donât get special treatmen, we'll get the strict mode or the door.
So take any EAC game that works on Proton today, like Elden Ring or Dead by Daylight. If the dev flips to v2, it stops working on the Deck, on Arch, and on any kernel you built yourself. Itâs not just the kernel either. Every loaded module has to be signed by an approved org. I had to patch a WiFi driver to fix a power issue with my Steam Frame adapter. Iâm no kernel wizard, I just followed a fix I found online, built the module and loaded it. Under v2, that alone locks me out, and signing it with my own key doesnât help, because Epic requires every enrolled MOK to be on their list. And this isnât some niche edge case. People routinely install extra drivers to get their Xbox controllers working properly, fix their racing wheels, set up a virtual camera for streaming, or run a gaming-tuned kernel like catchy (which may work due to huge popularity, but still), etc. By Epicâs standards, all of that is unsigned. So the choice becomes: reboot into a "clean" setup where your controller or adapter doesnât work, or donât play a game that runs fine today.
those who donât are completely unplayable on official servers (see CS2)
Marvel Rivals runs on Linux through Proton, where no Windows kernel driver can load, so Linux players are on userspace-only AC. NetEase still supports the Deck, and Iâve barely seen a cheater. Yet, as you say yourself, once a game gets labeled "unplayable", no matter the actual reason, itâs a no-brainer for these corporations to take the strict route and call it a day. Flipping to v2 costs them nothing, and Linux is, in your words, "a complete irrelevancy". Nobody is going to fight to keep a compatibility mode alive for an irrelevancy.
2
u/C7VV 2h ago
Using Marvel Rivals or Overwatch as an example is really missing the mark imo.
Cheating is just not that useful in those games. There's shields, stuns, invulnerability etc.
Compare to CS where even just wallhacks (which are much harder to stop serverside) can give you an immense advantage
3
u/UltraCynar 11h ago
Anyone who thinks what epic is doing here is fine just need to go back to windows. This is the opposite of fine.Â
2
u/MutualRaid 4h ago
There are games that stuck with a combination of user mode EAC and proprietary/server-side AC for Linux clients even if they ran kernel mode EAC on Windows. So yes, it may well affect games like that.
5
u/Willybrown93 13h ago edited 13h ago
I wouldn't be caught dead with either Epic software or an invasive anticheat on my Debian. Not on your life. I don't need extraction shooter slop or whatever
4
u/MasterControl90 12h ago
I have only one problem with this: it is the same company lead by an individual that pretty much lives of spite and envy of another person and that clearly stated in the past that linux doesn't matter while, at the same time, actively find ways to block linux players to dissuade them from the platform lead by said person he hates so much... All of the sudden "OH WE LOVE LINUX"! He just realised he is missing a lot by not following the way led by his "nemesis"... what a clown
7
u/Own_Nail_2999 13h ago
This stupid way of trying to prevent cheating locally will remain a pointless war. Just do anti-cheat online.Â
Don't wan't a wall hacker to see a player too early? Just don't send his position until he is in actual sight.
6
2
u/mdedetrich 2h ago
Until everyone gets fiber internet with amazing latency, this is not going to work
2
u/skyerush 8h ago
you cannot do all anti-cheat detection on the server. latency exists, and the server can't detect everything.
2
u/VNC_Sub 13h ago
The requirement of tpm 2 and secure boot is a no go for me. Old mobo that doesn't need to be replaced is one of the reasons for switching to linux. Couldn't upgrade to win 11 and then support stopped for 10 and all their other bs pushed me to linux. Oh well. I've been without epic for over a year.
2
u/jeffiscow 11h ago
I wonder if there's any chance they could work with valve? To they work together on auntie's sheet. It would probably bring them more money together then if they they work on their separate anti-cheats.
3
u/Big-Reporter3498 6h ago
People are welcoming this as a ditch effort to stick it to Microsoft, but at this point once most games require you to go through the launcher of some sort diagnostics and collection is it really any different from gaming on windows with better performance?
→ More replies (2)
2
âą
100
u/hadrabap 15h ago
My favorite game -- Oracle Database -- is not affected đ€Ș