I've never played Fortnite and I'm not interested in playing it ever. I also don't care for Epic Games, but I think this is a clear win for Linux!
Easy Anti-Cheat is one of or perhaps the biggest/most common anti-cheat engines in gaming today, and basically every AAA game title requires their anti-cheat engine to run. Even if the game itself is Linux-compatible, if the anti-cheat isn't, then you can't run the game. In the past couple years, all of Valve's work on Proton means that basically every Windows game now runs flawlessly on Linux too... with the exception of anti-cheat engines.
I have a handful of friends who are big PC gamers and that's the last big excuse they have for staying on Windows. I don't expect that they'll all finally jump ship for Linux now, but some of them will!
Tbh - I have 1 windows gaming laptop to play 3 AAA games that require EAC.
If they get EAC working in Linux? I’m assuming this opens up the other AAA games that use this to be playable on Linux. EAC is my only real blocker now.
EAC already works with linux just fine. The devs literally only have to flick a switch that says "allow linux". What epic are doing is kernel-level anti cheat on linux, meaning they want to install a root kit to 'keep their games safe'.
All Linux anti cheats including EAC work in user space which means they are way less efficient than kernel anti cheats. Also they won't move EAC to kernel module, they will utilize Secure Boot and eBPF for better protection.
”The LSM BPF feature enables eBPF programs to use Linux Security Module hooks for granular access control and monitoring. This enables anti-cheat to restrict other processes from reading or writing protected game process memory without needing a kernel module, as well as monitor for cheats loaded in different ways.”
Honestly from what I'm reading up on it probably not much, am not an expert at all but it does seem to enable pretty in depth system monitoring.
That being said if I was scared of a program spying on me I just would not install it no matter what level of system access it has, you can gather a lot of information about a user even with only user level access in Linux.
Nothing. eBPF is the same thing as a kernel module in terms of system access more or less. It can straight up intercept syscalls and change them even. Thats used to great effect in k8s clusters for networking as a replacement to NAT because it removes a ton of context switches. But it also shows you the sheer power it has... It can do anything the kernel can basically (it just cant add fundamentally new functionality, which true modules can).
Thankfully, as others have pointed out too.. eBPF is a TON more auditable than a compiled code blob. So them hiding things will be extremely hard even if they try and pull it off. Though we wont know for sure until it lands if they design it to be super hidden or not...
Indeed. So its def better than some obstruse blob thats incredibly hard to deobfuscate at least.
Not that Ill be patroning egs or fortnite... but I might use eac having titles in some cases. Maybe... Since this requires things Im on the wrong distro... :'(
On them being able to abuse eBPF/LSMs: they of course can on a technical level, however the intent of the eBPF interfaces is such that skilled users can still audit what the eBPF programs and LSM(s) are doing. 'decompiling' eBPF is less a thing but analyzing/auditing/verifying what an eBPF does is in fact very much a thing. IE at my $DayJob when $VendorTool updates they include new eBPF scripts and part of my responsibility for our compliance/infosec standards is to audit what the new eBPF scripts changed/are doing is still 'fine' (IE, no sneaky malicious code, not creating obvious security vulns via eBPF, etc). So while I wouldn't expect even moderately skilled Linux users/developers to be able to audit/verify the EAC v2 eBPF/LSM setup, its well within the capabilities of many and is much better than a precompiled kernel module.
TBH, this eBPF+LSM+'verified boot chain' pattern is exactly what has been the expected acceptable middle ground to achieve comparable anti-cheat vs windows kernel-level anti-cheat. It is just so different from normal windows AC that the costs were never justified historically. eBPF via LSM hooks allow the community to also reasonably audit what the AC is actually doing/monitoring, and while it is likely to be somewhat of a 'panopticon' spying on everything it can, that is also sort of the point of AC. The big thing we can also hopefully verify/audit is does it actually report back to EAC servers what it spys? or just hashes/minimal sets?
Still, might not be for everyone, but for those who wanted to switch to Linux but couldn't because of EAC this is hopeful.
it's possible to monitor eBPF? well then, that takes a lot of my fears away.
I was concerned that it's basically just like a kernel module (being virtually impossible to keep an eye on), except it's slightly limited by having to use the helper functions and the limited size.
still not gonna use it (at least not until it has actually been verified as "clean", for lack of a better word), but it's good to know that it's even possible to verify it.
More completely, you can strace the bpf() syscalls (and friends, I forget them all, I've got it all well scripted by now) and using strace/ptrace/other standard debugging stuff dump the eBPF binary as its loaded along with all the arguments. That is the "if you don't have a concrete list of the eBPF progs" escape hatch. The vast majority of vendors who provide eBPF progs for security basically have them in a folder/file tree you can just load up anyhow.
For Anti-Cheat, the common pattern for nearly 20+ years is that there is a upstream server that sends micro-programs (think "add the values of these five memory addresses, hash it and send it to the server", if the hash of the five addresses matches known values, some cheater hasn't hijacked them). By the AC server being able to dynamically probe and set these micro-validation programs/scripts, it makes it that much harder for the cheaters in the cat-mouse game, that AC servers/vendors can upload new validation scripts and within minutes have it running against users/players. So a presumption I have is that EACv2 might not have a static eBPF program, but instead a eBPF 'framework' and also occasionally load/update widgits/tools within that framework that the user-space AC can ask eBPF to run. Because of that dynamism it might be easier to track what the EACv2 is doing via live tracing (note, of course live tracing would probably be a thing they'd configure the LSMs to block on the AC, so you'd fail AC validation but thats normally OK for those who know AC reversing safely) than there just being a convienient folder of eBPF progs/LSM setup/config.
Though all this is speculative, we'll only really know once it releases, but shockingly they are using 'all the right at the right places' to make an as-fair-to-morals-of-OSS/Linux AC as you reasonably could.
FWIW, even this eBPF based AC, like kernel-level AC on windows, is trivially defeated by hardware attacks like P2P DMA cards. But nominally those types of cheaters you defeat by server-side statistics and is a whole 'nother topic of how to defend against when the hardware itself can be hostile/un-trusted.
Not as much as kernel module. Games and existing anti cheats are also proprietary. Did you reverse engineer every one of them to make sure they are not already spying on you?
EAC "worked" on Linux, but was generally considered much less capable than the windows version. Also, from what I'm seeing, EAC isn't actually going to be installing a kernel level anything, it's just going to be verifying that the kernel is unmodified. I think that's a pretty good win
Works sure but it's userspace that sort of protection is for the most part trivial you can hack around it relatively simply so for most competitive games it just isn't enough.
I hate kernel level AC as much as the next guy, but we can't pretend that the user space version is just as good because it isn't.
The biggest issue with this right now is that it won't work on the Deck. The Deck doesn't have proper Secure Boot support, which is understandably a requirement for this anticheat. Hopefully Valve finally implements Secure Boot after this announcement.
It ships with an empty key hierarchy by default, and is in SetupMode, but the firmware fully supports Secure Boot, and you can enrol your own PK and then enrol whatever KEKs/DBs/DBXs you want (your own, your distro's, or Microsoft's for Windows) and the firmware will properly do all the things it is supposed to do.
The problem with the Steam Deck is that the UEFI setup user interfaces do not have any toggles for the user to manage Secure Boot. So if you do enrol your own PK and key hierarchy, you better know the UEFI APIs to unregister your PK and clear the key hierarchy, or else you are stuck with Secure Boot in UserMode with no way to turn it off or put it back into SetupMode without reflashing the EEPROM.
I run Secure Boot with CachyOS on my Steam Deck using my own keys with no problem (mostly because I have LUKS with TPM-auto unlocking; and I want to prevent a bootloader swap from being able to steal my keys on boot; thus only images I signed can run).
I'm not the most prolific gamer in the world, but I think I can count on one hand the number of games I own that can't run natively on Linux now without any workarounds or fixes. And each of those that don't run natively, the issue is the anti-cheat. The games themselves are fine, it's just he middleware.
The problem is that the games that worked perfectly fine on linux before are now gonna start using EAC v2 or start making their own implementations once Fortnite sets the precedent. This is a net positive on paper but also opens the gates for much more bullshit down the line.
But still needs TPM2, secureboot, signed kernels, all that crap. Not things we want to promote the use of, in terms of user freedom and device ownership.
idk, secure boot and TPM2 was already required by mane games if you were dual booting to play them on windows, namely riot vanguard and a few others afaik. So its not different in that regard for people playing those games on linux. It's not like one won't be able to just not play those games, which is the current status quo
On Windows, games are like the only software that requires this. It's not like on phones where you can only bank on official Roms, because those banks already don't let you use the browser.
And you have the freedom NOT to play the game. You think freedom means obligation to allow playing if it makes cheating easier? Don't be stupid! Freedom doesn't mean letting it be easy to cheat. The only freedom being eroded is that the game won't work on Cachyos, big deal.
Eventually every "secure" app will do this on Windows and Linux just like they do on phones. The only reason they haven't so far is that people were warning about this for decades so they have to boil the frog veeeeeeeeeery slowly
On Windows, games are like the only software that requires this
Nope.
Windows uses Secureboot + TPM to encrypt "secrets" like your Microsoft account token. If you use the "Windows App" to access corporate services, that checks your computer is secure. If you're signed into a corporate account even, Windows checks that stuff too.
On Linux, this essentially means that whoever is checking your system has to trust your
firmware
bootloader
kernel
kernel modules
If any of those aren't "secure" then get fucked. Need a newer kernel for hardware support, to fix a bug etc? Well tough shit, the anti-cheat doesn't trust it.
People gaming on the ASRock / AMD BC-250, which never had secureboot or even Windows drivers just straight up cannot play BF6 or Valorant etc. because of this.
I literally can't play League of Legends on my Windows 11 computer, all because I purposefully installed Win11 without Microsoft's DRM features that they advertise as "security" features.
I don't want to use TPM, I don't want to use secure boot, and I don't want to use a signed kernel. Linux has its origins as an OS for hackers and developers, I'm all for making it more accessible but there's some red lines. It's like we can use Linux as long as you disable all the stuff that makes Linux great.
oh so because you dont want to do these things noone else should be allowed to?
why should any linux user care what you think? isnt the whole point of linux that you own your machine and can do whatever you want? if thats what a user wants to do with their linux machine it should be their perogative no?
It's like the paradox of tolerance, tolerance of intolerance doesn't count. Linux is about freedom yes, but it's also about not being able to take away freedom - that's the whole point of the GPL which is at the heart of linux.
TPM and Secure Boot don't make Linux not great. Sure, you have the option to not use them, but if a product requires it, oh well. That doesn't make Linux better to avoid it, it makes it worse because you're forced to use Windows instead.
"But I don't wanna use TPM" well I don't wanna use Windows, and you already are using TPM most likely without even knowing it, as it's on by default either in the hardware or in the firmware. TPM is a genuinely good thing, requiring it for some apps doesn't take away from what makes Linux great because it's an OS you can do WHATEVER YOU WANT! Including not playing games that require TPM.
Well, TPM and secure boot is required on boot so you're kinda stuck unless you want to reboot every time to switch. You can't even use kexec. That's a deal breaker. What if Adobe comes to Linux and requires it? Then Chrome does, and a bunch of other apps, and then most Linux desktop environments will be locked down, and then maybe you'll have Linux on Desktop finally but it won't have been worth it since it won't really be Linux.
Linux is the OS that harks back to the old hacker days when PCs were just becoming a thing, where things were open and you were encouraged to tinker with your computer, it's the OS for us.
I take your point, but I gotta believe that the overwhelming majority of people for whom Fortnite and AAA game compatibility is the thing stopping them from switching to Linux, were never going to be running a small niche or custom distro anyway. They were always going to be running Ubuntu, Fedora, Mint, or a gaming-specific distro like CachyOS, SteamOS, or PopOS.
I get you’re talking majorities here, but I consider myself an avid gamer but run Arch on my laptop and only keep windows on my gaming pc to play TFT with my partner and the occasional ARAM. I hate being on that computer though and really look forward to being able to get it switched over to Linux and would prefer Arch so it is the same as my laptop. Though I suppose running another distro would be ok in the meantime, I’d be afraid that would just further leave a disparity between distros and wind up in the same boat as now just a different sea.
Eh, if the publisher was ok with it in user space, I doubt they would suddenly flip on it, plus I'm pretty sure most games aren't updating their anti-cheat versions. We'll see, but if the game wasn't taking anti-cheat that seriously, then it's hard to imagine they'll suddenly take it seriously now.
Who is exactly being locked down? If you've been wanting to play Fortnite this whole time, you have already been locked down to Windows. This just gives those people more choices.
Linux is the only OS left that harks back to the early days of computers. Computers that were left open for the user to hack, change and play with as they see fit.
Requiring this is basically saying, you can use Linux as long as you make sure you rip the soul out of Linux. This kind of lock down, over several generations, taken far enough, is why you can't do anything on your phone.
Alright, well, if we use our brains, companies that let you play with easy anti-cheat turned on weren't taking anti-cheat seriously, so it's unlikely they'll suddenly take it seriously.
Yes, I am quoting the Rust dev and yes, they were actually correct. Deal with it.
I've never played Fortnite and I'm not interested in playing it ever.
It's decent. A fun shooter with ok graphics for kids. Frequent events and mixing things up. Not much deeper than that. It's interesting in the same sense that simply trying a chain store burger, even if you have access to better food. I don't blame you for not trying it though.
But EAC has worked on Linux for years. Elden Ring uses it and has worked on Linux from launch. This is a newer iteration thats being spearheaded by Fortnite.
290
u/TripleSecretSquirrel 17h ago
I've never played Fortnite and I'm not interested in playing it ever. I also don't care for Epic Games, but I think this is a clear win for Linux!
Easy Anti-Cheat is one of or perhaps the biggest/most common anti-cheat engines in gaming today, and basically every AAA game title requires their anti-cheat engine to run. Even if the game itself is Linux-compatible, if the anti-cheat isn't, then you can't run the game. In the past couple years, all of Valve's work on Proton means that basically every Windows game now runs flawlessly on Linux too... with the exception of anti-cheat engines.
I have a handful of friends who are big PC gamers and that's the last big excuse they have for staying on Windows. I don't expect that they'll all finally jump ship for Linux now, but some of them will!