Basically, they are going to use a bunch of security features available on Linux to ensure the integrity of the PC. This includes Secure Boot, TPM2.0, signature of kernel modules, and more.
This should put the Easy Anti-Cheat on Linux on par with Windows, paving the way for no restrictions in the future. As said in the article, some distros might not have the required security/integrity features.
Let’s be honest this is the opposite of privacy or open source of this forum for Fortnite being on Linux
But outside of that perspective of course, Anything to get people onto the Penguin so ill take it
Before they try this they should try that the official NVIDIA drivers work on Linux with secure boot.
Otherwise, this is useless, most gaming devices are using NVIDIA with dog shit secure boot support for official drivers.
This is terrible news. The anti-cheat still has kernel access through BPF, so it can see and has access to literally everything.
I switched from Microsoft Windows 11 Pro to Fedora Linux several months ago. One of the main reasons why is because two different video games I bought on Steam tried to silently install a kernel level anti-cheat as part of an update. I’m not a competitive gamer. I don’t care at all about PvP. I only play either single-player or online PvE. But some games have both single-player modes and PvP modes, and two games that have PvP modes added a KLAC with no warning nor notice. After the second one, that’s what finally pushed me over the edge to leave Windows.
I thought that I’d be safe on Linux and this kind of spyware wouldn’t function, but alas. I just disabled Secure Boot and TPM to prevent this from running. It’s either that or switch to FreeBSD I suppose.
The question is: could this all run in a sandbox and/or with at least source available (and reproducible) modules?
Requesting attestation from the OS, should be able with an API like its on Android (as far as I know)
Spyware is always possible if it’s possible to give apps full access to for example the file system.
The question is not if spyware is possible, but whether if its possible to run apps in a way that they can’t spy on you, for example as a flatpak with minimal permissions.
Both are important for security and should not be disabled
They already work on RHEL or OEL (with RHCK). You just need to enroll the NVIDIA signing key into Secure Boot. Download here:
I’m not sure why their key is not on the whitelist, possibly because they aren’t aware.
Secure Boot being important for security is questionable at best. - Secure Boot Easily Bypassable Using Decade-Old Vulnerabilities
I agree that TPM is important, but it has now been co-opted by Epic Games to violate privacy. I guarantee that while Epic Games is the first, they certainly will not be the last. So off it goes, unless or until an easier or better workaround is found.
This seems likely to cause problems given the poor Secure Boot support on many distros, especially given that it’s happening “in the very near-term.”
We’ll answer any questions you have about getting your distribution aligned with our configuration requirements to get your signing keys added to our well-known list. The list is a core part of how EAC Linux v2 verifies systems, so we’ll maintain it to start. Our goal is to make the well-known key list open source, and we welcome PRs from the community to expand it.
Hopefully distros won’t just be arbitrarily rejected from this list.
When launching a game using EAC Linux v2 for the first time, players will be prompted to install an anti-cheat systemd service which runs only while a protected game is running.
This thing better be open-source. If it’s running some random binary as root or with similar capabilities, no way am I installing this. Give that it needs to load eBPF programs…
A custom kernel can easily be modified to bypass integrity checks and return false data to anti-cheat. That’s why we require that the kernel binary in use during anti-cheat protected gameplay is signed with a well-known key.
RIP Gentoo users I guess?
Kexec is a Linux kernel feature that loads a new kernel into a running system without a full reboot cycle. Because parts of the normal boot flow are skipped, measured boot outputs no longer reflect the running kernel or its configuration. This could be abused to load a modified kernel—or change kernel options—to enable cheating without leaving traces in the measured boot log. We require that kexec is explicitly disabled at boot time.
Well, that’s annoying.
The Steam Deck does not support the required features for our EAC v2 solution, but we are actively talking with Valve and hope to support it in the future.
LOL.
While I hope games that currently refuse to support Linux might start using this and support at least some systems, I very much hope this isn’t going to be used by all the games using EAC v1 that already support Linux.
I’d rather they do this over simply blocking Linux but I worry it’ll become a trend as this should be compatible with most commonly used Linux systems. I wish game companies would simply add the option to use servers which don’t require kernel-level anti-cheat, that way anyone can play without risking their security or hassling with anti-cheat compatibility but the users who have kernel-level anti-cheat enabled still get to (supposedly) benefit from fewer cheaters in their game.
