2 ms·

EAC supports Linux, but by doing so you're disabling a number of security features since you're making the anti-cheat run entirely in userspace. Remember these

by tapoxi 1mo ago

EAC supports Linux, but by doing so you're disabling a number of security features since you're making the anti-cheat run entirely in userspace. Remember these games aren't Linux native either, so it allows Windows-using cheaters to lie to the process that they're on Linux and to only use userspace protection. The cheat then runs in kernel space and remains invisible. The only realistic way to solve this on Linux is enforcing secure boot w/trusted kernels and then running the anti-cheat in sandboxed eBPF kernel space. Embark is looking at this approach.

altairprime 1mo ago
> The only realistic way to solve this on Linux is enforcing secure boot w/trusted kernels and then running the anti-cheat in sandboxed eBPF kernel space. Embark is looking at this approach. Assuming secure boot, there’s another realistic way, which is to use vendor-signed readonly Linux OS images — not just kernels — that disallow process memory access to root, come with signed kernel drivers, and offer secure attestation support chained to secure boot. Steam Linux and Bazzite could both implement this easily; the former has a fixed hardware target list and the latter is already an ‘all in one’ solution. Since Linux users are generally competent at dual-booting, one would simply dual-boot into the sealed image to play PvP multiplayer games, no eBPF development or maintenance of anti-cheat required. Embark is within their rights to evaluate the workload of supporting DIY unsigned Linux instances through eBPF but doing so would create a viable competitor to an attestation-derived Valve Anti-Cheat for Steam Linux, and so likely inspire the giant in the room to step up and obsolete it.
trashb 29d ago
> EAC supports Linux, but by doing so you're disabling a number of security features since you're making the anti-cheat run entirely in userspace. I see I was assuming EAC is EAC, but it seems there is a difference between the kernel mode version (windows) and the client mode version (linux). There are different assurances and therefore not the same security can be guaranteed. In that case it can indeed be that the assurances on linux are not sufficient. However I think the EAC marketing or documentation is a bit unclear/misleading around this issue. Still I think they should offer the game for the customers on linux, though maybe they are not allowed in the competitive lobbies?

by tapoxi 1mo ago

altairprime 1mo ago

> The only realistic way to solve this on Linux is enforcing secure boot w/trusted kernels and then running the anti-cheat in sandboxed eBPF kernel space. Embark is looking at this approach. Assuming secure boot, there’s another realistic way, which is to use vendor-signed readonly Linux OS images — not just kernels — that disallow process memory access to root, come with signed kernel drivers, and offer secure attestation support chained to secure boot. Steam Linux and Bazzite could both implement this easily; the former has a fixed hardware target list and the latter is already an ‘all in one’ solution. Since Linux users are generally competent at dual-booting, one would simply dual-boot into the sealed image to play PvP multiplayer games, no eBPF development or maintenance of anti-cheat required. Embark is within their rights to evaluate the workload of supporting DIY unsigned Linux instances through eBPF but doing so would create a viable competitor to an attestation-derived Valve Anti-Cheat for Steam Linux, and so likely inspire the giant in the room to step up and obsolete it.

trashb 29d ago

> EAC supports Linux, but by doing so you're disabling a number of security features since you're making the anti-cheat run entirely in userspace. I see I was assuming EAC is EAC, but it seems there is a difference between the kernel mode version (windows) and the client mode version (linux). There are different assurances and therefore not the same security can be guaranteed. In that case it can indeed be that the assurances on linux are not sufficient. However I think the EAC marketing or documentation is a bit unclear/misleading around this issue. Still I think they should offer the game for the customers on linux, though maybe they are not allowed in the competitive lobbies?