Awesome Gaming on Linux Without Cheating
23 points by calvin
23 points by calvin
Burying the lede: The anticheat used in Fortnite and other titles will support Linux soon. Support will be done via eBPF rather than kernel modules, and will require a measured boot with only a few trusted Linux distribution keys.
All in all I think measured boot is really the only way to ensure anti cheat on Linux. I’m glad they’re going with an eBPF module rather than a kernel module too, I presume that will alleviate a lot of concerns.
It’s a shame that this effectively forces users to use distro kernels (and hence removes some flexibility), although I can’t really see any other way around it. I guess you can always have multiple kernels available on the bootloader, so it’s at least better than dual booting Windows. I hope that make it easy for distros to be supported.
I also wonder if NixOS will be able to find some way to be supported, last I checked boot attestation on Nix required self-enrolled keys (since otherwise you couldn’t reproduce the distro kernel build, the private key is an input after all…). I guess that you can at least confirm the signing matches an unsigned kernel + public key, so it’s not really that bad from an untrusted build standpoint (though Nix will need some way around it for sure).
All in all I guess I feel OK about this. Cheating is definitely a big market for some reason, and although I don’t play multiplayer games I repeatedly see people complain about cheaters on games with weak anti cheat, so I understand why devs go for it and I’m glad to see that they are taking Linux seriously.
I’m glad they’re going with an eBPF module rather than a kernel module too, I presume that will alleviate a lot of concerns.
This runs code written by Epic as root, and requires remote attestation of the boot configuration.
The only concern this alleviates is reducing the impact of possible incompetence.
though Nix will need some way around it for sure
This is the least of the problems. At worst, create a separate repository that submodules Nixpkgs and provides signed kernels (in case of bit-reproducible version, the kernel might be built normally then a signature fetchurl-ed and added separately). You need to automate some pushes, but no need to change Nix itself.
create a separate repository that submodules Nixpkgs and provides signed kernels
Or just have Nix fetch binaries for Universal Blue, Ubuntu, Fedora, Debian, etc. and boot those into the NixOS initrd. I've done this before for using vendor hardware kernels (e.g. getting Samsung phones to run NixOS) and it works. You of course are stuck with a kernel which NixOS can't do much with, but if it supports the modules initrd needs, you're totally good.
I also wonder if NixOS will be able to find some way to be supported
Emily has been working on Secure Boot and NixOS for a long time. Realistically it seems a year or two away:
https://discourse.nixos.org/t/eac-linux-v2-requirements-vs-boot-security-work-in-549372/80560/9
Remote attestation technology is horrible in that it restricts what someone can do with hardware they are supposed to own. We really should be objecting to things like this.
Yay, more ineffective surveillance instead of server-side validation, woo!
I look forward to watching friends of mine demonstrate the irrelevance and overstep of whatever they deploy.
This, weirdly, would suit my setup quite well: Linux mint for "fun" (gaming, DRM media) and FreeBSD for anything "serious" (work, hacking, etc.).
OTOH Fortnite isn't anything I'm interested in, so 🤷♂️