That’s not what this is doing. From my understanding, the kernel doesn’t include any new code made by Epic. It just needs to support Secure Boot and a bunch of other requirements, all of which are already possible with existing Linux solutions.
The anti-cheat wants to verify that you haven’t fucked with your system, there are ways to do that and EAC requires that your setup can credibly after attest to it.
On Windows, we rely heavily on a kernel driver to protect the games. This driver isn’t always on, it starts when a game is launched and stops when the player exits. For EAC Linux v2 we will not leverage an equivalent kernel module, and instead we’ll take full advantage of existing Linux platform security features like measured boot, the kernel lockdown LSM, and IOMMU support, plus our own eBPF logic to maintain integrity and detect cheaters. These security features are not available on every distro and may require configuration changes to activate.
I agree with your sentiment though. But somehow, against all odds, the “programming is too hard” people landed on a solution that sounds pretty good to me.
The problem is not the high-level solution. If the anti-cheat does what they claim – great.
If.
The problem is that EACv2 itself is unverified machine code running with elevated privileges. Unless the source code is released, it will be impossible to know what kinds of shenanigans it engages in. It demands that users trust it implicitly, along with the people and clankers that wrote it, the mistakes they made, and the people and interests they are beholden to.
Trust should be earned, and the fact that people have been indoctrinated to give it away freely should be deeply concerning to everyone.
If you wanted to test it, you could try sandboxing it to run as an unprivileged user with access to nothing else on the operating system. They claim it will run without needing sudo or root.
I’m not gonna test it though. I’m not willing to use a distro that doesn’t let me compile and install my own kernel modules.
[edit] I read a bit more, looks like they are allowing unprivileged code into the kernel. That’s apparently what eBPF does.
I don’t care how good the solution is, I’m not having my shit get attested for no good reason. If needed I’ll just wait for a game to get cracked. I’m not installing any anti-cheat enabling bullshit.
Someone on reddit wondered if this is the embrace phase of embrace, extend, extinguish.
This is what most people arguing in favor of this don’t get. This changes the entire ecosystem via some kind of peer-pressure once more and more game developers implement EACv2 (from the side of both developers as well as players). And other AC vendors like BattlEye will likely also follow suit. Imagine letting Tim into your kernel… I’m not even letting Gabe into my kernel.
Also RIP custom kernel modifications/tweaks for the sake of performance or new features if you want to play any future game which will implement EACv2. Also RIP applying in-development or bugfix patches, especially AMDGPU ones. And RIP OOT modules for niche hardware that’s not packaged by the distro.
Personally, I don’t even play any competitive multiplayer games so I generally have no interaction with anticheat one way or another. For that reason, I don’t see myself doing the steps required to get EAC v2 working.
But, given that there are loads of people who:
Want to play and enjoy these competitive multiplayer games
Don’t want cheaters to ruin the game for them
Acknowledge that cheaters will ruin the game if nothing is done to prevent that
Then, some trade-offs are inevitable. Anti-cheat is required for that, there’s no getting around it. That is the “good reason” for which the attestation is needed.
Maybe for you that’s not a good reason - that’s fine, it’s the same for me, I just don’t play those kinds of games and so the games I play don’t need anticheat. There’s really no reason to get angry with a solution that DOESN’T AFFECT YOU if you’re not interested in it, but actually serves a purpose for others.
That’s not what this is doing. From my understanding, the kernel doesn’t include any new code made by Epic. It just needs to support Secure Boot and a bunch of other requirements, all of which are already possible with existing Linux solutions.
The anti-cheat wants to verify that you haven’t fucked with your system, there are ways to do that and EAC requires that your setup can credibly after attest to it.
Video going over the requirements (with timestamp): https://youtu.be/3Xi7m0CYk5s?t=7m39s
Source: https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2
I agree with your sentiment though. But somehow, against all odds, the “programming is too hard” people landed on a solution that sounds pretty good to me.
eBPF does run in kernel mode.
Maybe better than a module, but I wouldn’t say “the kernel doesn’t include any new code”
It’s also why they have to use “integrity” mode of kernel lockdown
If they used “confidentiality” mode, their eBPF code would be untrusted by the kernel and couldn’t be loaded
The problem is not the high-level solution. If the anti-cheat does what they claim – great.
If.
The problem is that EACv2 itself is unverified machine code running with elevated privileges. Unless the source code is released, it will be impossible to know what kinds of shenanigans it engages in. It demands that users trust it implicitly, along with the people and clankers that wrote it, the mistakes they made, and the people and interests they are beholden to.
Trust should be earned, and the fact that people have been indoctrinated to give it away freely should be deeply concerning to everyone.
If you wanted to test it, you could try sandboxing it to run as an unprivileged user with access to nothing else on the operating system. They claim it will run without needing sudo or root.
I’m not gonna test it though. I’m not willing to use a distro that doesn’t let me compile and install my own kernel modules.
[edit] I read a bit more, looks like they are allowing unprivileged code into the kernel. That’s apparently what eBPF does.
Stay far away from this project.
Holy shit, that’s like
curl | sudo bashon steroids. Fucking hilarious.I don’t care how good the solution is, I’m not having my shit get attested for no good reason. If needed I’ll just wait for a game to get cracked. I’m not installing any anti-cheat enabling bullshit.
Someone on reddit wondered if this is the embrace phase of embrace, extend, extinguish.
https://www.reddit.com/r/linux_gaming/comments/1xgm7qi/comment/19rq81f8dnsyt/?context=3
…like the current Nvidia drivers that you need to build (and sign in case of secure boot) the kernel module for ?
There’s a reason people recommend AMD over NVIDIA for Linux use.
Personally, I don’t even play any competitive multiplayer games so I generally have no interaction with anticheat one way or another. For that reason, I don’t see myself doing the steps required to get EAC v2 working.
But, given that there are loads of people who:
Then, some trade-offs are inevitable. Anti-cheat is required for that, there’s no getting around it. That is the “good reason” for which the attestation is needed.
Maybe for you that’s not a good reason - that’s fine, it’s the same for me, I just don’t play those kinds of games and so the games I play don’t need anticheat. There’s really no reason to get angry with a solution that DOESN’T AFFECT YOU if you’re not interested in it, but actually serves a purpose for others.
you still shouldn’t use it and support these asshats. i don’t care if this one thing is good by chance. that’s a single living tree in a forest of rot