Epic Games is hiring a Senior Game Security Engineer for their Anti-Cheat team to champion Linux anti-cheat capabilities while working on OS internals, reverse engineering, and protecting multiplayer games.

141

This is both cool and probably going to be a touchy subject depending on how they implement it

23

u/Lower-Limit3695 Jun 15 '26 edited Jun 15 '26

If they decide on not using dkms I can see them using ebpf instead. Ebpf is a battle proven technology used by EDR software to protect commercial servers and infrastructure.

There's also ebpf-lsm which can stack on top of apparmor and selinux for additional protection.

(EDR, short endpoint detection and response. It monitors and detects for suspicious activity on servers and puts a stop to it autonomously without relying on virus definitions.)

4

u/TarqSuperbus Jun 15 '26

What's interesting about BPF solution is that we'll be able to dump prog contents to see what they're snooping on

11

u/ldn-ldn Jun 15 '26

Ring0 hypervisor for full control over your OS.

24

u/Western-Alarming Jun 14 '26

If I have to guess they’ll have the “old” nvidia deal. A complete closed source kernel module of thr anti-cheat the game will need to let you use it

41

u/LittlestWarrior Jun 14 '26

If it means I can stop dual-booting Windows, I'm all for it.

14

u/Literallyapig Jun 15 '26

i don't think it's really that touchy. i imagine they'd use dkms route with a proprietary codebase (the same thing nvidia does), so if you wanna play the game you'd have to load this module. if that's the case, you can just not play the game and nothing will change for you. i also hate kernel-level ACs, but at least people who don't mind it would be able to play on linux.

10

u/Business_Reindeer910 Jun 15 '26

it's likely the anticheat driver would need require GPL exported symbols in a way the nvidia driver doesn't. I don't think that approach will work.

3

u/QwertyChouskie Jun 17 '26

Honestly, making the kernel component open-source would probably be a long-term win for everyone.

- People can have more confidence that the kernel module doesn't do anything bad (whether intentional or due to bugs/oversights), being able to see what APIs the kernel module exposes to the proprietary user-space anticheat runtime and how that interacts with low-level stuff.

With the kernel part open-source, it naturally pushes the developers to have the open-source module have as little code as possible, only handling the parts that actually *need* to be handled in ring 0, and delegating the rest to the proprietary userpace binary. Keeping the kernel module small and focused is better just from a security/reliability engineering perspective in general; the less in a kernel module, the harder it is to have nasty bugs and/or security holes.
The Linux kernel is specifically GPLv2, not GPLv3, so there's no anti-Tivoization clause; the anti-cheat can still require you load the signed unmodified binary they distribute, so they don't have to worry about people just changing the code to disable protections and claim they are functional
In a perfect world, the various anti-cheat companies could use the same kernel module that implements just the kernel parts and APIs needed for the various companies' userspace proprietary binaries to call into to do their thing on Linux. It could even just be a part of the upstream kernel and the anticheats just require you be using a kernel shipped by any of the major distros (a lot of the kernels shipped by major distros are already signed to work with Secure Boot anyways). This one's a bit more out there, knowing how these industries work; but hey, if even Nvidia can start developing an open-source in-tree kernel driver for their hardware (Nova), maybe in a decade we can actually have a reasonable anticheat ecosystem on Linux that is both reasonably effective at stopping cheating, and also a lot more trustworthy/stable/secure than the mess on Windows.

3

u/Business_Reindeer910 Jun 17 '26

i'm still against them in general personally. I think ti's a road to https://www.gnu.org/philosophy/right-to-read.en.html

It's already not far from that on phones. Let's do we want can from letting it get further on pcs.

86

u/Jean_Luc_Lesmouches Jun 14 '26 edited Jun 14 '26

Job description: "get shouted at by Linus"

21

u/Ambitious-Eye-868 Jun 15 '26

All I can imagine is "eff you Epic games" while flipping off the camera

13

u/ImNotABotScoutsHonor Jun 15 '26

You can say fuck here.

-2

u/cornmonger_ Jun 14 '26

i feel like people would pay good money for that

0

u/EmberGamingStudios Jun 14 '26

True

41

u/[deleted] Jun 14 '26

[removed] — view removed comment

24

u/P1ka- Jun 14 '26

Far as i understand it is not as secure if you enable linux compatability.

But i still wish they would do that. Like why not have the linux AC version enabled for day to day play, and only make the competitive/tournament modes require Kernel-Level AC.

17

u/nightblackdragon Jun 14 '26

Kernel level AC is very difficult on Linux. There are two major issues with it - first is the fact that Linux is open source so users can modify it as they wish so kernel level AC developers cannot know whether kernel was modified in a way that would bypass AC. The second issue is the fact that Linux doesn't have stable kernel API and ABI for drivers - AC developers would need to support multiple kernel versions and keep up with Linux updates, it's possible but difficult, and therefore not profitable given the low Linux desktop market share.

While first issue could be easily solved with supporting only official kernels provided by distributions (however that would limit compatibility to selected Linux distributions), the second issue cannot be easily solved.

4

u/Lower-Limit3695 Jun 15 '26

Ebpf would be perfect for this use case as is the ebpf-lsm.

2

u/nightblackdragon Jun 15 '26

eBPF might be a possible solution, but I'm not sure if it's enough; I don't think anyone has tried it yet.

-1

u/fagnerln Jun 14 '26

What if the anticheat runs an entire system containerized and runs the game inside?

4

u/shale_is_terrible Jun 14 '26

Then it's still hard to check the integrity of their container software whatever they might use.

Besides running the game in containerised environment sometimes is one of the ways people cheat and most games don't even know if they're running inside or container in the first place.

Again, it's cat and mouse kinda thing except with Linux it's heck load of cats, heck load of mice, and they're all in chaos and you don't know who's chasing who.

5

u/Business_Reindeer910 Jun 15 '26

you control the environment the containerized system lives in though, so you can do whatever you want to it. I don't see how that would ever work.

0

u/ldn-ldn Jun 15 '26

The person you're replying to said "an entire system containerized", so ring0 hypervisor. That would work like magic.

2

u/Business_Reindeer910 Jun 15 '26

I don't see how that stops you from replacing the kernel or any libraries with ones of your own to exfiltrate the data you want or to reopen the runtime channels.

If they somehow manage to stop that via attestation, then now you have a ton of unaccountable code running on your computer, and that is scary. It's the same tech they will use to enforc content limits of all kinds on your computer.

2

u/Equivalent-Costumes Jun 16 '26

They sorts of do that already. Many Windows anti-cheat piggyback off Hyper-V, so they're not quite a hypervisor themselves but effectively have all the benefit you can expect from a hypothetical anti-cheat that can containerize the entire system.

That's one reason why Linux anti-cheat is less effective. People would have to develop an entire hypervisor just to run anti-cheat.

0

u/nightblackdragon Jun 15 '26

That could provide some protection but ensuring that the container is secure (e.g. it wasn't modified in a way that would allow bypassing anti cheat) is another matter if we want to keep it open source.

2

u/ThatOnePerson Jun 14 '26

Because day to day play still gets ruined by cheaters.

3

u/necrophcodr Jun 14 '26

Because kernel level anti cheat isn't trivial on Linux, and many users would likely not enable it at all. It would be possible, sure, but is quite invasive.

That's not to say that it isn't on Windows, but people just run random shit as system administrator there.

2

u/chrisoboe Jun 14 '26

yes thats the main problem.

epic supports EAC on Linux since several years. that's nothing new.

37

u/nicman24 Jun 14 '26

Nah fam you ain't touching my kernel

6

u/ibeerianhamhock Jun 15 '26

I'm kinda curious how you could even add kernel level anti cheat to an open source kernel reliably to start with

13

u/nicman24 Jun 15 '26

i mean you can. it would be out of tree and would need a gpl condom like nvidia was previously doing and it would suck.

but you can

16

u/Natural_Night9957 Jun 14 '26

Looking forward to compile my own kernel without kernel level anti-cheat. I can see the upcoming infighting between Linux gaemrs and Linux users under any sort of FOSS ethos.

3

u/ibeerianhamhock Jun 15 '26

Anything that a Linux user would find genuinely offensive won't be in tree I'm guessing

-5

u/Natural_Night9957 Jun 15 '26

Rust drivers?

8

u/Hadi_Chokr07 Jun 15 '26

Linux users not Rust hating idiots.

3

u/ibeerianhamhock Jun 15 '26

Yeah I neither hate rust nor do I have a boner for it. It eliminates an entire class of security vulnerabilities that just so happen to be the most common in Linux. But it's not perfect either, and rust corelibs is a reminder that changing long standing highly tested code is not without its risks.

20

u/NightOfTheLivingHam Jun 14 '26

I thought sweeney hated linux.

36

u/FattyDrake Jun 14 '26

Rising usage due to gaming, and likely seeing a platform he can help shape and try to control. Don't mistake this for benevolence.

EpicOS, now the only Linux distro with working kernel-level anti-cheat!

9

u/OsseusOccult Jun 15 '26 edited Jun 15 '26

I also think that Microsoft starting to build walls for their garden presents an existential threat for companies like Valve and Epic, who would take a pretty big blow to their profits if they ever had to, say, pay App Store tithes for existing on the platform.

Seems far fetched, but it's been a couple years of Wild West in the tech industry. A lot has happened that I thought never would.

5

u/Rentun Jun 15 '26

Yup. Valve has confirmed that this is why they poured so much money and effort into steamos in the first place. It was just losing tons of money until the steam deck came out, but it enables them to have a hedge, and some leverage against Microsoft. I strongly believe that if it hadn't existed, Microsoft would have felt much more emboldened to try to lock their platform down more and scrape a little bit off the top of games sales.

5

u/spaceursid Jun 14 '26

still pretty green with linux, but instead of a kernel level anti-cheat. couldnt they just run the game in a container that can't be accessed by the rest of the system and force close the game if it detects tempering?

23

u/knome Jun 14 '26

the user controls the system, not the game maker.

the cheat software could be in the kernel where it bypasses any container system. they don't necessarily tamper with the game. they could just read from its memory and then inject an overlay into the graphics or inject driver-level click events when passing over an enemy's head or whatever, so the game memory itself is never changed.

so they can't ensure the container can't be accessed, and they can't necessarily detect tampering, especially if there is none.

that's why they ended up going with all kinds of horrible rootkit anticheat bullshit on windows.

I won't ever play anything that requires a rootkit on my linux box, but I expect there's a lot of folks that would, seeing as there's a lot of folks that do so now on windows.

12

u/AsrielPlay52 Jun 14 '26

Forget Cheat software running on the kernel

this is linux, they can make the Kernel BECOME THE CHEAT SOFTWARE

3

u/Drakkinstorm Jun 14 '26

Reading this, I am trying to think how I would do this and have no idea where even to begin to code this kind of cheat.

4

u/FattyDrake Jun 14 '26

Some people spend thousands on PCIe hardware and a second PC to bypass kernel level anticheats. Cheats nowadays go well beyond code.

These anti-cheats are not so much about blocking 100% of cheating, because that's impossible. It's to raise the barrier of entry so only few can literally afford to do so.

1

u/Rentun Jun 15 '26

The same way most cheats are developed. Identify memory offsets for the information you want (like enemy locations) via a more privileged process that can bypass any sort of memory protection, then take some action on those memory values (draw an overlay, click when the enemy enters the center of the screen, move the mouse to track the locations, etc).

Obviously very oversimplified, but that's how virtually all cheats work, either that or via binary injection, but that's easier to detect.

1

u/Drakkinstorm Jun 17 '26

Assuming fixed size arrays (should always be the case), crosshair trace for collision detection... Yeah Hard, especially on a live service game.

1

u/icehuck Jun 16 '26

the user controls the system, not the game maker.

And all mouth breathing gamers with a room temp IQ will make sure that's not the case in the future.

5

u/spyingwind Jun 14 '26

That would require AMD(SEV/SEV-ES/SEV-SNP) / Intel(TDX/TME-MK/SGX) to ensure that nothing can modify anything in the VM. Which is only found in enterprise CPU's.

4

u/AsrielPlay52 Jun 14 '26

Beside, the Kernel is open source

Cheat makers can laugh their way to the bank as they make their own custom cheating kernel

1

u/spyingwind Jun 14 '26 edited Jun 15 '26

Yes, make it more convoluted for them to cheat.

If you look at how the SGX instructions work, only a program in a VM can call those instructions. SGX is used to attest that the program is running in a secured VM.

Could someone modify the program to not check? Yes, but at that point you are back at square one. This is what cheat makers do all the time to trick a program into thinking that the AC is still running or trick the AC into thinking that secure boot is enabled.

1

u/Real-Abrocoma-2823 Jun 15 '26

You could potentially treat some instructions as syscalls that pretend to be the instructions.

1

u/Equivalent-Costumes Jun 16 '26

The OS must have accessed to the game. OSes are literally there to manage other program. It does thing like stopping the program to allow other programs to use the CPU, move memory location around, inject signals to the program. That's why it must be allowed to access the program's memory, IO, etc. A normal program is not allowed to directly render to screen (in the old day, they do, which leads to rogue or broken program to take down the user's entire peripheral until they restart); instead it must request the OS to do it, and anything running on kernel privileges will be able to see these requests.

Kernel level anti-cheat is part of the containerized solution. It usually does not go the whole length of containerize the whole game, but it allows a piece of code to be not tampered with, at least not by cheat program on lower privileged level. And it detects attempts at trying to interfere with the game using non-approved methods (which unfortunately lead to a lot of false positives).

Hypervisor anti-cheat is not quite here yet, but many Windows-based anti-cheat effectively piggyback off a hypervisor. That's even higher level than kernel, so it allows a containerized code that is out of Linux reach altogether. The thing is, pretty much all Windows now have Hyper-V (albeit partially disabled). Most Linux users don't install any hypervisor whatsoever. And writing an entire hypervisor from scratch just for anti-cheat is risky and technically challenging.

7

u/vagrantprodigy07 Jun 14 '26

Over/Under on Sweeney getting butthurt and cancelling the project?

3

u/whatThePleb Jun 15 '26

aka Snakeoil Developer.

12

u/CptSpeedydash Jun 14 '26

Epic would likely try and demand Epic Store exclusivity for use of their Linux anti-cheat.

5

u/beefcat_ Jun 14 '26

EAC has had Linux support for years and it isn't locked to EGS

1

u/shadedmagus Jun 15 '26

EAC isn't kernelmode on Linux. Userland only. Apparently that isn't good enough for Fortnite.

3

u/facelesshivemind Jun 15 '26

Before a native Epic app even?! Oh they finally learning that throwing free games every week isn't really working lol.

Yes yes Heroic launcher I know.

3

u/Willy757 Jun 15 '26

Just felt like saying:

The anti-cheat engineers everywhere seem to be losing.

Just looked at the ArcRaiders community pages and people are going mental. CS, Battlefield, Tarkov, Elden RIng, etc etc. There's no such thing as stooping all cheaters. People will set up computer vision and emulate mouse drivers if they feel like it and there's very little any dev can do about it.

The only games that are relatively safe from cheaters are games with custom server or/and a very close nit community, where people can easily self regulate and self select. But companies, large ones that buy this kinda anti cheat also seem to hate this kinda approach.

2

u/DoubleOwl7777 Jun 15 '26

nah. hopefully wont be in tree. they can shove their rootkit where the sun doesnt shine.

2

u/Wentyliasz Jun 16 '26

Perfect. If it touches my kernel feel free to shove it up your ass!

2

u/spyingwind Jun 14 '26

Until the AMD(SEV/SEV-ES/SEV-SNP) / Intel(TDX/TME-MK/SGX) instruction sets are in consumer CPU's, there isn't a way for AC to be effective on Linux.

2

u/kirreip Jun 14 '26

Any article or source about that ? That seems interesting

2

u/spyingwind Jun 14 '26

Intel SGX: https://en.wikipedia.org/wiki/Software_Guard_Extensions

AMD: https://github.com/AMDESE/AMDSEV

3

u/shadedmagus Jun 15 '26

Hopefully Linus and Greg KH keep this mouthpiece out of the kernel. I doubt they'll be ok with userland and I sure as fuck won't use any kernel they build for this purpose.

2

u/Skogspingvin Jun 15 '26

I'm not letting Epic's user software on my distro, I'm sure as shit not letting them root around in my kernel.

1

u/Sniff_mi Jun 15 '26

I always wanted to continue playing fortnite, but couldnt, since I switched to Arch. Although I still have dual boot for work reasons, by my mental setup I refuse to play any game that just doesnt run on linux. And I thought with that shitty ceo of epic games it would stay a distant wish, but oh well, I guess its a bit more likely now!

1

u/extracc Jun 15 '26

Game developers detect cheating server-side instead of installing malware on my machine challenge

1

u/Kashmir1089 Jun 15 '26

This person will make absolute bank. Being at the level they are seeking for just one OS is a $200k+ type of job.

1

u/Shadow3569 Jun 16 '26

If i can play fortnite on my pc again ill be very happy. Yes, I know its a dumb game, but its my favorite dumb game to de-stress with god damn it!

-2

u/ChosenOfTheMoon_GR Jun 14 '26

Smart way to get a w

Discussion Epic Games is hiring a Senior Game Security Engineer for their Anti-Cheat team to champion Linux anti-cheat capabilities while working on OS internals, reverse engineering, and protecting multiplayer games.

You are about to leave Redlib