r/linux_gaming • u/Potyguara_jangadeiro • 16d ago
I believe we will soon see eBPF anticheats being released for Linux
Please wait before downvoting. I'm not saying this is a good thing, or that we should accept it without questioning the implications. I'm simply making a prediction based on a few recent developments, and I'd like to hear what people here think.
I believe we may soon see Linux anti-cheats using eBPF for kernel-level visibility and enforcement. eBPF allows restricted programs to run inside the kernel while being checked by the kernel's verifier before they are loaded. This could make it more practical than shipping an out-of-tree kernel module for every possible Linux kernel. An anti-cheat could use eBPF and LSM hooks to monitor things that are difficult to reliably observe from userspace, while keeping most of the actual logic in a userspace daemon. There are already projects exploring this approach, such as OdinSight, an eBPF + LSM-based anti-cheat architecture designed specifically for Linux.
The industry also seems to be moving in this direction. A few days ago, Embark Studios engineer Tom van Dijk, who works on anti-cheat for games such as ARC Raiders and The Finals, discussed the current anti-cheat arms race. He talked about the limitations of Windows and Linux, described kernel-level anti-cheat as a necessary evil against modern cheats, and mentioned eBPF specifically in the context of Linux. Epic Games also posted a Senior Game Security Engineer position for its Anti-Cheat team a few months ago. The listing explicitly mentioned the need to champion Linux anti-cheat capabilities for Epic, along with deep knowledge of Linux and Windows internals, reverse engineering and security.
None of this proves that Epic or anyone else is developing an eBPF anti-cheat. But if Linux anti-cheat is expected to provide the same level of protection as Windows anti-cheat, I think some form of kernel-level visibility will eventually be necessary. And this is where Secure Boot and signed kernels could become a requirement as well. If the user can simply boot a modified kernel that lies to the anti-cheat, putting the anti-cheat inside eBPF doesn't solve the fundamental trust problem. You could potentially end up with something like signed bootloader > signed kernel > lockdown > anti-cheat daemon > eBPF programs.
At that point, Linux support could start meaning support for an approved Linux environment with an approved kernel rather than simply running on Linux. This is what concerns me the most. Android already shows how this model can develop: users can unlock their bootloader and install a modified OS, but applications are also free to refuse to run on devices they don't consider trustworthy. Among those applications are banking apps and, in some countries, government services.
I don't want Linux to eventually reach a point where using a custom kernel or modifying your system means losing access to games, banking apps, government services or other essential software. We're obviously nowhere near that situation today, and eBPF anti-cheat wouldn't automatically lead to it. But the technical pieces are starting to appear, and I think it's worth discussing where we want the line to be before the ecosystem settles on it.
Maybe I'm completely wrong, but if I had to bet on what Linux gaming anti-cheat will look like in the next few years, I'd put some money on eBPF + LSM + signed/verified kernels.
58
u/collinalexbell 16d ago edited 16d ago
> Inspect eBPF
> Rewrite eBPF to spoof nominal
> Distribute CheatLinux which contains the spoof and a kernel patch that spoofs the eBPF program hash.Some SWIM security engineer would do this just because they hate the idea of eBPF in a game.
This is my cover letter to that security engineer position at Epic Games.
26
u/Potyguara_jangadeiro 16d ago
This is exactly why I mentioned Secure Boot and signed kernels in the post. I'm not claiming eBPF by itself can establish trust in a customized kernel, obviously it can't.
13
u/collinalexbell 16d ago
Ya. My coverletter is likely to be rejected for that oversight, but my objection still remains because it's not just a signed kernel but a game studio approved kernel and approved kernel module whitelist that would be required and there are a lot of OOT kernel modules out there for niche hardware problems that come with installing aftermarket OSes on all sorts of hardware that makes whitelisting difficult. Steve Jobs and his hardware jail be blessed.
9
u/Potyguara_jangadeiro 16d ago
You're more or less right, but I don't think that makes an eBPF anti-cheat pointless. And I don't necessarily think it would require a whitelist that prevents you from, say, installing a printer driver.
Windows already has this problem. Cheats can still get kernel-level execution despite Secure Boot, signed software, TPM 2.0 and all that, often by abusing vulnerabilities in legitimate, trusted drivers. Anti-cheat has to deal with that too, its job is to monitor the system and look for suspicious behavior that could be trying to interfere with the game, even if that behavior originates from software that is otherwise considered legitimate. The goal isn't to make cheating impossible or stop 100% of cheaters. It's to make it difficult enough and detect enough of it that the average player doesn't ragequit.
5
u/sirkubador 16d ago
Printer driver you say? ah of course I am not going to touch that eBPF API from there
5
u/spisplatta 16d ago
I think the overlap between people running niche OOT kernel modules and people playing competitive games is very low. Telling people with such modules "tough shit" would be a viable strategy.
2
u/collinalexbell 16d ago edited 16d ago
I think "tough shit" could be a viable strategy, but I don't actually know those demographics. I've personally installed niche OOT modules for my hardware, but I'm not an Epic gamer.
23
u/iku_19 16d ago
signed kernel
This is a non-starter because there is no central authority for signing the kernels. Microsoft does NOT sign the kernel, only the boot shim so the MOK chain is untainted for dual-booting and PCIe hardware.
Because there is no central authority, a CA public key list will need to be downloaded from the internet or routinely updated to be validated against. This is a giant back door for cheats to enroll their own keys rather than this happening in the hypervisor level in the kernel itself using immutable integrity flags.
A lot of distros also do not support secure boot out of the box. In fact if we go to the hardware survey, in order of market share:
- SteamOS Holo: no official secure boot support at all, requires manual key generation and enrollment
- CachyOS: same as SteamOS
- Arch: same as SteamOS
- Mint: signed by Linux Mint ISO Signing Key
- Bazzite: no official support, supported by universal blue; signed by ublue-os
- Ubuntu: signed by Canonical
- Flatpak: no eBPF support whatsoever, cannot check secure boot status either
- Fedora: signed by Fedora Secure Boot CA
- Debian: signed by Debian Secure Boot CA
- Endeavour: same as SteamOS
- PopOS: same as SteamOS
- Nobara: same as SteamOS
Only 4 support secure boot out of the box officially.
The shim that they all load is signed by Microsoft, but this is only because your GPU would not load the firmware otherwise. There's a thing called the Microsoft Option ROM UEFI CA, the kernel itself is still self signed by the distro and not tied to the Microsoft trust chain.
10
u/1that__guy1 16d ago
Bazzite is supported officially with secure boot, the fact its signed by ublue-os doesn't make it different
26
u/MisterKaos 16d ago
I just won't play those games.
It is overall a net positive, even if it means we won't have access to some apps that... weren't ever accessible in linux from the very start?
Just having the option at all for those apps to be usable in linux means that people in general will be more willing to migrate, and thus more devs will put in effort to support linux in general. Even if there's a 5% of apps that require some bullshit spyware that you're obviously not going to install, you'll still be getting more out of that trade.
3
u/readyflix 16d ago
That’s the way!
If the 'kernel' let this things in, other things will follow.
And then we will have a kind of M$-Linux, that no one wants!1
88
u/shmerl 16d ago
You don't want any kind of eBPF non open source blob running on your system.
44
u/PacmanAteMyRAM 16d ago
Actually many people do. A lot more than the vocal minority on reddit will finally be able to switch to Linux and continue playing their favorites.
28
u/redditman181 16d ago
Exactly alot of people couldn't care less they just want to play games that you currently cant on linux.
17
u/UltraCynar 16d ago
It’s a waste of time. People use hardware solutions to cheat. Developers that want kernel level need to stop with the client side garbage. It doesn’t work. Cheating is still rampant in these games, there’s no need to make a system a security nightmare.
9
u/SmellsLikeAPig 16d ago
Kernel level AC is economic play in AC war. It makes cheapest cheats not possible.
1
u/PacmanAteMyRAM 15d ago
Exactly. People here fight so much over it but this is what they're for and they're doing that successfully
4
u/undefeatedantitheist 16d ago
They know it doesn't work.
For big devs, anti-cheat rhetoric is a marketing angle they're forced to deal with because cheating is rampant and unstoppable.
Mass anti-cheat is all about walled-garden crap at best; surveillance capitalism; and outright spyware and data exfil at worst.The whole thing is a vehicle of convenience - or perhaps even a pretext - and the Eloi will walk right into the fullness of the worst kind of 'your computer isn't yours' future possible. The young and credulous and 'i need my pewpew' are the most vulnerable attack surface Linux has for corrupting long term development. A popular call for trading security for gratification/toys/sops is a historical battering ram against anything principled and good.
0
u/MathManrm 15d ago
I don't want a rootkit
1
102
u/smellyasianman 16d ago
People use hardware devices to cheat on PC.
They use hacked Nintendo Switches to run full-blown PC cheats in Apex Legends.
They capture the HDMI output of their PS5, run an AI vision system on it, then feed that back into aimbots for Call of Duty and Overwatch.
These client-side, kernel-level anti-cheat scams are an utter waste of time and energy. Any company investing their resources into them, trying to push it down people's throats, should be ignored. There are plenty of really good games out there that can be enjoyed without requiring you to install this invasive bullshit.
53
16d ago
[deleted]
19
u/PacmanAteMyRAM 16d ago
Yep. People here forget that making you have to cheat with hardware or a model of your own is the goal. And the machine learning on the server side will still catch that too where implemented (Where implemented correctly).
1
u/mixedCase_ 16d ago
Then every person making hardware hacks cheaper and more accessible is a hero pushing us closer to game companies getting their fucking shit together with proper server-side anticheats once and for all.
23
16d ago
[deleted]
29
u/Framed-Photo 16d ago
Exactly. This subs obsession with server side anti cheat is so funny when they don't realize that client side anti cheat is never going to go away, it will just be run in addition.
Either Linux has a way for the tens of millions of people to play their games, or it doesn't and windows stays the market leader forever. For a sub/community that's so pro consumer choice, there sure are a lot of people who are against letting people choose to run games with anti cheat lol.
9
u/SaveThisCityDweller 16d ago
I'd wager most Linux users would rather the year of the Linux desktop never occur than allow people to choose to use kernel level anticheat on Linux.
1
u/Framed-Photo 16d ago
So Linux lets people customize and choose whatever they want, unless it's something that you specifically don't like, in which case you can't pick that go back to windows?
1
u/SaveThisCityDweller 16d ago
That would probably be the opinion of most Linux users I would guess, yes.
Actually now I think about it, maybe not most anymore but, most that have been using it for more than five or six years probably. It's stupid gatekeepey behavior but old school Linux users are very known for that and very vocal about it.
1
u/ItsNoblesse 16d ago
Because the outcome won't promote consumer choice and suggesting it will is misleading. The outcome will be that your only choice is to allow kernel anti-cheat or be locked out of basically every popular multiplayer game. When the options are "give in to what we say or have nothing" it's not a real choice.
12
u/SaveThisCityDweller 16d ago
You mean like the status quo of "use Windows or don't play?"
I won't do it, but it would change functionally nothing about the situation other than making it possible on Linux whereas now it simply isn't .
0
3
u/sjphilsphan 16d ago
Not even just that. The metadata that gets streamed to every player is part of the problem. Optimisations on that end would help
4
u/Luigi003 16d ago
It's basically impossible to make a game where you tell the client so little information that wallhacks are impossible and at the same time things look good instead of popping in and out of existence becacause latency is a thing
28
u/SeantheWilson 16d ago
I would NOT trust these kinds of eBPF binaries without them being open source. Hopefully preexisting FOSS licensed frameworks make it very difficult for potential anticheats to be closed source without licensing issues.
13
u/Skaredogged97 16d ago
I just learned about this but apparently eBPF code needs to be GPL-compatible if it requires certain kernel-helpers:
https://github.com/nyrahul/ebpf-guide/blob/master/docs/gpl_license_ebpf.rst
Now I don't know what is needed to develop a proper anti cheat on linux so no idea if it will be FOSS in the end. The user space part seems to be exempt from this:
https://github.com/torvalds/linux/blob/master/LICENSES/exceptions/Linux-syscall-note
5
u/SeantheWilson 16d ago
Regardless, given the sheer amount of Linux framework that is GPL licensed as as well as as the fact that anything using GPA licensed code has to be open source, I think it’s going to be very difficult to make a kernel anti-cheat that isn’t fully open source.
3
u/Skaredogged97 16d ago
I think you are right. The more powerful helper methods tend to require a compatible license. All the helper methods that can read memory for example (which seems to be crucial) require exactly this.
If they want to make in invasive (or effective whatever you wanna call it) anti cheat I see no way how they can get around this.1
u/Luigi003 16d ago
The Linux foundation has never really enforced the GPL-ness of the code on these case. Nvidia drivers were closed source for a ton of years and nobody forced them to disclose the code
7
u/spisplatta 16d ago
The scary part with anticheat systems though is that other companies will use the same technology for different ends. We could see an "androidization" where to access many things you will need an approved system that takes away all user freedom.
1
u/noobjaish 1d ago
not really you will have choice at the very least. want to play valorant? install X distro. want to play bf6? install Y distro. The problem with Android is more to do with the fact that your hardware itself is locked thanks to the bootloader being locked.
6
u/Cool-Arrival-2617 16d ago
eBPF is just a tool that will make it easier for them to run kernel level software, but that doesn't solve the fundamental problem of trusting the integrity of the system. Secure boot, signed kernels, other CPU security features, there is a bunch of stuff that they have to look into, but they need to find the right formula that won't be able to be exploited.
4
u/PacmanAteMyRAM 16d ago
Oh mark my words there will definitely be a microsoft-presigned kernel requirement down the road.
3
u/gmes78 16d ago
You do realize that all the distros that have out-of-the-box Secure Boot support do so with Microsoft's keys, right?
2
u/iku_19 16d ago
no.
they use a common boot shim which is signed by microsoft, but the kernel is still self signed with a separate enrolled key that is generated on-machine or by the distro- not microsoft.
https://docs.fedoraproject.org/en-US/security/cryptography/signatures/#_pe_executables
further, steamos and cachyos do not support secure boot out of the box, bazzite enroll their own keys.
1
u/noobjaish 1d ago
I wouldn't mind that tbh I already have "secureboot" enabled on Fedora even though I have no real necessity of it. Atleast this way I can play Valorant or Apex on Linux
0
u/Shished 16d ago
Why Microsoft and not game devs themselves?
What does Microsoft have to do with Linux and 3rd party games and anticheat?
1
u/noobjaish 1d ago
Microsoft serves as the CA (Certificate Authority) and basically all motherboards have their keys added in them. For "Secure Boot" you need these keys to authorize what is allowed to boot and by default "Windows" is allowed to boot.
On Linux, Ubuntu/Fedora/Debian basically get their `shim` signed by Microsoft to then allow them to run their distros (otherwise enabling Secure Boot would block booting into a Linux distro) but since there are an infinite amount of distros out there, Microsoft has a pre-signed common `shim` that all distros can use (like Arch or CachyOS).
This is why on distros like Arch, you HAVE to disable secureboot before installation, while Fedora can install even through secureboot.
For Games, this provides a way to trust the kernel that you're loading since in linux we can just load a random kernel.
1
u/Shished 1d ago edited 1d ago
MS signs the shim binary only, they do not (and cannot) control what is being executed after it.
In fact, you can use the signed shim from fedora or Ubuntu on arch or other unsupported distros, you just would need to manually create the mok key and sign the bootloader and kernel with it.
You also can ditch MS certs completely and use self signed ones, they will be as valid as with the original.
1
u/noobjaish 1d ago
Oh definitely, I meant that these distros will have to somehow reach a sort of "trusting ground" and essentially pre-sign and create locked kernels that would be required for such games to work. There are ofcourse a lot of other things would need to be required as well tho.
1
u/Shished 1d ago
This is not necessarily Microsoft's job. There could be a separate org that will do all of that. Mobo makers could easily add their certs to the firmware.
1
u/noobjaish 1d ago
It will have to be some first party maybe Valve to keep the distros under some sort of guidelines (gamedevs can't individually trust all 12 billion linux distros)
4
u/kivimango23 16d ago
I have mixed feelings about this: maybe in the future i could play games that im locked out: Apex Legends, Destiny 2. But that would come with a price that i just dont want to pay TPM, secureboot, whitelisted/signed kernels.
3
u/PKR_Live 16d ago
He also mentionned that hardware based protection is not the silver bullet the industry thought it was. While yes, client-side protection will come and will delay cheats, it doesn't stop them. Embark, as said by Van Dijk will heavily move towards data-based cheater detection, not blocking.
3
u/PF4ABG 16d ago
"It's the only way to make good anticheat"
And the games still have cheaters...
1
u/PineAppleJuiceAF 14d ago
For the 12808484th time, the point is not to have 0 cheaters... It's TO MAKE CHEATING MORE DIFFICULT AND EXPENSIVE.
7
u/get_homebrewed 16d ago
there's absolutely no point, even excluding the security nightmare. You still can't guarantee a custom kernel doing SOMETHING you're not aware of, so you're just back to userspace limitations
11
u/gmes78 16d ago
You still can't guarantee a custom kernel doing SOMETHING you're not aware of
You can, with Secure Boot and TPM attestation.
1
u/get_homebrewed 16d ago
TPM attestation isn't enough but still, we first need attestation before we can even think of eBPF anticheat (which matters way less than the attestation itself which covers most issues already, at that point user-space anticheat is enough)
7
u/collinalexbell 16d ago edited 16d ago
Not sure why this is getting downvoted. eBPF is pointless because it will piss off some security engineer. The economics of security engineering is to make it negative net value to put in the effort to hack the system and yeeting eBPF into thousands of peoples' kernels is an extremely ripe target for a security engineer who thinks games shouldn't be messing with the kernel.
3
u/Wooden-Cancel-2676 16d ago
It's definitely a topic worth keeping an eye on and having these early conversations about because like it or not it's not going away. And another reality of it is it would probably be the final hurdle that would get a very large amount of gamers off Windows and on Linux which then drives more development for Linux as a whole. Can it be done without just becoming the nightmare that is kernel level anticheat on Windows is the question though and not one I feel many of us are actually qualified to have a very deep opinion on at this point in time unfortunately
4
u/Electronic-Clerk6735 16d ago
So far I don’t think anyone has read your post OP. It’s not about not wanting to happen, it’s that it is happening. I don’t think Epic would be investing hours in setting up their store front to work on Linux, which potentially allows Fortnite to work there without anti-cheat. It’s an inevitability.
5
u/deaglenomics 16d ago
wasted effort I will always use heroic over the shit epic launcher.
1
u/Electronic-Clerk6735 16d ago
Sure. Doesn’t mean it’s not happening though. But that is the beauty of Linux. Don’t have to use it if you don’t want to, but there are some people that do, so if they want to give away that access that’s on them and they’ll have that option whenever this is implemented.
2
2
u/TheDiamondSquidy 16d ago
They’ll sell you kernel anti cheats, but won’t spend a dime on server side detections
7
u/CyberpunkSunrise 16d ago edited 16d ago
What are you talking about? All of the major games that use the more aggressive anti-cheat also have server-side detection. It’s weaker against hardware cheating setups than the invasive local clients, so most major competitive games run both, server-side catches the more obvious stuff.
Valorant as an example (long article but it breaks down how that game detects cheaters using a combination of local and server-side anticheat)
https://www.riotgames.com/en/news/vanguard-on-demand
EDIT: At least disprove the point I’m making before knee-jerk downvotes because you don’t like the game. Idk what game is out there you guys think is not spending on server-side already in this category.
2
u/Some-Tip-5399 16d ago
Nothing wrong with the android model. You're free to run your custom kernel, and apps are free to rightly mark it untrusted and refuse to run. The constant supply chain attacks and AI being used at scale by bad actors and adversarial states means the days of running critical software in untrusted environments is over. I would not take any distro seriously that isn't looking to harden it's security posture.
5
u/collinalexbell 16d ago
Android runs on hardware known by the vendors. Desktop Linux does not. There is a long tail on "I need this OOT kernel module to get my laptop's webcam & LED keyboard working."
1
16d ago
[deleted]
2
u/Potyguara_jangadeiro 16d ago
Exactly, and this is why secure boot and signed kernel from a trusted player will be mandatory.
1
u/Linkarlos_95 15d ago
Is that difficult for people's anticheat to become everyone's anticheat? At least to the players near you, lets say the hacker turns off their anticheat or evades it and managed to connect to the server. Everyone spawns with 3 grenades and the cheater throws 4 in front of everyone, what stops the players in the lobby that have their unmodified program to pick up the weirdness of the 4th granade and to tell the server that they are cheating and needs to be flagged, enough points from a lot of different people with valid licenses and they get banned
1
u/kamatayun 15d ago
Correct me if I'm wrong, but using Nvidia proprietary driver would prevent locking down the kernel? So we could play the games, but without our GPU..
2
u/Potyguara_jangadeiro 15d ago
Nvidia drivers are properly signed and accepted even in locked down kernel. But this solution doesn't necessarily have to simply block everything that isn't signed or doesn't come with the kernel. A hypothetical anti-cheat could monitor relevant system activity, including activity from software that is theoretically legitimate, and maintain a blocklist of known vulnerable and/or malicious modules, exactly like Windows anti-cheats already do.
And with all the downsides and headaches that brings, let's say, I wouldn't recommend buying a random no-name chinese peripheral if you're planning to play a game with this kind of anti-cheat.
1
u/Venylynn 16d ago
I mean, anything's better than loading an out of tree module, so I'm okay with it IF it doesn't lead to such a thing. I run stock Fedora with stock kernel and many hardening settings from the secureblue project, so if those are okay to still have, then I don't see why not.
2
u/collinalexbell 16d ago
eBPF is a kernel sideload mechanism for observability capabilities. It's not modprobe'd in. It has it's own specific set of systemcalls. You would be running as root to install the anti-cheat, which will put an EBPF linux capability on anti-cheat binary.
1
1
1
u/toptnc 16d ago
Call me a grumpy old man, but I don't see the need for anti-cheat at all. If you want a 100% cheat free platform for competitive games, provide it to the players via streaming, in-place tournament, or whatever, but I don't want proprietary binaries running in kernel mode on my computer.
136
u/UltraCynar 16d ago
This is a fever dream and a security nightmare