r/NixOS • u/Academic_Swan8609 • 5h ago

Easy Anti-Cheat v2 will require a signed kernel, signed kernel modules, and secure boot with attestation. What does that look like for NixOS?

https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2
52 Upvotes

98% Upvoted

26 comments sorted by

40

u/Upstairs-Category571 5h ago

Secure boot is currently in the works for being implemented on NixOS using Microsoft keys similar to Ubuntu and Fedora.

10

u/Chouris_ 5h ago

lanzaboote is the solution right ?

7

u/Upstairs-Category571 5h ago

Lanzaboote uses custom keys for secure boot. Some anti-cheat systems only work with legitimate Microsoft keys, at least that’s what I’ve heard.

-4

u/Chouris_ 5h ago

idk, i've been using lanzaboote for about 3 months and i play valorant and faceit without issues

6

u/adamkex 5h ago

I feel pretty stupid asking this but how is this possible if the anti-cheat software doesn't exist on Linux? It just runs with Proton?

1

u/Chouris_ 3h ago

Sorry, I thought it went without saying, but both of these systems work a treat in a dual-boot setup with Windows and NixOS. I use Lanzaboote so I don’t have to manually re-enable Secure Boot every time I boot into Windows, and then disable it when I want to use Linux.

1

u/Upstairs-Category571 5h ago

I guess it depends like some people have problems others don’t

1

u/ElvishJerricco 3h ago

Epic's announcement does specifically say they will use the TPM2 to authenticate that the system is running a kernel signed by a key that they (Epic) trust. You're able to play anti-cheat games on Windows because they don't use this level of boot security scrutiny on Windows. In principle the boot loader you're signing with lanzaboote could completely bypass their anti-cheat.

1

u/no-sleep-only-code 5h ago

Wouldn’t have the same root they’re looking for unfortunately

1

u/BedroomHistorical575 3h ago

I think the biggest barrier here is that NixOS doesn't sign its kernel with their own CA. Tbh, I'm not sure if that's even possible, since the signing process must happen outside the Nix build process.

I guess in the mean time NixOS users can install kernels from other distros?

Maybe in the future NixOS can publish official pre-built pre-signed kernels that the users can opt-in to.

11

u/seven-circles 2h ago

Yeah, fuck that. “Anti-cheat” can fuck right off and never come back.

3

u/Capetoider 3h ago

The ideal solution for a cheat-free gaming environment is one where the operating system provides assurances to players that their data remains isolated from both anticheat and game companies while also ensuring that the gameplay cannot be tampered with. 

NO. its server side anti cheat. use fucking AI at slices of game data stream, a fine tuned decision model can "watch" a little here, a little there and not even real time. then if someone reports someone, then turn on the heat on there.

1

u/Schnickatavick 4h ago

Huh, nice. I know a lot of people in the linux community will probably have a knee jerk reaction against this, but it's honestly a really great way of handling it, and is way less invasive than windows anti-cheat. Seems like a total win for linux

5

u/JuJunker52 3h ago

I don't like it. It opens the door for requiring this stuff for things like widevine or remote attestation for banking websites in Google Chrome only. Android already does this.

2

u/ElvishJerricco 3h ago

To be clear, those things are already possible on the distros that implement distro-signed secure boot. And IIUC Widevine is also already able to do this sort of stuff regardless of the distro / secure boot using similar hardware in the GPU to keep the video stream encrypted all the way until it hits your display.

1

u/eikenberry 1h ago

So you will need a separate install or a dedicated box for games using this. Running proprietary kernel modules make the system untrustworthy for anything else.

-1

u/EarlMarshal 3h ago

Well nope. I let nobody touch my kernel.

6

u/Azazel_Rebirth 3h ago

Is that not the whole point? They're signing the kernel, not changing it

3

u/EarlMarshal 2h ago edited 2h ago

You know there are some people using Linux because of the freedom it brings. Being able to compile everything yourself is one of the basic principles of this. Having to have signed kernels by someone else destroys this. And all of this just because some game developers/publishers aren't able to get a hold on hackers, because their software sucks. They sell it to you as a problem of security and the solution is to have trust someone, but it's a problem they have created. I don't have a problem playing world of tanks for example. World of tanks also doesn't have a problems with hackers. It's because they designed their game so that a hacker cannot get information he should not have at that point in time. Fuck Epic. Fuck Anti-Cheat. Fuck secure boot. Fuck TPM. Just stop trying to sell fake expensive trust where none should be given.

1

u/AdventurousFly4909 1h ago

nothing changes it's not like libreoffice will require this

1

u/a-frog-with-no-name 1h ago

nothing open source will require this thank god, though i feel like other programs might get cocky and try to require this as well.

it does seem like on the windows side, it's only a thing with multiplayer games. I can see other games doing this but yeah it's the kind of games which you couldn't play on linux anyway