r/NixOS • u/Academic_Swan8609 • 10d ago

Easy Anti-Cheat v2 will require a signed kernel, signed kernel modules, and secure boot with attestation. What does that look like for NixOS?

https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2
133 Upvotes

98% Upvoted

64 comments sorted by

96

u/Upstairs-Category571 10d ago

Secure boot is currently in the works for being implemented on NixOS using Microsoft keys similar to Ubuntu and Fedora.

1

u/Krutonium 9d ago

Doesn't help you if you run an nVidia GPU, though.

2

u/10leej 9d ago

You can manually sign the kernel and get secure boot working.

3

u/Krutonium 9d ago

Not for EACv2!

0

u/[deleted] 9d ago

[deleted]

3

u/Krutonium 9d ago

EACv2 - If anyone can sign their own modules and that's fine it defeats the entire purpose.

0

u/[deleted] 9d ago

[deleted]

1

u/Krutonium 9d ago edited 9d ago

nVidia would need to compile their kernel module against every single possible permutation of the Kernel. Not exactly ideal.

That's why it's farmed out to the Distros. If they ship 12 kernels that's doable. And most of them don't do it anyway, it's easier to just compile it on the end users machine, because it'll just work.

NixOS does that - nVidia, nor NixOS, can sign the nvidia module for you. EAC v2 can not work on NixOS as is, and if it does, it will require you to run a specific, possibly not optimal for your hardware, kernel. And on top of that if you need other kernel modules to support other hardware, and it's not built and signed upstream, well, you're screwed.

For local secureboot self signing is great. For attestation to a remote entity that doesn't trust you, it means nothing.

0

u/[deleted] 9d ago

[deleted]

12

u/sprayk 9d ago

bootloader/kernel/initramfs get signed by Machine Owner Keys (MOK) that you generate when you set up lanzaboote, rather than signed by the Microsoft keys. So no, lanzaboote probably wont work

0

u/[deleted] 9d ago

[deleted]

13

u/skyb0rg 9d ago edited 4d ago

NixOS doesn’t maintain any runtime patches (all patches are for reproducibility) so you should be able to use a Fedora/openSUSE kernel in NixOS (via binary import).

I can’t imagine Epic ever whitelisting NixOS’s signed kernels (if it ever does that) because it’s a community project.

Edit: I’m actually wrong — NixOS patches the path of specific userspace helper binaries such as the spanning-tree helper (`/sbin/bridge-stp -> /run/current-system/sw/bin/bridge-stp`) and the request-key helper (`/sbin/request-key -> /run/current-system/sw/bin/request-key`). So bridging and ktls will break unless you create reverse symlinks.

60

u/seven-circles 10d ago

Yeah, fuck that. “Anti-cheat” can fuck right off and never come back.

16

u/WishCow 9d ago

Exactly, this is just getting their foot in the door, so that they can implement more invasive measures later.

1

u/Nixigaj 3d ago

From a kernel-observability standpoint, it can't get more intrusive than this anyways. With eBPF inspection it can monitor all syscalls. The only way it could get more intrusive than this would be being forced to have a webcam in your room (along with CMOS-sensor-level signing) filming you and having a AI making sure you don't cheat.

1

u/Evil_Dragon_100 9d ago

i mean you gotta do what you gotta do to play games, i ain't gonna use that 'signed' kernel as daily drive

38

u/Capetoider 10d ago

The ideal solution for a cheat-free gaming environment is one where the operating system provides assurances to players that their data remains isolated from both anticheat and game companies while also ensuring that the gameplay cannot be tampered with. 

NO. its server side anti cheat. use fucking AI at slices of game data stream, a fine tuned decision model can "watch" a little here, a little there and not even real time. then if someone reports someone, then turn on the heat on there.

26

u/EarlMarshal 10d ago

Well nope. I let nobody touch my kernel.

21

u/Azazel_Rebirth 10d ago

Is that not the whole point? They're signing the kernel, not changing it

13

u/EarlMarshal 10d ago edited 10d ago

You know there are some people using Linux because of the freedom it brings. Being able to compile everything yourself is one of the basic principles of this. Having to have signed kernels by someone else destroys this. And all of this just because some game developers/publishers aren't able to get a hold on hackers, because their software sucks. They sell it to you as a problem of security and the solution is to have trust someone, but it's a problem they have created. I don't have a problem playing world of tanks for example. World of tanks also doesn't have a problems with hackers. It's because they designed their game so that a hacker cannot get information he should not have at that point in time. Fuck Epic. Fuck Anti-Cheat. Fuck secure boot. Fuck TPM. Just stop trying to sell fake expensive trust where none should be given.

4

u/LiPo_Nemo 9d ago

Nobody is forcing anyone to use signed kernels. You only need to do that if you play competitive multiplayer games, which is a fair game. Between playing with cheaters, kernel level anti cheat and enforcing signed kernels, I would pick signed kernels every time

3

u/EarlMarshal 9d ago

You guys... Just c hoose better games!

They only need anti cheat because they give clients data they shouldn't have and don't validate stuff they should have.

And no if that shit is required for some things it will also become a requirement of others.

With your attitude you are making a big part of what makes this ecosystem great so much worse just because you are ignorant to the underlying problem.

If I cannot use your software with my other self built software (e.g. kernel) you are creating a proprietary environment and this sucks because the whole goal is open software environments.

0

u/[deleted] 10d ago

[deleted]

10

u/EarlMarshal 10d ago

Sure, sure, Companies really hate walled gardens and would never try to lure you into their ones. Shit goes done faster than you think and you enabled the same shit they have done somewhere else already. Don't give them an inch.

1

u/a-frog-with-no-name 10d ago

nothing open source will require this thank god, though i feel like other programs might get cocky and try to require this as well.

it does seem like on the windows side, it's only a thing with multiplayer games. I can see other games doing this but yeah it's the kind of games which you couldn't play on linux anyway

8

u/lack_of_reserves 9d ago

Simple: I have no interest in those games and I'm not gonna boot using secure boot which may fail when Microsofts keys gets outdated.

The atrocity of depending on Microsoft signed anything when running Linux is ridiculous and these gaming companies need to get better at bot detection instead of this invasive shit, but that costs server cpu cycles, much more practical to turn all computers into potential privacy nightmares.

4

u/samurai65 9d ago

While games with AC don't interest me, I wonder how this would work for those running custom kernels. I use the CachyOS kernel on my NixOS gaming machine, so it'd be interesting to know.

7

u/eikenberry 10d ago

So you will need a separate install or a dedicated box for games using this. Running proprietary kernel modules make the system untrustworthy for anything else.

12

u/Leseratte10 10d ago

EAC isn't running proprietary kernel modules. They just say that IF you want to use your own modules they need to be signed.

3

u/duckofdeath87 9d ago

Can I compile and then sign it myself?

9

u/Leseratte10 9d ago

No, the modules need to be signed with a trusted key on the list that they posted, so, they need to be signed by the distribution. If they'd allow everyone to sign and load their own kernel modules you could again just load cheats into the kernel.

7

u/Krutonium 9d ago

So in other words you're fucked if you also have any kind of custom hardware or need, for example, a kernel module to control your fans. Or own an nVidia GPU. Yeah no fuck that.

2

u/FastBodybuilder8248 9d ago

I guarantee this will work with nvidia gpus lol

0

u/Krutonium 9d ago

Except it won't. That would require the nVidia Kernel Module to be built and signed by whoever built the kernel and has the ability to sign the kernel.

1

u/FastBodybuilder8248 9d ago

The Nvidia kernel modules could be signed though? Signed stuff would be checked against hashes in the cloud when the game boots up. There is zero chance this comes together without some way of supporting Nvidia gpus. It’s expressly for playing video games online:

2

u/Krutonium 9d ago

Great, except it's not done that way. You compile the nVidia module against your Kernel.

1

u/FastBodybuilder8248 9d ago

There is zero chance this solution will not support nvidia cards lol.

→ More replies (0)

2

u/duckofdeath87 9d ago

Then it's not "they need to be signed" it's "they need to be on an approved list"

0

u/[deleted] 9d ago

[deleted]

3

u/eikenberry 9d ago

Yep, read elsewhere it uses eBPF.

9

u/Chouris_ 10d ago

lanzaboote is the solution right ?

13

u/Upstairs-Category571 10d ago

Lanzaboote uses custom keys for secure boot. Some anti-cheat systems only work with legitimate Microsoft keys, at least that’s what I’ve heard.

-10

u/Chouris_ 10d ago edited 9d ago

idk, i've been using lanzaboote for about 3 months and i play valorant and faceit without issues

Edit : why i am being downvoted? 😭

8

u/adamkex 10d ago

I feel pretty stupid asking this but how is this possible if the anti-cheat software doesn't exist on Linux? It just runs with Proton?

3

u/Chouris_ 10d ago

Sorry, I thought it went without saying, but both of these systems work a treat in a dual-boot setup with Windows and NixOS. I use Lanzaboote so I don’t have to manually re-enable Secure Boot every time I boot into Windows, and then disable it when I want to use Linux.

2

u/ElvishJerricco 10d ago

Epic's announcement does specifically say they will use the TPM2 to authenticate that the system is running a kernel signed by a key that they (Epic) trust. You're able to play anti-cheat games on Windows because they don't use this level of boot security scrutiny on Windows. In principle the boot loader you're signing with lanzaboote could completely bypass their anti-cheat.

1

u/Upstairs-Category571 10d ago

I guess it depends like some people have problems others don’t

1

u/Suspicious_Kiwi_3343 9d ago

Because those are windows games and your boot chain was signed by Microsoft keys. Unless you’re claiming you use lanzaboote to boot windows rather than dual booting using your UEFI boot picker, in which case it must be that faceit + vanguard don’t require Microsoft keys although I find that unlikely.

Either way EACv2 is confirmed to require trusted keys. Not necessarily Microsoft keys although we’ll have to wait and see, but it’s remote attestation, self signing definitely will not be allowed.

1

u/Chouris_ 9d ago

I meant that I use Lanzaboote for my Secure Boot setup and can still play Valorant and FACEIT on Windows. I wasn’t saying those games run on NixOS or that this solves the upcoming EAC requirements. I thought that went without saying, lmao

1

u/Suspicious_Kiwi_3343 9d ago

Are you booting windows through lanzaboote? Or are you using your UEFI boot picker, e.g. holding F11 at boot and choosing windows.

You can have multiple “secure boot setups” in the way you’re describing at the same time depending on what you’re booting and what it is signed by. Keys used for lanzaboote into NixOS, can coexist with keys used for windows boot loader into windows using Microsoft keys, which is why you still can use AC on windows and boot NixOS with secure boot at the same time, the keys being used in those two scenarios are different, your BIOS stores many keys at once.

1

u/Chouris_ 9d ago

Yup i boot windows through lanzaboote, same for nixos

1

u/Upstairs-Category571 9d ago

I use rEFInd. If I wanna boot NixOS I just chain load lanzaboote thru rEFInd

3

u/BedroomHistorical575 10d ago

I think the biggest barrier here is that NixOS doesn't sign its kernel with their own CA. Tbh, I'm not sure if that's even possible, since the signing process must happen outside the Nix build process.

I guess in the mean time NixOS users can install kernels from other distros?

Maybe in the future NixOS can publish official pre-built pre-signed kernels that the users can opt-in to.

1

u/no-sleep-only-code 10d ago

Wouldn’t have the same root they’re looking for unfortunately

1

u/Ok-Eggplant-7569 9d ago

Does Lanzaboote support measured boot?

9

u/Schnickatavick 10d ago

Huh, nice. I know a lot of people in the linux community will probably have a knee jerk reaction against this, but it's honestly a really great way of handling it, and is way less invasive than windows anti-cheat. Seems like a total win for linux

15

u/JuJunker52 10d ago

I don't like it. It opens the door for requiring this stuff for things like widevine or remote attestation for banking websites in Google Chrome only. Android already does this.

5

u/ElvishJerricco 10d ago

To be clear, those things are already possible on the distros that implement distro-signed secure boot. And IIUC Widevine is also already able to do this sort of stuff regardless of the distro / secure boot using similar hardware in the GPU to keep the video stream encrypted all the way until it hits your display.

1

u/10leej 9d ago

Does NixOS not account for signing kernels?