Kernel Level anticheat is coming to Linux

It was always going to end up like that. The tools for enabling it already exists and all what was needed was linux gaining enough market share.

https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2

I had a feeling we would get something like that. At least it doesn't (yet) rely on shady closed sourced kernel modules so it seems better than the typical windows implementation.

eBPF will be used to provide kernel level access for anticheat software. That does provide kernel level perms but within restrictions.

There are eBPF rootkits so do need to be careful with what you grant access to when it comes to these perms (similar to how you need to be careful with root access). I personally have a strict rule against that when it comes to closed sourced software.

https://www.researchgate.net/publication/372499508_eBPF-based_Malware

https://github.com/Gui774ume/ebpfkit

A badly coded eBPF program can allow for privilege escalation

https://github.com/pathtofile/bad-bpf

It's a powerful tool that can do a lot of damage in the wrong hands.

https://ebpf.io/what-is-ebpf/#loader--verification-architecture

While this isn't exactly an ideal solution it should still bring more people to linux which will also improve the availability of other types of software.

The people who care a lot about security might simply be a loud majority while there is a much larger pool of people who just want to play games online and very much don't want to play against cheaters.

Sandboxing
Since the anticheat will run at the kernel level you can't sandbox it at the software level and the only way to protect yourself will be to use a separate linux install for games that require it (hoping your bios itself isn't going to be infected which requires safety on the hardware level) and disconnect any drive with sensitive data (which is impractical typically in the case of NVME drives).

But at this point you may as well just boot windows to be honest unless you have some specific reason for why you want to play on linux. At least you will get another option for games that will add support for kernel level anticheat on linux but it's obviously not a particularly great second option.

The genshin impact incident
There was a case of randomware using a security issue in the genshin impact anticheat to disable peoples anti-virus software to encrypt all their data anyway. This illustrates the danger of granting kernel level access to anything because even if the software itself isn't malicious any security issue it has could get utilized by another piece of software to cause very significant damage.

https://www.trendmicro.com/en_gb/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html

LSM control alone is quite dangerous
The linux security module is used for things like apparmor and SELINUX both of which are options for additional linux security. I personally use apparmor to limit wine and app images besides the default profiles.

But it turns out you can even use LSM to get around the standard access control such as accessing files you would otherwise need root access for.

https://github.com/kubearmor/KubeArmor/wiki/Introduction-to-Linux-Security-Modules-(LSMs)

That means that if some malware is able to exploit a security issue in EAC linux V2 said malware could encrypt every single file in addition to being able to access all of your data regardless of what security you tried to set up as long as it isn't some password protected zip folder where said password isn't physically accessable for the malware.

That's why the only decently reliable sandbox is physical disconnection (unplugging your main system and using a separate linux install just for those anticheat games).

Here is the main important details we know regarding the upcoming linux kernel level anticheat from epic games:
Of course we don't know the details yet but i don't see any way to implement this in a safe manner.

Kernel lockdown creates real problems right away
While kernel lockdown does have some security benefits (which isn't much compared to the massive security risks imposed by the kernel level anticheat) it will also stop various things from properly working including LACT (needed for proper GPU overclocking/undervolting on the nvidia side at least).

https://man.archlinux.org/man/kernel_lockdown.7

Of course there are probably ways in which they could make the anticheat works without breaking important functionality like that but it remains to be seen how it actually plays out in the end. Perhaps there could be a less restrictive kernel lockdown mode or perhaps eBPF could be used to provide the functionality needed (which would require extra work so not ideal).

Epic games does not view the EAC linux V2 approach as the ideal solution
They at least claim to view it as a temporary option until they are able to make something effective that isn't egregiously intrusive.
But it's unclear of said "long-term solution" is ever doing to actually materialize or if linux gamers will forever have to choose between a linux version of kernel level anticheat or not playing the game via linux at all for popular multiplayer titles.