Kernel Level anticheat is coming to Linux

[Admin]

It was always going to end up like that. The tools for enabling it already exists and all what was needed was linux gaining enough market share.

https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2

I had a feeling we would get something like that. At least it doesn't (yet) rely on shady closed sourced kernel modules so it seems better than the typical windows implementation.

eBPF will be used to provide kernel level access for anticheat software. That does provide kernel level perms but within restrictions.

There are eBPF rootkits so do need to be careful with what you grant access to when it comes to these perms (similar to how you need to be careful with root access). I personally have a strict rule against that when it comes to closed sourced software.

https://www.researchgate.net/publication/372499508_eBPF-based_Malware

https://github.com/Gui774ume/ebpfkit

A badly coded eBPF program can allow for privilege escalation

https://github.com/pathtofile/bad-bpf

It's a powerful tool that can do a lot of damage in the wrong hands.

https://ebpf.io/what-is-ebpf/#loader--verification-architecture

While this isn't exactly an ideal solution it should still bring more people to linux which will also improve the availability of other types of software.

The people who care a lot about security might simply be a loud majority while there is a much larger pool of people who just want to play games online and very much don't want to play against cheaters.

 

[Admin]

Sandboxing
Since the anticheat will run at the kernel level you can't sandbox it at the software level and the only way to protect yourself will be to use a separate linux install for games that require it (hoping your bios itself isn't going to be infected which requires safety on the hardware level) and disconnect any drive with sensitive data (which is impractical typically in the case of NVME drives).

But at this point you may as well just boot windows to be honest unless you have some specific reason for why you want to play on linux. At least you will get another option for games that will add support for kernel level anticheat on linux but it's obviously not a particularly great second option.

 

[Admin]

The genshin impact incident
There was a case of randomware using a security issue in the genshin impact anticheat to disable peoples anti-virus software to encrypt all their data anyway. This illustrates the danger of granting kernel level access to anything because even if the software itself isn't malicious any security issue it has could get utilized by another piece of software to cause very significant damage.

https://www.trendmicro.com/en_gb/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html

 

[Admin]

LSM control alone is quite dangerous
The linux security module is used for things like apparmor and SELINUX both of which are options for additional linux security. I personally use apparmor to limit wine and app images besides the default profiles.

But it turns out you can even use LSM to get around the standard access control such as accessing files you would otherwise need root access for.

Certain POSIX-compliant filesystems depend on the ability to grant accesses that would ordinarily be denied at a coarse level (DAC level) of granularity (check capabilities man page for CAP_DAC_OVERRIDE). LSM supports DAC override (a.k.a., permissive hooks) for particular objects such as POSIX-compliant filesystems, where the security module can grant access the kernel was about to deny.

https://github.com/kubearmor/KubeArmor/wiki/Introduction-to-Linux-Security-Modules-(LSMs)

That means that if some malware is able to exploit a security issue in EAC linux V2 said malware could encrypt every single file in addition to being able to access all of your data regardless of what security you tried to set up as long as it isn't some password protected zip folder where said password isn't physically accessable for the malware.

That's why the only decently reliable sandbox is physical disconnection (unplugging your main system and using a separate linux install just for those anticheat games).

Here is the main important details we know regarding the upcoming linux kernel level anticheat from epic games:

The LSM BPF feature enables eBPF programs to use Linux Security Module hooks for granular access control and monitoring. This enables anti-cheat to restrict other processes from reading or writing protected game process memory without needing a kernel module, as well as monitor for cheats loaded in different ways. We require the BPF LSM to be loaded and active.

Of course we don't know the details yet but i don't see any way to implement this in a safe manner.