Will kernel-level anti-cheat ever work on linux?
From both a technical perspective and if the maintainers of these anti-cheat will consider porting or re-writing kernel level anti-cheat to work on linux, is it possible? Do you think that the maintainers of kernel level anti-cheat will be adamant in not doing it, or that the kernel even supports it or will support it. I think that if it ever happens, there will be a influx of people moving to linux, or abandoning their duelboots, and that alot of people will hate that such a thing is available on linux.
like this
MachineFab812
in reply to SpiderUnderUrBed • • •I think its less a question of the technical feasibility, and more of an issue that we, as users, don't want more closed-source blobs in our kernels. Meanwhile, the publishers insist that they can't open-source their anti-cheat code; Their idea being that if we know what's in it, it will be easier to bypass.
Basically, one distro or a few(at most) may get anti-cheat integrated one day(like, say, SteamOS), but it will likely never be in your standard Linux kernel.
They could go the route of kernel modules, I would think, but for whatever reason, we're still having this conversation.
unprovenbreeze
in reply to MachineFab812 • • •Valve also has server side anticheat in his games (Counter Strike or Deadlock). They are also against it.
Kernel-level anticheats can be bypassed anyways, but they are the easy solution for the corps that want to sell their multiplayer game.
Nanook
in reply to MachineFab812 • • •seralth
in reply to Nanook • • •If you want it to still be steam OS and compatible with games then you couldn't use kernel.org kernels that's the point.
Fundamentally it becomes a console not a PC. That's WHAT steamOS would be in this hypothetical.
FauxLiving
in reply to seralth • • •If a person stands to make a lot of money figuring out how to use a regular, non-anticheat kernel then they will do it. It would be a lot less difficult to do when the kernel code is open source.
For anti-cheats, it isn't the case, as with Windows, where you can semi-trust that the kernel isn't lying. If an anti-cheat runs and wants to see what DMA devices are connected it uses the kernel to do that and it trusts that the kernel isn't lying. You could trivially modify the Linux kernel's source code to not list a specific card when asked by a kernel module.
phantomwise
in reply to MachineFab812 • • •kadu
in reply to SpiderUnderUrBed • • •Absolutely nothing prevents somebody from writing a kernel level anticheat on Linux.
Users would throw a fit, and it would be way easier to bypass, but it certainly could be made.
dosse91
in reply to kadu • • •kadu
in reply to dosse91 • • •It doesn't "need" to be anything. It could be a DKMS module that is mandatory for playing a game.
Whether people would like it and use it is a completely different story.
solrize
in reply to SpiderUnderUrBed • • •catloaf
in reply to solrize • • •You don't even need to do that. You could just blacklist or delete the module.
The game wouldnt work, but you could do it.
0xtero
in reply to solrize • • •southsamurai
in reply to SpiderUnderUrBed • • •like this
Mordikan likes this.
Badabinski
in reply to SpiderUnderUrBed • • •Godort
in reply to SpiderUnderUrBed • • •Is it possible to have kernel-level anti-cheat in Linux?
Yes, Absolutely. But, people would throw a fit. There is probably no way to opensource it without also making it easier to bypass. There would be a concerted effort to reverse engineer it and remove it from the system while maintaining functionality
Maintainers of anti-cheat software are not volunteers. If there was an order from management to port the system to Linux, it would happen. It's just that with the Linux userbase as small as it is, it's simply not profitable to cater to them.
I fully disagree. The thing keeping regular people away from Linux as an OS is not that they can't play some online game with Anti-cheat.
Linux is in a weird place right now. It's actually a perfect fit for non-technical users that use their computers for email, web browsing, and Netflix, but those users don't know what an operating system is, let alone that there are options.
... show moreIs it possible to have kernel-level anti-cheat in Linux?
Yes, Absolutely. But, people would throw a fit. There is probably no way to opensource it without also making it easier to bypass. There would be a concerted effort to reverse engineer it and remove it from the system while maintaining functionality
Maintainers of anti-cheat software are not volunteers. If there was an order from management to port the system to Linux, it would happen. It's just that with the Linux userbase as small as it is, it's simply not profitable to cater to them.
I fully disagree. The thing keeping regular people away from Linux as an OS is not that they can't play some online game with Anti-cheat.
Linux is in a weird place right now. It's actually a perfect fit for non-technical users that use their computers for email, web browsing, and Netflix, but those users don't know what an operating system is, let alone that there are options. More technical users tend to require more specialized applications, and if there isn't a native linux port available, you have to do some research for alternatives, or to find a way to run it in wine.
Windows is shitty, but it's comfortable. And I know that it will run any software I throw at it with basically no research or troubleshooting.
Nanook
in reply to Godort • • •pinball_wizard
in reply to Godort • • •I want to highlight this in case OP missed it. Your point here is critical.
Now I'm going to nerd out a bit about it:
To expand on your points above (for OP), there's an impasse here between the anti-cheat developer and the distro developers.
The anti-cheat developer needs support from the distro developer to get their anti-cheat packages signed, to allow them to run in the kernel. Any package not signed by the distro developer that tries to run at kernel level will be treated by the OS as a virus. (Windows has this protection as well.)
Getting the code signed is pretty easy. The only requirement is sharing the source code, so the distro developers can make sure there's nothing nasty in it.
But the anti-cheat developers feel that they need to never share their source code, to prevent cheating. In some cases, they have even have contracts that prevent them from legally sharing parts of their source code (if licensed from a third party).
... show moreI want to highlight this in case OP missed it. Your point here is critical.
Now I'm going to nerd out a bit about it:
To expand on your points above (for OP), there's an impasse here between the anti-cheat developer and the distro developers.
The anti-cheat developer needs support from the distro developer to get their anti-cheat packages signed, to allow them to run in the kernel. Any package not signed by the distro developer that tries to run at kernel level will be treated by the OS as a virus. (Windows has this protection as well.)
Getting the code signed is pretty easy. The only requirement is sharing the source code, so the distro developers can make sure there's nothing nasty in it.
But the anti-cheat developers feel that they need to never share their source code, to prevent cheating. In some cases, they have even have contracts that prevent them from legally sharing parts of their source code (if licensed from a third party).
That's also not a problem. All they have to do is sign a binding contract for secrecy with every contributor to the distro, and then privately share their source code, and get it signed.
On Windows, that means signing a contract with Microsoft. On Mac, with Apple.
But on Linux, is just means tracking down and making separate agreements with a few thousand independent individuals...
So the technical solution is pretty simple: share code, get code signed, run in kernel.
But the contrasting needs of everyone involved make it unlikely on Linux.
Interestingly, an Anti-cheat developer who felt very confident that their code was unbeatable, could just publish it publicly, and get it signed and running quite quickly.
But uh... Most anti-cheat is also pretty low quality code, according to most estimations.
cmnybo
in reply to SpiderUnderUrBed • • •JTskulk
in reply to SpiderUnderUrBed • • •homura1650
in reply to JTskulk • • •This is where TPMs, measured boot, and remote attestation come in.
You can run whatever kernel you want, but if it is not an approved kernel, you wouldn't be able to attest to running an approved kernel; allowing whatever DRM scheme the developer put in to active.
I believe this is how the higher levels of Android's Play Integrity system work.
Zak
in reply to homura1650 • • •When Microsoft first proposed something like that a couple decades ago, it was widely seen as the nightmarish corporate power grab it was. Even mainstream, non-techy publications were critical.
It is.
How the fuck did this become acceptable?
software architecture
Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)seralth
in reply to Zak • • •Money. And the fact nothing majorly bad ever happens.
Time and time again people cry and claim horrid things will happen if this or that becomes allowed.
Then because of that smart people make sure it doesn't happen or when something does it's so minor that only nerds hear or care about it.
Nothing short of a functional bullet to normal man's head level of bad will EVER get the avg joe to care. And so long as the avg joe does not care, money is the final say in all decisions.
The crying and claiming of horrid things by very smart people, is typically enough tho to prevent the worse of it. Because those smart people are the ones buying and managing or having enough influences among the people with the money.
So it's less profitable to anger those smart people.
But end of the day. Money.
thingsiplay
in reply to SpiderUnderUrBed • • •One way I can imagine it being some certified Linux kernel versions that are accepted and worked together with anticheat creators. That way Valve could use the Kernel in Steam Deck or SteamOS, so any game works out of the box. And other distribution users can just install this Kernel too, if their distributions provide it.
Anyone who don't want to have Kernel level anticheat systems enabled on their system, do not need to install the Kernel. Therefore they are secure against it. But for anyone else who wants it, they can. At least this option would be a compromise.
vrighter
in reply to thingsiplay • • •0xtero
in reply to vrighter • • •thingsiplay
in reply to vrighter • • •Besides your argumentation that open source is less secure, a driver or program does not need to be in the Kernel to work with it. Does it? Kernel level anti cheat systems are available on Windows too, without being in the Windows Kernel. All it needs is a Kernel module to load it separately. Something like the Nvidia proprietary driver. I don't know if this would work for Anticheat.
Back to your point of open source and code around it. Well they code around the proprietary tools too. Reverse engineering stuff is possible. So your argumentation is a bit weak. Open Source means more people are looking into and its actually more secure and up to date (for common and actually developed drivers).
And you don't have to use it, if you don't like. How about letting people give options instead calling something they want or need being useless? It has a use and reason, so its by definition not useless. Instead using Windows, they could use Linux.
vrighter
in reply to thingsiplay • • •thingsiplay
in reply to vrighter • • •daggermoon
in reply to thingsiplay • • •dan
in reply to SpiderUnderUrBed • • •AFAIK Microsoft have plans to block kernel level anti-cheat on Windows. After the CrowdSec issues last year, they're rethinking which types of programs should even be allowed to run in kernel space.
Edit: I was wrong. They actually want to increase what can be done in user mode, to reduce reliance on kernel mode code.
sibachian
in reply to dan • • •Czele
in reply to sibachian • • •Mirror Giraffe
in reply to Czele • • •GenderNeutralBro
in reply to dan • • •That's basically what Apple did with macOS 11. They deprecated kernel extensions and replaced them with "system extensions", and created new APIs so security tools, VPNs and such could function without kernel-level privileges.
Thordros [he/him, comrade/them]
in reply to SpiderUnderUrBed • • •Meanwhile in indie land, I just tried to cheat my way through a Chapter 3 minigame in Deltarune, and Toby Fox himself showed up in his dogsona to blow up the game and make me start the minigame over.
This is the extent to which anti-cheat measures should go.
Caveman
in reply to SpiderUnderUrBed • • •vintageballs
in reply to Caveman • • •EtzBetz
in reply to Caveman • • •MTK
in reply to SpiderUnderUrBed • • •Magiilaro
Unknown parent • • •You can add your own signing keys to the UEFI and boot an modified bootloader and Kernel that you have signed yourself.
So yes, it is possible to "lie"
For such a locked down system, akin to game consoles or smartphones, would be needed. And even those get jail broken and manipulated, so "total security" on there is not complete but easier to check and ensure.
Another way to make sure that the code is not manipulated would be to put all those games into the cloud and have every player only play via streaming. All the code would then run on secured, locked down and verified machines.
buckykat [none/use name]
in reply to SpiderUnderUrBed • • •kernel level anti cheat is malware
abandon ranked, return to private lobbies
r00ty
Unknown parent • • •Linux secure boot was a little weird last I checked. The kernel and modules don't need to be secure boot signed. Most distros can use shim to pass secure boot and then take over the secure boot process.
There are dkms kernel modules that are user compiled. These are signed using a machine owner key. So the machine owner could for sure compile their own malicious version and still be in a secure boot context.
haui
in reply to SpiderUnderUrBed • • •dan
Unknown parent • • •Magiilaro
Unknown parent • • •The anticheat module would need run on a higher level then the Kernel itself to prevent that, for example alongside the CPU (like the Intel Management Engine).
Joe
in reply to Magiilaro • • •Another technique that helps is to limit the amount of information shared with clients to need to know info. This can be computationally intensive server-side and hard to get right .. but it can help in many cases. There are evolving techniques to do this.
In FPS games, there can also be streaming input validation. eg. Accurate fire requires the right sequence of events and/or is used for cheat detection. At the point where cheats have to emulate human behaviour, with human-like reaction times, the value of cheating drops.
That's the advanced stuff. Many games don't even check whether people are running around out of bounds, flying through the air etc. Known bugs and map exploits don't get fixed for years.
GardenData61371
Unknown parent • • •Bogasse
Unknown parent • • •TBH I'm not sure wider adoption would worsen things ? Gaming distros would probably ship bullshit anticheat modules by default while the others would not, or at most provide some documentation on how to opt in.
I think it's quite similar to the situation with NVIDIA proprietary drivers? (I don't own a graphics card so I'm not super aware on this topic)
Ulu-Mulu-no-die
in reply to SpiderUnderUrBed • • •I surely hope they never will, no user program should ever be allowed to run at kernel level, that's what malware does.
I personally avoid those kind of games, but those who won't can dual-boot.
Mwa
in reply to Ulu-Mulu-no-die • • •Ulu-Mulu-no-die
Unknown parent • • •On one side, I'm one of those glad for people coming to Linux because Linux is truly fantastic and it can make your life easier on many things, I'm happy for them.
On the other side, I share your concerns, because everything that gets adopted by the masses is inevitably subject to enshittification, I would never want that to happen to Linux.
We should find a sweet middle-point tho I have no idea what that would be.
Mwa
in reply to SpiderUnderUrBed • • •squaresinger
in reply to Mwa • • •Magiilaro
Unknown parent • • •MonkderVierte
in reply to SpiderUnderUrBed • • •Anna
in reply to SpiderUnderUrBed • • •Diplomjodler
in reply to Anna • • •HelloRoot
in reply to SpiderUnderUrBed • • •GregorGizeh
in reply to HelloRoot • • •Geodad
Unknown parent • • •I think the more people who aren't using corporate operating systems, the better.
I'm firmly against Microsoft, Red Hat, and Ubuntu.
phantomwise
in reply to SpiderUnderUrBed • • •Nanook
in reply to phantomwise • • •lemmylemonade
in reply to Nanook • • •FauxLiving
in reply to lemmylemonade • • •He's just being pedantic.
Technically 'ls' has kernel access because it depends on system calls in order to produce its output.
System calls are the mechanisms through which programs request services from the Linux kernel, allowing them to perform tasks like file management, process control, and device management. Any program that's running on your machine has the access required to make syscalls and so you could say they have access to the kernel. They won't have kernel-level privileges, so they can't act as the kernel, but they do have access. Obviously the original user was referring to kernel anti-cheat modules which act as the kernel with all of the same privileges.
qweertz
in reply to SpiderUnderUrBed • • •Every IT-literate person fights kernel-lvl malware disguising as games with everything they got.
Since Linux has a high percentage of those, I hope those "solutions" will never spread
SavvyWolf
in reply to SpiderUnderUrBed • • •It's relatively trivial, you just need to write a kernel module. You'd just need/want to make it gpl so everything it does is fully audited and transparent. That's not a problem, is it? Right?
From a technical standpoint, you could argue that someone could create a fork of the kernel that spoofs the interface that the anticheat uses to make it ignore things. You can, of course, also do something similar in Windows, but security theatre never let practicality get in the way.
muusemuuse
in reply to SpiderUnderUrBed • • •Short answer: no
Long answer: only the most important things should even have such low-level access to the system. A fucking game is not in that category. Nooooooo
theshatterstone54
in reply to muusemuuse • • •theshatterstone54
Unknown parent • • •forza4galicia
in reply to SpiderUnderUrBed • •Linux reshared this.