r/linux • u/lajka30 • Mar 03 '26
Development EA is hiring a Senior Anti-Cheat Engineer to lead development of a native ARM64 driver for their Javelin kernel anti-cheat system and start laying groundwork for Linux/Proton support
123
u/beefcat_ Mar 03 '26
I'm really curious what the plan is to properly secure their anti-cheat software from being tampered with by a modified kernel. This has been the Achilles heel of other AC solutions with Linux support.
On Windows, there are mechanisms in place that allow you to verify that the kernel and all loaded drivers are genuine, something that just isn't feasible on Linux without forcing users onto very locked down distros.
56
u/FlukyS Mar 03 '26
There are mechanisms to check for tampering but they have to be done with some collaboration probably with distros. It is definitely easier to track modules running because there are very few DKMS packages out there so less surprises than Windows so you can whitelist what is installed
26
u/JDaxe Mar 03 '26
Tracking modules is useless if I just compile my anticheat bypass into the kernel directly
39
u/FlukyS Mar 03 '26
You might not have understood what I meant by the first sentence, I basically meant there that they if they were working with distros directly could pick specific kernel versions, signatures and hashes, all three together you can just disable the anti-cheat if something is off. It isn't perfect but you need to combine stuff like secure boot, signatures, secure areas of memory...etc and it gets there. The downside is it hurts smaller distros specifically.
18
u/woj-tek Mar 03 '26
lesser evil. still better to offer support for games for the overwhealming majority of regular players at least…
16
u/FlukyS Mar 03 '26
Yeah, like in this situation it is the only realistic approach. I'd even suggest that disabling ptrace outside of the app's process tree as well would be a smart plan as well, most distros don't do it but it would stop debugging
2
u/gesis Mar 05 '26
Using hashes will get them a great start. A lot of the groundwork is already done with traditional stable release models having mostly static packages with known hashes.
Yeah, it leaves weird kernels and rolling releases out, but targeting some modern equivalent of the LSB should be doable.
6
u/LvS Mar 03 '26
The important thing is that it stops people from modifying their own system.
So that there's corporate control over the software.
Because in the end Canonical isn't a large company, you can just buy it.
8
u/Gangsir Mar 03 '26
Unfortunately "people can modify their system any way they want" and "we can have a game where anticheat works" are incompatible. There has to be some level of control so that anticheat can actually be sure it's not being fooled. Ground truths and all that.
1
u/LvS Mar 04 '26
Yes, and people want to have a game.
So obviously they will vote to remove everyone's ability to modify their system any way they want.
6
u/ccAbstraction Mar 04 '26
Yes, probably on Windows and definitely on Android and iOS, but on Linux, they probably can't get much farther than system attestation, which, IMO is all you need for anticheat anyway.
Immutable distros might end up being popular for gaming because of this, but there are so many use cases for mutable distros and custom immutable images, that it doesn't make sense for "them" to stop everyone from modifying their systems just so a few pass attestation when they need to.
6
u/megayippie Mar 04 '26
Nah, you are just unable to modify shit AND game on it. Choose one.
0
u/LvS Mar 04 '26
That works until more apps than games stop running on the "modify shit" versions and turn essentially into a crippled version of Linux.
4
u/woj-tek Mar 04 '26
Erm… you are streching your argument. Noone will force everyone to use "blessed" kernels. If you want to game - use the one that are attested… not everyone on linux games. And with this development those who want to game and use linux will be able to do so without having to dual-boot to windows.
Hence: "lesser evil"
Alas, would be nice to have server-side anti-cheat as well…
-1
u/LvS Mar 04 '26
What tells you it's gonna be just multiplayer games that will require an attested OS?
It's an easy argument to way "just use an attested OS, even Linux works fine that way" once that catches on.
2
3
u/DonaldLucas Mar 04 '26
You would only need to load the approved kernel when gaming, while you could load your different modified kernel while not gaming.
1
u/LvS Mar 04 '26
As long as only games do it.
We all know that the next step is that California or so will create a law that demands an approved kernel for proving your age and then all social media websites require the approved kernel.
3
Mar 04 '26 edited Aug 09 '26
[deleted]
1
u/LvS Mar 04 '26
It's a somewhat open secret that he's been trying to sell it.
So if the offer is good enough, I'm pretty sure you can get it.
3
u/dasunt Mar 03 '26
Versions wouldn't work - I could just have my hypothetical cheating kernel report it is the OEM version.
Hashes and signatures would be a little harder to work around - I'd have to trap those calls and return the expected answer.
I think secure boot would likely be hard to work around, from my understanding, but I don't know enough about UEFI to give a confident answer.
7
u/spyingwind Mar 03 '26
There are a few CPU instructions that the TPM chip listens to that the CPU can't intercept easily, but a cheater could just patch out those calls or have the kernel emulate the TPM chip, like how KVM/QEMU emulates TPM.
1
u/FlukyS Mar 03 '26
Well my point is using all of it, the signature is the first part and the hardest, verifying the hash of the file just is a double check that it was what was shipped and not just reported by the motherboard as valid because there are some potential hardware hacks that might be technically feasible but very very difficult. The specific version would be validated by the hash so doesn't need a separate check but is a requirement because there could be privilege escalation stuff that could bypass checks.
4
7
u/iamamidgetnamedwija Mar 03 '26
Am I dumb or would gentoo completely not work with this then
7
u/FlukyS Mar 03 '26
Yeah my suggestion would disallow Gentoo or distros that are smaller. For Fedora, Ubuntu and Arch (and friends) you could have blessed kernels that the anti-cheat will be told are fine and they would be validated by signature. Since Gentoo you are compiling stuff yourself it would be not allowed to run.
4
u/useless_it Mar 03 '26
Gentoo has several installable kernels.
sys-kernel/gentoo-kernel-binis a binary and portage only constructs the initramfs and/or an UKI, besides any signing required for SecureBoot.I suppose that someone can create an ebuild that installs a vetted UKI with the anticheat module. Still, any non-GPL module will taint the kernel IIRC.
2
u/LawfulnessNo8446 Mar 03 '26
I'm not completely sure, and someone who runs Gentoo should correct me if I'm wrong, but I don't believe that you need to compile a ton of different kernel modules on Gentoo, which is what dkms is for. To my knowledge, it's standard programs that are manually compiled.
10
u/Rocktopod Mar 03 '26
very locked down distros.
Would SteamOS be locked down enough? Because I'm sure that's really all they care about at this point.
12
u/poudink Mar 03 '26
SteamOS isn't really that locked down. The read-only stuff can be disabled with a simple command and you can set a sudo password to do root stuff.
10
u/beefsack Mar 03 '26
The "modified kernel" part feels pretty solved by TPM,
kernel_lockdownmode and a signed, trusted kernel.The shit part about that is that you'd have to use a "blessed" kernel that gets trusted by anticheat makers, and that would almost certainly only be official SteamOS kernels.
There are other complexities in Linux relating to cheating but I don't think there are as clear solutions to those. These mainly relate to processes running as root and being able to inspect memory and might have solutions via things like selinux MAC and things like
deny_ptracebut I think they are slightly less clear cut.0
u/cyber-punky Mar 05 '26
I mean, i can make my kernel look and act like any version I want with a kernel module, how are they going to stop that ?
3
u/beefsack Mar 05 '26
Via a hardware backed full chain of trust into the booted operating system.
During the boot process, TPM collects hashes of the bootloader, signed kernel and lockdown policies. The anticheat software can then query the TPM to collect these hashes which are signed using a hardware private key in the TPM. Because it's signed and AFAIK the key hasn't leaked yet, it's currently not tamperable.
If you used a random modified kernel, the kernel hash wouldn't match and it would fail the kernel signature check.
0
u/cyber-punky Mar 05 '26
I absolutely can beat this trivially. Any userspace process opening any file, or doing any query, any syscall, any ioctl can be manipulated with a kernel module.
Any kind of verification is shallow once you have ring0 control.
1
u/beefsack Mar 05 '26
I guess the part that is relevant to the point you raise is
kernel_lockdownmode. This strongly restricts the features that you are able to use. In effect, it prevents mechanisms that could enable syscall hijacking, memory access, probing and tracing including strongly inhibiting eBPF, as well as restricting hardware register access.There are still a bunch of userspace stuff you can do under
kernel_lockdown, but it's all stuff that could be easily detected by a userspace anticheat.1
17
u/__ali1234__ Mar 03 '26
Linux has had that capability since 2019 and all major distributions now turn it on when booting on a UEFI enabled system.
7
u/dnu-pdjdjdidndjs Mar 03 '26
linux has stage 2 trusted boot and linux users use tpm2?
24
u/__ali1234__ Mar 03 '26 edited Mar 03 '26
Yes, Linux has stage 2 trusted boot. Shim will no longer boot unsigned kernels, and signed kernels will no longer load unsigned modules when secure boot is enabled. See man 7 kernel_lockdown.
TPM has nothing to do with it because secure boot is based on public key signatures and the TPM is for storing private keys.
edit: A TPM is only required for the remote attestation, and that is fully supported by Linux. The only reason nobody uses it is because there is little or no Linux software that requires it yet.
6
u/dnu-pdjdjdidndjs Mar 03 '26
the tpm is needed for the hardware root of trust proving down the line
manufacturer key -> bootloader signature -> kernel signature (including the initramfs, kernel, kernel parameters, any modules including nvidia)
If any of those components fail trust you cant prove things and also I think amd/whoever burned the key on the tpm needs to provide an attestation service proving that the tpm is valid
I didnt mean that its impossible since android does it I just meant its not in use
3
u/__ali1234__ Mar 03 '26 edited Mar 03 '26
All of those things are already signed today and cannot be modified unless the user disables secure boot or enrolls a custom key. If you enroll a custom key it will be recorded in the TPM2 attestation report. Linux already has support for TPM2. On an up to date secure boot system you can install tpm2-tools and run
systemd-analyze pcrsto see the hashes of the whole boot chain. Remote attestation is simply a matter of asking the TPM to make a signed copy of those numbers, and then sending the result to the remote server.1
u/dnu-pdjdjdidndjs Mar 03 '26
couldnt systemd just lie
3
u/__ali1234__ Mar 03 '26
Sure. Then the signature check on the remote server will fail and your game won't connect.
0
u/dnu-pdjdjdidndjs Mar 03 '26
what signature check? the one generated by the userspace daemon based on a report by systemd? im pretty sure this is the purpose of tpm remote attestation is that only the tpm manufacturer can backdoor the root of trust
why couldnt i just have my secure boot sign fake init with full kernel access then just spoof integrity
5
u/__ali1234__ Mar 03 '26
No, the signature check that happens on the game server. This is remote attestation.
The EFI firmware stores the hash of the secure boot key store in the TPM before any operating system code even runs. The TPM will only sign the hash that was stored in it by the firmware. It won't let you change the hash after boot, and it won't give you the signing key, that's the whole point.
2
u/DemonInAJar Mar 03 '26
You can verify that a certificate has been generated inside a tpm by verifying the manufacturer chain. The private keys in this case are not exportable and can be used by remote verifiers through nonce challenges achieving remote attestation. The local machine can only solve the challenges if policy matches. Policies can be set to match specific secure boot states + boot sequences and only then will the tpm challenges work. This assumes the boot sequences and policy states have been whitelisted by the verifiers.
2
u/Green0Photon Mar 03 '26
You can still do secure boot with your own keys. So even if it's checking for secure boot and that secure boot uses the official keys, I'm pretty sure that can still be spoofed.
They need to do some form of remote attestation to make sure the kernel is actually running signed as the expected version. Which involves the TPM. If I'm remembering right.
(I also don't think it's ethical to do this. And if EA implements it, you still shouldn't play the game on Linux, even if you now have the ability.)
6
u/dnu-pdjdjdidndjs Mar 03 '26
yes https://www.reddit.com/r/linux/comments/1rjvyvv/comment/o8h5fx6
you can sign your own stuff and the entire security is broken
in the model they want the tpm needs to provide remote attestation to prove its not been tampered with, then it validates you only signed "legal" bootloader, kernel, initramfs, and no illegal kernel parameters, and third party modules like nvidia would need to be trusted. idek how much of this windows does.
its also still technically less secure than android since its much easier to reach the kernel attack surface than android where every app is sandboxed but i guess someone trying to make cheats could use adb debugging or whatever to get a shell as a normal user, which is still less control than on linux where you can just do sudo and replace system binaries.
5
u/Moscato359 Mar 03 '26
2 stage bootloader can get around it
1
u/DemonInAJar Mar 03 '26
You can lock this through pcr extension if you first attest the first stage bootloader.
3
u/f0xsky Mar 03 '26
RHEL supports secure boot. So the kennel can be signed. This allows for kernel modules to also be signed.
3
u/sayhisam1 Mar 03 '26
You could start with a restricted set of distros
Personally i'd love to see them start with atomic distros (e.g. silverblue, or bazzite). Seems easier than targetting any broad distribution which can have any number of packages and kernel modules
2
2
u/RAMChYLD Mar 04 '26
Such mechanisms do exist on Linux. Just that most users don't bother with it because it's a huge pain that adds compile time to a driver due to the signing.
1
u/Dominant88 Mar 04 '26
I honestly wouldn’t mind if there was a more locked down, dedicated distro for gaming.
1
u/megayippie Mar 04 '26
Check for the signature of the kernel. Or just ship the game in a docker container.
1
u/itzjackybro Mar 04 '26
One way to do it is to have it run in some kind of lightweight VM, so the user doesn't have control over what gets installed... I don't think you can be 100% sure without that.
1
1
u/Cool-Arrival-2617 Mar 04 '26
I'm afraid they may require distribution signed kernels, secure boot enabled and additional integrity checks. By the time they have something the Nvidia proprietary driver will likely use NOVA and no longer an out of tree module, for other module it might be an issue.
This would suck because custom kernels wouldn't be allowed at all but I'm not sure they could ever support them. But they would at least need to make it so every distro can register their keys to them for free and so even the small distro can have it work (if they can figure out how to sign the kernel).
1
u/2rad0 Mar 03 '26
I'm really curious what the plan is to properly secure their anti-cheat software from being tampered with by a modified kernel.
It will be a masterclass in why secureboot is mostly theatrics aside from a few specific contexts.
78
u/hackingdreams Mar 03 '26
Genuinely, who the hell wants EA to be running code at kernel level on their systems? There's no trust there - they're among the worst anti-consumer software companies out there.
26
u/LvS Mar 03 '26
Everybody playing those games wants that. Obviously. Otherwise they wouldn't use it.
And they trust EA or Face It or whatever more than they trust their opponents.
5
Mar 04 '26
I disagree. People have never had a choice and the kernel level access discussion really became commonplace in 2025 with the launch of Battlefield 6. Prior to that, most of us were still on Windows and we didn't even know some games play on Linux (let alone actually using Linux).
8
u/LvS Mar 04 '26
"People are fine with EA rootkits on Windows" is making my point.
They'll still be fine with them on Linux.
1
u/z7r1k3 Aug 16 '26
I would argue no one wants that. They want to play the game. EA could come up with a non-kernel solution, and people would likely prefer it.
21
u/inemsn Mar 03 '26
i agree: but if it gets more people to start using linux, that's a positive, even if it still leaves work to be done.
2
Mar 04 '26
[deleted]
5
u/M8gazine Mar 04 '26
"I'm better than these people who play (ugh!) Battlefield and (eww!) Apex Legends!"
Come on now rofl. No need to act morally superior over people playing games you're not a fan of.
If EA making anticheat work on Linux gets more gamers using the OS, that's an objectively positive thing.
2
u/Mother-Pride-Fest Mar 04 '26
To be fair, requiring kernel-level anti-cheat is on its own a reason for a game to be complete garbage. But that doesn't stop millions of people from buying the games.
2
u/Steve_Streza Mar 04 '26
EA FC is still the most complete soccer game out there. Even in single player it requires their anti-cheat.
1
u/RAMChYLD Mar 04 '26
You don't have to if you don't want it, but if it will bring more users to Linux, it's good.
To be fair tho, despite their track record as worst company in the US, I think EA was one of the more pro-Linux companies out there. I mean we had SimCity 3000 for Linux.
11
3
u/FrostyDiscipline7558 Mar 04 '26
Or just write games natively for Linux so Proton / Wine isn't needed! Ugh!
7
u/EbonShadow Mar 04 '26
I won't allow kernel level antitcheats on my os, period
6
u/M8gazine Mar 04 '26
Okay? That's great? Nobody is forcing you to play their games. However, it is an objectively good thing that they're working on Linux support, since it means more people are able to move to Linux.
9
u/EbonShadow Mar 04 '26
No, an objectively good thing would be for them to stop using Kernal Level Anticheats.
2
1
u/M8gazine Mar 04 '26
Kernel anticheats aren't ideal, no.
But if you want it to be the Year of the Linux Desktop, then them working on Linux is necessary.
4
u/dreamersword Mar 03 '26
I do not want this. Not from EA I will just play my single player games thanks.
2
1
u/pds314 Mar 04 '26
Those requirements seem highly specific. I mean, I guess it depends on what you count as experience but... Previously shipped drivers for Windows on ARM. I guess having specific requirements for a senior position makes sense but still there have got to be a ton of low level people with a ton of relevant experience that have not shipped a Windows-on-ARM driver.
1
u/Salty_1984 Mar 04 '26
It is good that they are finally acknowledging Linux but kernel level anti cheat on a platform where users have root is going to be a nightmare. Either they lock down the system which no one wants or cheaters will just bypass it. The Windows version already has trust issues. Hard to see this ending well for anyone. But maybe they surprise us.
1
u/Zamorakphat Mar 04 '26
This needs to be celebrated. I don't play these games but any effort to bring them into the Linux fold is so exciting for getting more of the normal crowd on this ecosystem.
1
u/El_Sjakie Mar 04 '26
My faith in EA is such that I suspect that if they do find someone to do that work for them, they will then turn around and use said work to fuck all linux users. How? No idea! but if someone would figure it out, it would be EA!
1
1
Mar 04 '26
That's good to see. EA lost of huge opportunity to increase the player base of Battlefield 6 by enforcing an anti-cheat solution that restricted players to using Windows. It was bad PR all around.
0
-17
u/bombatomica_64 Mar 03 '26
Honestly the only way forward for anticheats is the machine learning stuff, as we've seen kernel anticheats don't do enough
20
u/DarkeoX Mar 03 '26
Any self-respecting and half-working AC these days is already using ML server-side. It's just that it can't catch everything and isn't suited for all kinds of cheats. So AC software is using a maximalist approach, locking down the client as much as they can.
Kernel AC is never alone, it's already using server-side & ML but the later isn't enough on its own.
-2
u/Raiyuza Mar 03 '26
Oke proof please, what ML is being applied.
14
10
u/DarkeoX Mar 03 '26
In addition to u/TheGrimsey below:
* Riot Games' Valorant's Vanguard AC : https://playvalorant.com/en-us/news/dev/valorant-anti-cheat-what-why-and-how/
> [...]It’s fundamentally a defense in depth approach. We first build the game to be as cheat-resistant as we can (e.g., Fog of War, and server authoritative movement netcode). Next, we make the cost of developing cheats as prohibitive as possible (e.g., Vanguard and other anti-tamper measures). Finally we detect, ban, and remove cheaters from the game as efficiently as possible using Vanguard cheat detection, hardware bans, player reports, data analysis, and machine learning research.[...]
* CoD's Ricochet: https://www.callofduty.com/fr/blog/2021/10/ricochet-anti-cheat-initiative-for-call-of-duty
> [...]Another layer in the battle against cheaters is the evolving use of machine learning (ML). ML algorithms examine gameplay data from the server, helping to identify suspicious behavior trends, and add another layer of security as part of the overall RICOCHET Anti-Cheat initiative.[...]
Even Epic's EAC is reportedly deploy ML on some projects but I haven't seen conclusive / public record of that so I'll refrain from mentioning un-sourced 3rd parties.
But yeah, I don't know why you thought AC companies didn't use ML on server-side or that they wouldn't give up on complex / ever-moving Windows innards tampering if they could afford to. They're doing both because it's the only way you suppress not all, but the biggest amount in the type of games it's deployed on.
5
Mar 03 '26
[removed] — view removed comment
10
1
u/RAMChYLD Mar 04 '26
Monetary gains. Maybe if eSports competitions are banned then we'd see a huge drop in cheaters. Most cheaters out there want a spot in the competitions and ultimately are money driven.
151
u/voronaam Mar 03 '26
16 years ago I was working for EA Sports. I asked if I can get a Linux desktop and was said "sure". Later I learned that it happened basically because I was the only one to ever ask. For the next several years I was the only developer with a Linux workstation in the entire campus. People were happy with the quality of my work, so nobody really minded, but there were a few interesting conversations.
Linux was so much not on the mind of anyone at the company that there were not even policy around forbidding its usage.
I am glad to see Linux entering mainstream. Now they are not only aware of its existence, they are looking to ship games natively now!
Technically, the first Neverwinter Nights had a native Linux version and Bioware was an EA company and there surely were still Bioware people around at the company. But I worked at a different location.