本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Awesome Gaming on Linux Without Cheating

Easy Anti-Cheat (EAC) has supported native Linux game clients since 2014. In 2021, we added support for running Windows game builds on Linux via Wine/Proton. However, that support is opt-in for each game and many haven’t opted in because our Linux implementation couldn’t offer the same level of protection as our Windows implementation. This is why Fortnite isn’t available on Linux yet, but it’s coming. Cheating in online games was once a small cottage industry, but it has become a billion-dollar market where cheat operators sell subscriptions for cheating tools that are updated frequently and require minimal technical skill to use. Without effective anti-cheat measures, these operators can drive enough players away from a game that it’s no longer financially viable for the game developer to run.

自 2014 年以来，Easy Anti-Cheat (EAC) 一直支持原生 Linux 游戏客户端。2021 年，我们增加了通过 Wine/Proton 在 Linux 上运行 Windows 游戏版本的支持。然而，该支持需要每款游戏自行选择加入，而许多游戏并未选择加入，因为我们的 Linux 实现无法提供与 Windows 实现同等级别的保护。这就是为什么《堡垒之夜》(Fortnite) 目前尚未在 Linux 上线，但它即将到来。在线游戏作弊曾经是一个小型家庭作坊式产业，但现在已演变成一个价值数十亿美元的市场，作弊运营商销售频繁更新且几乎不需要技术门槛即可使用的作弊工具订阅。如果没有有效的反作弊措施，这些运营商可能会导致足够多的玩家流失，使得游戏开发者无法维持游戏的经济可行性。

The long-term solution

The ideal solution for a cheat-free gaming environment is one where the operating system provides assurances to players that their data remains isolated from both anticheat and game companies while also ensuring that the gameplay cannot be tampered with. There have been many efforts over the years to build solutions like this including virtualization techniques to enable cheat free gaming, but to date they haven’t gained traction. We hope they soon will, and we’ll work with all willing companies in the industry to make this happen in the future. This includes continuing the Easy Anti-Cheat team’s open line of communications with Valve to support Steam Hardware devices to the maximum extent technically possible.

长期解决方案

实现无作弊游戏环境的理想方案是，操作系统能够向玩家保证其数据与反作弊公司及游戏公司保持隔离，同时确保游戏过程不被篡改。多年来，人们为构建此类解决方案付出了许多努力，包括利用虚拟化技术来实现无作弊游戏，但迄今为止尚未获得广泛应用。我们希望这种情况很快会改变，并将与业内所有愿意合作的公司共同努力，在未来实现这一目标。这包括 Easy Anti-Cheat 团队继续与 Valve 保持开放的沟通渠道，以在技术上最大程度地支持 Steam 硬件设备。

The immediate solution - What Epic is doing right now

To close the gap for Linux, we are rebuilding our Linux anti-cheat implementation into EAC Linux v2. We will bring the level of protection much closer to par with Windows, in the very near-term, using existing Linux features including signed kernel, signed kernel modules, and secure boot with attestation. These requirements build on work that distribution maintainers already do, and the more distributions that meet these requirements by default, the fewer players will need to change their setup to play. We are starting to reach out to leaders in the Linux community, and will continue to engage with more leaders in the coming weeks as we work towards bringing more awesome games to Linux. Later this year, we will co-host a panel discussion with Jef Spaleta (Fedora Project Leader) where we’ll talk through the path to enabling fair competitive gaming on Linux for players. We are also planning to pilot EAC Linux v2 in Fortnite first, where we’ll test it in a live environment and refine it based on what we learn. Once we’ve validated EAC v2’s effectiveness, we’ll make it available to more game developers so they can bring their multiplayer games to Linux players too.

即时解决方案——Epic 目前正在做的事情

为了缩小 Linux 平台的差距，我们正在将 Linux 反作弊实现重构为 EAC Linux v2。在短期内，我们将利用现有的 Linux 特性（包括签名内核、签名内核模块以及带认证的安全启动），使保护水平更接近 Windows。这些要求建立在发行版维护者已有的工作基础之上，满足这些默认要求的发行版越多，玩家在游玩时需要更改设置的情况就越少。我们已开始与 Linux 社区的领导者接触，并将在未来几周内继续与更多领导者沟通，致力于将更多出色的游戏引入 Linux。今年晚些时候，我们将与 Jef Spaleta（Fedora 项目负责人）共同主持一场小组讨论，探讨为 Linux 玩家实现公平竞技游戏的路径。我们还计划首先在《堡垒之夜》中试点 EAC Linux v2，在实时环境中进行测试，并根据反馈进行改进。一旦验证了 EAC v2 的有效性，我们将向更多游戏开发者开放，以便他们也能将多人游戏带给 Linux 玩家。

Join the initiative

If you maintain a Linux distribution, we want to connect with you. If you haven’t been contacted by us already, reach out ASAP to linux-gaming@epicgames.com. We’ll answer any questions you have about getting your distribution aligned with our configuration requirements to get your signing keys added to our well-known list. The list is a core part of how EAC Linux v2 verifies systems, so we’ll maintain it to start. Our goal is to make the well-known key list open source, and we welcome PRs from the community to expand it. When launching a game using EAC Linux v2 for the first time, players will be prompted to install an anti-cheat systemd service which runs only while a protected game is running. For games that already have the existing EAC Linux support activated, developers will be able to choose whether they want to continue using the older anti-cheat implementation for maximum compatibility or switch to EAC Linux v2 for better cheat protection. On Windows, we rely heavily on a kernel driver to protect the games. This driver isn’t always on, it starts when a game is launched and stops when the player exits. For EAC Linux v2 we will not leverage an equivalent kernel module, and instead we’ll take full advantage of existing Linux platform security features like measured boot, the kernel lockdown LSM, and IOMMU support, plus our own eBPF logic to maintain integrity and detect cheaters. These security features are not available on every distro and may require configuration changes to activate. Let’s go through the system requirements for EAC Linux v2 one by one. We expect to iterate on these requirements over time, and we appreciate feedback from developers and distribution maintainers to help refine them.

加入倡议

如果您是 Linux 发行版的维护者，我们希望与您建立联系。如果您尚未收到我们的联系，请尽快发送邮件至 linux-gaming@epicgames.com。我们将解答您关于如何使您的发行版符合我们的配置要求，以便将您的签名密钥添加到我们的“知名列表”中的任何问题。该列表是 EAC Linux v2 验证系统的核心部分，因此初期将由我们进行维护。我们的目标是将该知名密钥列表开源，并欢迎社区提交 PR 以进行扩展。首次启动使用 EAC Linux v2 的游戏时，系统会提示玩家安装一个反作弊 systemd 服务，该服务仅在受保护游戏运行时才会运行。对于已经激活现有 EAC Linux 支持的游戏，开发者可以选择继续使用旧版反作弊实现以获得最大兼容性，或者切换到 EAC Linux v2 以获得更好的作弊防护。在 Windows 上，我们主要依赖内核驱动程序来保护游戏。该驱动程序并非一直开启，它在游戏启动时加载，在玩家退出时停止。对于 EAC Linux v2，我们不会利用等效的内核模块，而是充分利用现有的 Linux 平台安全特性，如度量启动 (measured boot)、内核锁定 LSM 和 IOMMU 支持，再加上我们自己的 eBPF 逻辑来维护完整性并检测作弊者。这些安全特性并非在所有发行版中都可用，可能需要更改配置才能激活。下面我们逐一介绍 EAC Linux v2 的系统要求。我们预计会随着时间的推移对这些要求进行迭代，并感谢开发者和发行版维护者提供反馈以帮助我们完善它们。

1. Signed Kernel & Kernel Modules

A custom kernel can easily be modified to bypass integrity checks and return false data to anti-cheat. That’s why we require that the kernel binary in use during anti-cheat protected gameplay is signed with a well-known key. Unlike Windows, most Linux device drivers are part of the kernel source code directly (in-tree) and will be compiled and signed by your distribution alongside the kernel. There are some exceptions that are maintained separately from the kernel (out-of-tree), notably NVIDIA GPU drivers. If you need to load kernel modules, we require that they meet the same requirements as the kernel—being built by an organization and signed with a well-known key.

1. 签名内核与内核模块

自定义内核可以很容易地被修改，从而绕过完整性检查并向反作弊系统返回虚假数据。因此，我们要求在反作弊保护的游戏过程中使用的内核二进制文件必须使用知名密钥进行签名。与 Windows 不同，大多数 Linux 设备驱动程序直接包含在内核源代码中（内核树内），并将由您的发行版与内核一起编译和签名。也有一些例外情况是与内核分开维护的（内核树外），最显著的是 NVIDIA GPU 驱动程序。如果您需要加载内核模块，我们要求它们满足与内核相同的要求——由组织构建并使用知名密钥签名。

2. TPM 2.0

The TPM is a hardware feature that provides security primitives like extend-only Platform Configuration Registers (PCRs) which enable a tamper-resistant boot log to be produced and verified. During boot, each piece of the boot sequence (firmware, boot manager, Linux kernel) can record metadata about the code that will run next and update the extend-only registers. This is extremely valuable, because when properly used, it enables an application like anti-cheat to know what code ran at boot without running at boot itself. TPM 2.0 is standard on modern consumer hardware, and software support is built into the Linux kernel. We require that systems have TPM 2.

2. TPM 2.0

TPM 是一种硬件特性，提供诸如“仅扩展”平台配置寄存器 (PCR) 之类的安全原语，能够生成并验证防篡改的启动日志。在启动过程中，启动序列的每一部分（固件、启动管理器、Linux 内核）都可以记录关于接下来将运行的代码的元数据，并更新这些“仅扩展”寄存器。这非常有价值，因为如果使用得当，它使反作弊等应用程序能够在无需自身在启动时运行的情况下，获知启动时运行了哪些代码。TPM 2.0 是现代消费级硬件的标准配置，Linux 内核中也内置了软件支持。我们要求系统具备 TPM 2。