> The only realistic way to solve this on Linux is enforcing secure boot w/trusted kernels and then running the anti-cheat in sandboxed eBPF kernel space. Embark is looking at this approach.

Assuming secure boot, there’s another realistic way, which is to use vendor-signed readonly Linux OS images — not just kernels — that disallow process memory access to root, come with signed kernel drivers, and offer secure attestation support chained to secure boot. Steam Linux and Bazzite could both implement this easily; the former has a fixed hardware target list and the latter is already an ‘all in one’ solution. Since Linux users are generally competent at dual-booting, one would simply dual-boot into the sealed image to play PvP multiplayer games, no eBPF development or maintenance of anti-cheat required. Embark is within their rights to evaluate the workload of supporting DIY unsigned Linux instances through eBPF but doing so would create a viable competitor to an attestation-derived Valve Anti-Cheat for Steam Linux, and so likely inspire the giant in the room to step up and obsolete it.