I tried out Bazzite 45’s ujust check-anticheat and am posting the output just for visibility. At this point in time, I don’t think I’m going to do anything about the Fails.
Easy Anti-Cheat Linux v2 readiness check
Requirements: ``https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2``
[PASS]Signed kernel
Kernel 7.2.15-ogc1.1.fc45.x86_64 is signed by 'ublue kernel'
[PASS]Signed kernel modules
All 117 loaded modules are signed
[PASS]TPM 2.0
[PASS]Secure Boot enabled
[FAIL]Only well-known Machine Owner Keys
Not well-known: 'grub' 'Ventoy Secure Boot Root CA'. Export them with 'mokutil --export', then remove each with 'sudo mokutil --dele
te MOK-000N.der'
[PASS]Measured boot
The boot manager recorded its measurements
[PASS]IOMMU enabled, passthrough disabled
[FAIL]Kernel lockdown integrity mode
Lockdown mode is 'none'. Run 'rpm-ostree kargs --append-if-missing=lockdown=integrity'
[FAIL]Kexec disabled
Run 'rpm-ostree kargs --append-if-missing=sysctl.kernel.kexec_load_disabled=1'
[PASS]BPF LSM active
3 of 10 checks failed.Fix the items above, then reboot and run this again.
Kernel argument changes take effect after a reboot.
EDIT: I’ve done a bit of research on the Fails, above. The first one: Only well-known Machine Owner Keys Not well-known: 'grub' 'Ventoy Secure Boot Root CA'seems odd. The MOK for grub is not well-known? Wouldn’t deleting its key keep the system from booting?
The other two Fails look like they’d be good things to implement: lockdown=integrity and sysctl.kernel.kexec_load_disabled=1. I’m not knowledgeable about this to speak reasonably, but is there some reason those aren’t the standard settings?