How to do PC gaming with a sense of security and privacy?

[Djoga'Ro]

I've been out of PC gaming for 10 years now, due to the PC I concocted back then crashing when stressing the GPU or the PCIe interface. Never figured out why and couldn't sent the core components back for analysis, since I bought those from more than one shop.
So since then I only played on Wii U then on Switch. Which for the most part is fine, however, there are games which I don't like to play on console that much. Skyrim or The Witcher for examples look like they've been stripped of details visually and make me wanna experience them on a more powerful machine. Or games in which a lot of fast paced aiming needs to be done I miss kb and mouse, terribly so.

And then lately some wave of nostalgia washed over me and I'd like to build a PC again - partly to see what WoW looks and feels like after 15 years. So I started researching what's what in terms of hardware nowadays, planning the machine, and looking into gaming on Linux. The machine - in concept - has taken shape, wouldn't be cheap.

Then I got a bit concerned, when I learned that to use battle.net you'd need to have and run their app on your smartphone. I don't likey. And I seem to be the only one concerned about this. Asking the internet for instance, if the battle.net app would work or not work without google services installed on the device, yields nothing.
I guess, exhausting microG's way's and what else there is to pass SafetyNet checks and putting the offensive app somewhat in a box with Shelter might be a thing?

Then there's the question of how to handle running complex proprietary software, i.e. games, in a manner that doesn't make you wanna cower crawled up in a corner.

Lutris seems to be the first go-to, when it's about getting games to run on Linux. Similar picture here. There seems to be little concern about safety. Try the internet for "Lutris" in combination with "security". Even worse, when I found a github issue on the Lutris flatpak repo, where someone asked to give the package more fs access freedom, the answer was like yeah let's give it a lot, and someone else warned about the consequences and gave better alternatives, the latter was literally answered with "not interested" by one of Lutris' main developers. Same thing in an feature request issue in the Lutris repo itself, asking for firejail functionality or similar. Same main developer: "not interested".

I'd really like to spend thousands of money on a gaming rig and get back on that PC gaming horse, but on Linux this time. But how to go about it, when the best tools to make it possible don't like condoms or apps like Blizzard's need to be run?

 

[PowerGod]

to use battle.net you'd need to have and run their app on your smartphone

This is an optional thing for a two factor authentication, it is not mandatory.
Battle.net can be used to play single player games even offline, but it will stay active for 30 days, then it will needs a connection to call home, after that you'll have again 30 days of offline play, and so on.
For now the best options to get games like you want are GOG, itch.io, and indiegala, just because those games don't require clients, at least for single player games, but still this can vary from game to game.

 

[Djoga'Ro]

Yeah, maybe I've got a little worked up over battle.net.

Still the bigger question remains. How to box in the games one runs in a consistent somewhat easy to maintain and to use manner? I guess, one could always just only use games in a vm or on a separate machine even. Or one could craft a run script for every game oneself.
But maybe someone here knows a way to generalise the task and one can just use Lutris, but something one put in place takes care of every game getting sandboxed? Maybe a separate Lutris distribution/variant, or separate runner repos with focus on better/some security?

I'm asking this naively, since I'd be utterly new to gaming on Linux - aside from one or two native games I found in devuan's repos, when I was bored at my mother's.

 

[ElPoco]

I guess you could have a user meant for games and never sudo anything from that user. This should limit the risk of a game or game-related software accessing sensitive data.

 

[TrashyMG]

I treat my Linux gaming machine as a console of sorts, I have another machine I do my day to day things. So I don't mind it having Steam, Battle.net Running via Steam Proton and use Lutris a bit for other things... If the concern is having a presence with these online services, just have to say it's just how it is... Use a different tier of passwords than anything you use. try giving as little user info as possible and such. Could put your gaming machine on a different subnet to ensure it's not interacting with the rest of your home network...

 

[TeDaDeS]

I have a computer with dual-boot and virtual machine. So I can opt to boot into Windows if I want, or run a Windows instance as virtual machine. Steam games run fine under Linux for the most part, but some don't and it's nice to be able to play those also. As seen on the forum Windows does break my computers boot process somewhat once a year which is really annoying. Luckily Linux is somewhat more easy to fix compared to Windows, although it might be more technical compared to a re-install.
Easiest is probably to just run Linux only.

My SteamDeck runs my games just fine, and it has a Linux desktop to. But I can imagine not wanting to have SteamOS and just a regular Linux distro.

 

[Djoga'Ro]

I guess you could have a user meant for games and never sudo anything from that user. This should limit the risk of a game or game-related software accessing sensitive data.

Yeah, read that in the arch wiki article on Wine. As described there, I'd put it in the category tinkering on a per game basis?
A semi-automatic - once set up properly - way to make sure games run as different user and still sandboxed regarding fs, on separate x server would sound great.

I treat my Linux gaming machine as a console of sorts, I have another machine I do my day to day things. So I don't mind it having Steam, Battle.net Running via Steam Proton and use Lutris a bit for other things... If the concern is having a presence with these online services, just have to say it's just how it is... Use a different tier of passwords than anything you use. try giving as little user info as possible and such. Could put your gaming machine on a different subnet to ensure it's not interacting with the rest of your home network...

A seperate physical machine would technically be the least hassle, but I don't wanna do that.
I'm no big fan of registering as a user everywhere, though for MMOs it's fine with me also paying a monthly fee, which I prefer over microtransactions or free-to-play kiddy-anarchy.

The latter is what I already do for Nintendo Switch, my work laptop, internet radio thingy, wi-fi clients.
I'd have two physical ethernet ports on the new machine, so in case of virtualisation, I'd pass through the one that's connected this way.

I have a computer with dual-boot and virtual machine. So I can opt to boot into Windows if I want, or run a Windows instance as virtual machine. Steam games run fine under Linux for the most part, but some don't and it's nice to be able to play those also. As seen on the forum Windows does break my computers boot process somewhat once a year which is really annoying. Luckily Linux is somewhat more easy to fix compared to Windows, although it might be more technical compared to a re-install.
Easiest is probably to just run Linux only.

My SteamDeck runs my games just fine, and it has a Linux desktop to. But I can imagine not wanting to have SteamOS and just a regular Linux distro.

I'm running Artix with Plasma on my work laptop, which I really like and 'd want to set up on the new private machine.
I guess I'd set up a vm with Windows anyway for titles I can't live without nor get to run on Linux. I know one can with qemu setup a vm on a separate drive, which one then can also boot normally into(, which would be useful to be able to update a lot of USB devices from lazy manufacturers). Would Windows go along? Or would one face "hardware changed" objections?

I still hope, that for everything that can run on Linux, I won't have to do it in a vm. Since, iirc, you'd have to boot the host not using the gpu to be able to pass it through to the vm? Just a quality of life argument, but still.

 

[TeDaDeS]

I still hope, that for everything that can run on Linux, I won't have to do it in a vm. Since, iirc, you'd have to boot the host not using the gpu to be able to pass it through to the vm? Just a quality of life argument, but still.

My experience is that 3D works good enough without PCI-passthrough, depending on the game so you don't need 2 GPU's for that. Having a dedicated disk and GPU would help performance obviously.
In the past I could boot my windows partition directly as a VM but it eventually gave me issues as NTFS could have changes from Linux and Windows due to shared folders. It was pretty neat though, as the VM was just a reference to the physical Windows disk.

 

[netcat]

This thread got me thinking and from now on I’m only gaming as root with a real-time process…..

Just running as another user that doesn’t have access to your files I should think would suffice. This is the normal way.
Or a chroot setup would work.
You’re sensitive data is encrypted and backed up right??
Assume you are and will continue to be pwn’d. Anything else is fantasy.
Install multiple intrusion detection systems but game as root always.

 

[Djoga'Ro]

My experience is that 3D works good enough without PCI-passthrough, depending on the game so you don't need 2 GPU's for that. Having a dedicated disk and GPU would help performance obviously.

Even when the game in question wouldn't make use of the whole thing, one would at least save some energy on overhead avoided.

This is the way.

FTFY

You’re sensitive data is encrypted and backed up right??

The most sensitive would be the keepass db, which I do back up. The next would be running processes, that have access to email and other accounts, decrypted filesystems, resources on my home network, and their memory and storage, I guess.

 

[ElPoco]

Yeah, read that in the arch wiki article on Wine. As described there, I'd put it in the category tinkering on a per game basis?
A semi-automatic - once set up properly - way to make sure games run as different user and still sandboxed regarding fs, on separate x server would sound great.

Having one user per game seems a bit over-cautious to me. Unless you have some sensitive game accounts maybe...

 

[Djoga'Ro]

Having one user per game seems a bit over-cautious to me. Unless you have some sensitive game accounts maybe...

Didn't mean it like that. I just imagined, I'd need to have a script or modified runner for each game. Though thinking again, you probably meant starting the manager (e.g. Lutris) as a separate user. ?

 

[ElPoco]

I was thinking about logging into a gaming-specific user to install and run games.
But if everything goes through a manager, running that manager as a separate user should work.

 

[Risca]

Lutris is not a manager. It's a wrapper to setup wine and other tools in a known working configuration for the game you're trying to install. It runs as the user who started it and installs everything as that user

 

[Djoga'Ro]

I was thinking about logging into a gaming-specific user to install and run games.

Thanks. That didn't even occur to me.
I guess, one could setup that on tty8 there's another login screen on boot.
Assuming Artix (no systemd, instead runit for instance) + KDE Plasma + X server + pipewire, could one expect that having two users logged into x sessions on separate ttys would work without major problems or restrictions multimedia/periphery-wise?
Also, I picked up on arch wiki that it would be a good idea to do gaming with a separate X server instance in case the game crashes it. Would that automagically be a given using two ttys or need to be explicitly arranged?

Lutris is not a manager. It's a wrapper to setup wine and other tools in a known working configuration for the game you're trying to install. It runs as the user who started it and installs everything as that user

Adopted terminology on my end. But isn't it also a manager, making persistent what you had it setup/your selection and per-game configuration changes?

 

[Risca]

Adopted terminology on my end. But isn't it also a manager, making persistent what you had it setup/your selection and per-game configuration changes?

Yeah, I guess you're right. At least it's not a privileged manager

 

[Djoga'Ro]

Thanks y'all. For a moment there I thought, it might be a dumb idea to spend money on a gaming PC - 't would be either inconvinient or a hazard. Consider me corrected.
Though, I put the project on hold. Cannot find a motherboard that wouldn't mean to compromise. The Zen 4 (or is it AM5) just brings a few PCIe lanes too little into the mix. I guess, I'll wait for the next non-pro 16core Threadripper. Plus, the current MBs/FWs destroying the CPU and it not yet being fully sorted out makes it easier.