gmh5225 Linux, SteamOS, and Proton Security
Use this skill for Linux-specific interpretation of platform and process evidence. Use reverse-engineering for binary reconstruction, graphics-api for rendering/capture, and dma-attack for device-originated memory access.
Establish the Execution Stack
Record native ELF versus Windows code under Proton, architecture, game build, runtime version, graphics stack, kernel/distribution, launch context, and active policy. Separate game code, Wine/Proton user-space components, translation libraries, and Linux kernel behavior.
Proton is a Wine-based compatibility tool. Its presence does not imply Windows kernel mechanisms are available, nor is it evidence of malicious virtualization. Wine components, DXVK/vkd3d-proton, different module layouts, and diagnostic output can be expected artifacts. Valve Proton
Platform and protection-component support are product/build-specific. Do not assume a Windows kernel component runs through Proton. Distinguish launcher, media, runtime, graphics, and policy failures before attributing failed startup to an account restriction or malicious activity. Valve Proton compatibility guidance
Privilege and Isolation Boundaries
| Surface | Documented distinction | Review implication |
|---|---|---|
| Credentials/capabilities | Capabilities divide privilege and are per-thread attributes | Record effective credentials and capability sets before asserting authority |
| User namespaces | UID 0 in a user namespace need not have host-root authority | Interpret credentials alongside mappings and namespace context |
| Seccomp | System-call filtering reduces interfaces; it is not a complete sandbox | Record active filter context and remaining boundaries |
| LSM policy | Availability, enabled modules, and actual enforcement differ | Confirm the selected policy rather than assuming SELinux/AppArmor from the OS name |
Linux capabilities, User namespaces, Kernel seccomp documentation, Kernel LSM documentation
Threat Model and Benign Controls
Describe unauthorized process/data access, abuse of privileged helpers, untrusted native modules, and misconfigured isolation by the actual credential, policy, and object boundary involved. A namespace or capability observation does not itself establish a successful attack.
Compare evidence against the same supported runtime and game build. Legitimate translation libraries, overlays, supported launch options, debug builds, and graphics differences are important controls. A library name does not establish authenticity; use component provenance and observed loading where available. Do not transplant Windows structure offsets, callback semantics, or driver findings into Linux conclusions.
Evidence and Result
Preserve kernel/distribution/SteamOS version, game/runtime build IDs, architecture, graphics driver, component hashes where useful, policy state, credential and namespace context, and sanitized diagnostics. Mark inaccessible policy or privilege information as unknown.
Distinguish unsupported platform, runtime regression, graphics failure, policy denial, account enforcement, and supported security findings. State the observer, available evidence, benign alternatives, and unresolved scope. Use research-rigor when making cross-version or consequential claims.
Primary sources reviewed: 2026-09-09. Distribution defaults and supported runtime/protection combinations must be checked for the actual target build.
Repository Navigation
For project selection, load repository resource selection on demand. Use the shared repository navigation for local discovery layers, filename case, missing snapshots and currentness. Generated descriptions and wiki pages are discovery aids, not independent evidence.
Data Source
Use the following repository sources directly when applying this skill. Prefer available local files for discovery and scoped historical inspection; use the raw URLs when the collection is not installed locally. These entrypoint details are retained here so source lookup does not depend on loading another skill.
0. Compiled Wiki
Start with wiki/index.md for topical synthesis and cross-project connections. Wiki schema describes its structure. Generated wiki pages are discovery aids; follow their original citations before adopting technical claims.
Raw catalog: wiki/index.md. This skill does not currently have a matching wiki overview. Use its local references and the wiki catalog to find related pages; do not invent a path.
A direct project question can start with its README entry or description below; reading the entire wiki is unnecessary.
1. Project Overview and Resource Index
README.md contains the collection's actual categories, subcategories, project URLs and short descriptions. Find the relevant category and retain the original URL, including any specific file or revision suffix.
Raw index: README.md.
2. Repository Descriptions
For a concise project summary, look for the actual local path:
description/{owner}/{repo}/description_en.txt
https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/description/{owner}/{repo}/description_en.txt
Example: bgfx description. Extract owner/repository from the original GitHub project URL, omitting a .git suffix. Resolve existing path casing before constructing a local/raw path. Descriptions are generated summaries, not independent verification. If absent or inaccessible, use the README entry, relevant archive or original project.
3. Repository Source Archives
For deeper inspection of an available captured source tree, locate:
archive/{owner}/{repo}.txt
https://raw.githubusercontent.com/gmh5225/awesome-game-security/refs/heads/main/archive/{owner}/{repo}.txt
Example: bgfx archive. Prefer inspecting the relevant portion of an existing archive over re-cloning merely to inspect the same captured material. Archives may exclude files, use fallback extraction or contain truncation; they are not guaranteed complete checkouts. Record any upstream revision evidence and included-file limits. If missing or insufficient, follow the README's original upstream URL.
Choose and Verify the Source
For a specific project, locate its README identity, use a description or wiki page for orientation when helpful, then inspect the relevant archive/source artifact for the question. For current compatibility or exact implementation, verify the matching upstream documentation, release or immutable source revision. Keep the collection revision and capture/generation dates separate from the upstream version. Multiple generated layers from one source are not independent corroboration, and missing archive content does not establish upstream absence.
The per-domain resource guide above helps choose useful artifacts. Shared repository navigation adds the optional read-only indexer, case-ambiguity handling and maintenance details; it supplements this Data Source section rather than replacing it.