Proton isn’t designed to be a security layer and afaik doesn’t go out of its way to sandbox applications. I’d expect a lot of viruses will fail to do anything, but there’ll also be some able to do things like steal your browser or discord passwords.

There’s no reason to risk it; don’t run anything in Proton that you don’t feel safe running on Windows.

ransomware might encrypt your home directory

Depends on what the virus is built to do.

I read someone intentionally infected their Linux system with a Windows virus, and they lost the home directory.

Proton/wine makes no security assurances, so it will be able to do anything that any other program you run is able to do. If a trojan or rat recognizes that it is running under wine, it can bring in some native Linux malware as well and it will execute just fine. https://forum.winehq.org/viewtopic.php?t=34573

I was just wondering what would happen if I downloaded a game that was infected by a computer virus and ran it in Linux using Proton.

Depends on the mechanism. Some viruses will target stuff that WINE doesn’t emulate – like, if it tries to fiddle with Windows system files, it’s just not going to work. But, sure, a Windows executable could look for and infect other Widows executables.

Has this happened to anyone?

I don’t know specifically about viruses or on Proton. But there has been Windows malware that works under WINE. Certainly it’s technically possible.

How would the virus behave?

Depends entirely on the virus in question. Can’t give a generic answer to that.

What files, connections or devices would it have access to?

WINE itself doesn’t isolate things (which probably is reasonable, given that it’s a huge, often-changing system and not the best place to enforce security restrictions). On a typical Linux box, anything that you, as a user, would, since Linux user-level restrictions would be the main place where security restrictions would come into play.

I do think that there’s a not-unreasonable argument that Valve should default to having games – not just Proton stuff – run in some kind of isolation by default. Basically, games generally are gonna need 3d access, and some are gonna need access to specialized input devices. But Steam games mostly don’t need general access to your system. But as things stand, Steam doesn’t do any kind of isolation either.

You can isolate Steam as a whole – you can look at installing Steam via flatpak, for one popular option. I don’t use flatpaks, so I’m not terribly familiar with the system, but I understand that those isolate the filesystem that Steam and its games have access to. That being said, it doesn’t isolate games from each other, or from Steam (e.g. I can imagine a Steam-credentials-stealing piece of malware making it into the Steam Workshop). On the other hand, I’m not totally sure how much I’d trust Valve to do a solid job of having the Steam API be really hardened against a malicious game anyway – that’s not easy – so maybe isolating Steam too is a good idea.

Could it be as damaging as running in in Windows?

Sure. If it’s not Linux-aware, it probably isn’t going to do anything worse than deleting all the files that your user has access to, but in general, that’d be about as bad anyway. If it is Linux-aware, it could probably do something like intercept your password next time you invoke sudo, then make use of it to act as root and do anything.

Well, there’s this study from 2018: https://link.springer.com/article/10.1007/s11416-018-0319-9

Given that Priton / Wine / … try to simulate a Windows environment, it’s certainly possible. But I’ve never heard this happened to anyone. And the discussions on the internet seem very theoretical.

Surely it highly depends on the exact kind of malware and what it tries to do. And it doesn’t really seem to happen in the wild. But I see no reason why it wouldn’t theoretically work.

Linux is not really comparable like this because the distribution matters along with the bootloader configuration.

If you have an immutable distro with SELinux configured and your own UEFI keys or a shim with secure boot, you’ll have a very different set of vulnerabilities from someone running Mint with secure boot turned off.

For a short time Microsoft marketed an upgrade path the a full Unix like operating system for Windows. It was widely known that some of the Windows shell differences from Unix were just arbitrary aliases for the Unix commands.

If you ever get the chance, try using an old Android device you do not use, enable the developer options for the ADB bridge and try hacking around, if you have an interest in understanding how Linux security works in practice when it is done right. The Linux side of Android is an interesting case study if you understand the premises of Android. It is a Linux system that is secure for people with absolutely no understanding of Linux or networking. This is enabled by allowing the app developer to become something like a full Linux user on the Android device. All of the Linux kernel binaries that could modify the kernel in any way are removed and there is no administrative account present. When the hardware manufacturer logs out for the last time, all the administrative and modifying binaries are deleted. This secures the remaining files that are all marked as read only. Android also has a very robust SELinux implementation in place. Every location present has a defined security context. So there are places where you can create temp files and store data, but the things that can be added and manipulated are very limited in their access to other parts of the system. If you mess around with this the way these tools work will become much more tangible.

By comparison, most distros ship with a very open and unconfigured security context. The SELinux configuration is still extremely permissive in distros with SELinix integrated, like Fedora. This is nothing like Android’s setup. The primary reason for a lot of the ROM community on Android and how they have root access is because of exploiting CVE vulnerabilities in the kernel that were found after the kernel was shipped. Android works with orphan kernels that only the manufacturer can update because they retain the source code for the kernel modules that they add at the last minute. This is the depreciation mechanism used by the hardware manufacturer to steal ownership with Android devices.

If you understand how exploiting CVE’s works on a simple abstract level, and why it is necessary in order to bypass the immutable system (read only file system without tools to modify Linux kernel binaries), and how SELinux adds further restrictions based on the context of who is accessing the directory or command/executable, you should better understand the complexity of the question you’re asking. The app developer on Android is like your equal on the device. They can do what you can do, and that is why you are so restricted too. Your measures of control on Android are very limited and just in the app environment spaces.

Once I learned the basics of this system, it has become the way I view all software systems intended to enable ignorant consumers. Tremendous power to alter systems is included in these platforms, platforms like Windows.

Those that are trying to make the Windows games work on Linux are likely completely focused on functionality. When people talk about things like sandboxing, they are almost always talking about library dependencies and not any kind of security context. It is likely that any malware that targets Windows binaries will not work on Linux directly, but something that targets Linux specifically is another matter entirely; it is security through obscurity, which means no security at all. Unless you’ve taken active measures to limit the PID/GID/security context of the process that is running the software, it has all the same permissions of the user that called it. It can delete, view, and write anywhere that you can with the user/group/sc that launched it.

Theoretically, the virus is made for Windows, so it would have different effects on Wine.

It probably wouldn’t do anything dangerous. But still, scan it with VirusTotal.