It's the other way around. Windows will stop supporting kernel level anti-cheat because of Crowdstrike
this post was submitted on 08 Jun 2025
64 points (95.7% liked)
Linux
55044 readers
970 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 6 years ago
MODERATORS
Meanwhile in indie land, I just tried to cheat my way through a Chapter 3 minigame in Deltarune, and Toby Fox himself showed up in his dogsona to blow up the game and make me start the minigame over.
This is the extent to which anti-cheat measures should go.
AFAIK Microsoft have plans to block kernel level anti-cheat on Windows. After the CrowdSec issues last year, they're rethinking which types of programs should even be allowed to run in kernel space.
load more comments
(8 replies)
One way I can imagine it being some certified Linux kernel versions that are accepted and worked together with anticheat creators. That way Valve could use the Kernel in Steam Deck or SteamOS, so any game works out of the box. And other distribution users can just install this Kernel too, if their distributions provide it.
Anyone who don't want to have Kernel level anticheat systems enabled on their system, do not need to install the Kernel. Therefore they are secure against it. But for anyone else who wants it, they can. At least this option would be a compromise.
I have 3 kernels installed anyway, what's one more?
if it's linux, it has to be open source. If it's open source, people will code around it immediately. How about not trying to shoehorn this useless crap in the first place?
Besides your argumentation that open source is less secure, a driver or program does not need to be in the Kernel to work with it. Does it? Kernel level anti cheat systems are available on Windows too, without being in the Windows Kernel. All it needs is a Kernel module to load it separately. Something like the Nvidia proprietary driver. I don't know if this would work for Anticheat.
Back to your point of open source and code around it. Well they code around the proprietary tools too. Reverse engineering stuff is possible. So your argumentation is a bit weak. Open Source means more people are looking into and its actually more secure and up to date (for common and actually developed drivers).
And you don't have to use it, if you don't like. How about letting people give options instead calling something they want or need being useless? It has a use and reason, so its by definition not useless. Instead using Windows, they could use Linux.
where did i say it's less secure? I said it will be coded around. as in forked and the changes patched out/worked around. The point is that it's pointless to even try. Because it won't work for those who do choose to use it, due to all the ones bypassing it
If the Kernel is not signed, then it does not matter. The whole point of signed Kernels is to only execute that specific code. Its not pointless. But besides that, even if you don't like Open Source, nobody said the Anticheat software has to be open source. This is something you implied. I don't think any of the Anticheat companies would Open Source it anyway, so this was not my suggestion at all.
It doesn’t have to be open source. There’s plenty of binary firmware and drivers around.
I'm not a programmer or cheater or anything, but I think the answer is yes and no. Yes it could technically be done and even work as intended as long as the device is locked down to prevent the user from replacing the shipped kernel (which would be a bad thing for users). However, savvy people could (in theory) make custom kernels that lie to the kernel module, causing the module to report there is no cheating when there is. It's my understanding that it's close to the current situation with Windows and virtual machines and anticheat: you can cheat by running your game in a VM and then have that virtual hardware extract secret information or flip bits in the right spots. Most competitive games will refuse to run in a VM for this reason.
load more comments
(11 replies)
The game developers could if they wanted to, but I hope they won't. I will not willingly install a rootkit on any of my computers. I wouldn't buy or pirate a game that requires one even if it could run on Linux. I don't even like running user level anti cheat, but at least that can be run in a sandbox.
Is it possible to have kernel-level anti-cheat in Linux?
Yes, Absolutely. But, people would throw a fit. There is probably no way to opensource it without also making it easier to bypass. There would be a concerted effort to reverse engineer it and remove it from the system while maintaining functionality
Maintainers of anti-cheat software are not volunteers. If there was an order from management to port the system to Linux, it would happen. It's just that with the Linux userbase as small as it is, it's simply not profitable to cater to them.
I think that if it ever happens, there will be a influx of people moving to linux, or abandoning their duelboots
I fully disagree. The thing keeping regular people away from Linux as an OS is not that they can't play some online game with Anti-cheat.
Linux is in a weird place right now. It's actually a perfect fit for non-technical users that use their computers for email, web browsing, and Netflix, but those users don't know what an operating system is, let alone that there are options. More technical users tend to require more specialized applications, and if there isn't a native linux port available, you have to do some research for alternatives, or to find a way to run it in wine.
Windows is shitty, but it's comfortable. And I know that it will run any software I throw at it with basically no research or troubleshooting.
There is probably no way to opensource it without also making it easier to bypass.
I want to highlight this in case OP missed it. Your point here is critical.
Now I'm going to nerd out a bit about it:
To expand on your points above (for OP), there's an impasse here between the anti-cheat developer and the distro developers.
The anti-cheat developer needs support from the distro developer to get their anti-cheat packages signed, to allow them to run in the kernel. Any package not signed by the distro developer that tries to run at kernel level will be treated by the OS as a virus. (Windows has this protection as well.)
Getting the code signed is pretty easy. The only requirement is sharing the source code, so the distro developers can make sure there's nothing nasty in it.
But the anti-cheat developers feel that they need to never share their source code, to prevent cheating. In some cases, they have even have contracts that prevent them from legally sharing parts of their source code (if licensed from a third party).
That's also not a problem. All they have to do is sign a binding contract for secrecy with every contributor to the distro, and then privately share their source code, and get it signed.
On Windows, that means signing a contract with Microsoft. On Mac, with Apple.
But on Linux, is just means tracking down and making separate agreements with a few thousand independent individuals...
So the technical solution is pretty simple: share code, get code signed, run in kernel.
But the contrasting needs of everyone involved make it unlikely on Linux.
@Godort @SpiderUnderUrBed That's really the conundrum, in an open source kernel, where can you put anti-cheat that someone else can't readily pull out?
I feel like bpf would be a decent solution for anticheat. I believe you can limit what an ebpf program can look at quite effectively.
I hope to fuck not.
What does it even mean? People can recompile the kernel to turn the crap off.
And then the game wouldn’t work.
You don't even need to do that. You could just blacklist or delete the module.
The game wouldnt work, but you could do it.
Absolutely nothing prevents somebody from writing a kernel level anticheat on Linux.
Users would throw a fit, and it would be way easier to bypass, but it certainly could be made.
It would need to be open source, distributing proprietary kernel modules is a nightmare that can cause the OS to fail to boot after every kernel update. An open source anticheat kernel module would probably be useless and easy to bypass.
It doesn't "need" to be anything. It could be a DKMS module that is mandatory for playing a game.
Whether people would like it and use it is a completely different story.
Sure hope not. If I wanted to run rookits I'd just use Windows. Why bother with Linux?
This is why I don't want more Linux adoption and don't understand people cheering every new user. We're in a sweet spot where a lot of games enable userland anticheat while we don't get kernel level ports (however they may be shipped doesn't matter). The only thing that'll come out of more adoption is kernel level anticheat ports that'll probably work with a few corporate backed distros only and we'll actually lose the games we have today. Because those will switch over the kernel level alternatives too.
The only way I'd like Linux to be a generic multiplayer platform is server side anticheats. It is very obviously the way to go and we are seeing extremely slow adoption (e.g. Marvel Rivals).
load more comments
(4 replies)
I think its less a question of the technical feasibility, and more of an issue that we, as users, don't want more closed-source blobs in our kernels. Meanwhile, the publishers insist that they can't open-source their anti-cheat code; Their idea being that if we know what's in it, it will be easier to bypass.
Basically, one distro or a few(at most) may get anti-cheat integrated one day(like, say, SteamOS), but it will likely never be in your standard Linux kernal.
They could go the rought of kernel modules, I would think, but for whatever reason, we're still having this conversation.
@MachineFab812 @SpiderUnderUrBed even if you have steamOS, what keeps you from downloading kernels from kernel.org and building?
load more comments
(1 replies)
Basically, one distro or a few(at most) may get anti-cheat integrated one day(like, say, SteamOS), but it will likely never be in your standard Linux kernal.
Valve also has server side anticheat in his games (Counter Strike or Deadlock). They are also against it.
Kernel-level anticheats can be bypassed anyways, but they are the easy solution for the corps that want to sell their multiplayer game.
load more comments
(1 replies)
It already works, but studios using anticheats that DO support Linux CURRENTLY don't bother implementing it because we're maaaaaybe 3% of the market on a good day, so they say "fuck it" and don't expend a few dev hours to enable it because they see it as a pain to deal with v users who need it.
we're maaaaaybe 3% of the market on a good day, so they say "fuck it"
So true. And worse than that, we're probably also the 3% most likely to skip buying a game that requires anti-cheat, anyway. Many of us are famously un-friendly toward closed source code running with invasive permissions.
It's a lot more than just "a few dev hours". You need to invest in training your testers on Linux, potentially purchasing new hardware, invest in programmers that can deal with writing for Linux, etc... Just because something like BattlEye has a checkbox for Linux support doesn't mean that all it takes is to click the button and rebuild your game.
AFAIK the current anticheat systems on Linux only run in userspace not at kernel level. This does mean Linux is theoretically easier to bypass compared to windows, some games just dont seem to want to take that risk. For as you said 3% of the market.
I personally disagree with that stance though, because all it takes is a hardware device and all software anticheats are useless no matter the os (think a raspberry pi, and capture card). So anticheat is really a losing battle anyways.
Yeah… Apex Legends dropped Linux support a while ago and that’s one of the reasons they cited; and tbf, there were publicly available Linux cheats that ran under proton.
But there’s also loads of publicly available “external” cheats that run the way you described. Some run through a virtual machine even. It’s just not a robust solution for preventing cheating, and mostly hurts the legit Linux players.