When running a game such as Elden Ring on Linux, how does its anti-cheat system handle kernel-level access? My understanding is that Linux does not simply let a Windows anti-cheat program access the kernel in the same way. Does the compatibility layer provide some limited Windows-like kernel functionality, does the game use a non-kernel version of the anti-cheat, or is the software somehow made to think it has access that it does not really have? I'm curious about what is actually happening behind the scenes.
3 Answers
Easy Anti-Cheat and BattlEye both support configurations that run without kernel-level access. Developers have to enable those options, though, so Linux compatibility is ultimately a choice made by the game developer. If a title works on Linux, it usually means the anti-cheat is using a supported user-space mode rather than Linux pretending to be Windows.
There are a few possible approaches. An anti-cheat can run in user space with limited visibility, or it can interact with the Windows-like environment provided by Wine or Proton, which only implements some kernel behavior. Linux can also use kernel-level software, but the operating system generally gives the user much more control over inspecting or removing it. That is different from the locked-down Windows model many kernel anti-cheats expect. So in cases where a game works, it is usually using a less invasive anti-cheat mode or relying on compatibility-layer support rather than receiving unrestricted Linux kernel access.
The anti-cheat is mainly there for online multiplayer, since Elden Ring includes invasions as well as cooperative play. It may discourage less sophisticated cheating, but it does not prevent every exploit or guarantee that multiplayer will be free of cheaters.
That makes sense. I was wondering whether Wine or Proton had some kind of wink-and-nod compatibility layer that satisfies the anti-cheat’s expected kernel calls without giving it unrestricted access, and that seems to be part of what can happen.