If gamers are willing to give up some privacy to avoid using Windows, could a kernel module provide effective anti-cheat on Linux? Is this technically feasible, and what practical or security concerns would make game developers or Linux users reject it?
5 Answers
The main problem is that Linux users generally control their own systems. They can inspect, modify, remove, or block the anti-cheat, and an open-source implementation could potentially be patched to report that everything is fine. A closed-source kernel module would also taint the kernel and be a deal-breaker for many people.
A lot of Linux users would simply refuse to install spyware-like software in the kernel, even if it enabled more games. That makes the business case weak: developers could build it, but the audience willing to accept it may be too small. Better server-side detection and game-specific approaches would be preferable to giving an anti-cheat unrestricted access to the machine.
There have been efforts to bring existing anti-cheat systems to Linux compatibility layers, including arrangements where the game verifies that it is running through a trusted interface. That approach is less invasive than a native kernel module, though it still depends on developers and anti-cheat vendors deciding that Linux support is worth the effort.
Yes, it’s technically possible. A Linux anti-cheat could run with root or kernel-level privileges, much like a rootkit or other low-level security tool. The bigger issue is whether users would trust proprietary code with that much access to their systems.
Anti-cheat doesn’t necessarily need to be kernel-level, but developers worry that user-space software is easier for cheats to evade. Linux has more distributions, configurations, permissions, and customization than Windows, so supporting every setup would be expensive and complicated. A system designed specifically for locked-down competitive events could work, but getting ordinary users to install one would be difficult.
That sounds more realistic than asking users to install a permanently privileged module, especially if the verification can be limited to what the game actually needs.