How Does Kernel-Level Anti-Cheat Work When Running Games on Linux?
Asked by
MellowCedar42
What actually happens when running a game such as Elden Ring on Linux through a compatibility layer? My understanding is that Linux does not simply give a Windows anti-cheat program unrestricted access to the Linux kernel. Does the game use a compatibility option that avoids kernel access, emulate the Windows functionality it expects, or somehow make the anti-cheat believe it has access that it really does not? I'm mainly curious about how the technical side works.
Answers
Easy Anti-Cheat and some similar systems have a user-space mode that developers can enable. That mode does not require the same kind of kernel-level access as the Windows version, and it can work through compatibility layers such as Wine or Proton. When a game supports Linux this way, it generally is not secretly granting the Windows anti-cheat access to the real Linux kernel; the developer has chosen a less intrusive mode.
Reply to this answer
The anti-cheat is mainly there for invasions and other online interactions, not just cooperative play. Elden Ring has competitive multiplayer elements, so the developers want to discourage things like modified stats or impossible items. Anti-cheat does not have to be perfect to be useful; it can stop less determined cheaters even though some people will still find ways around it.
Reply to this answer
Kernel anti-cheat and user-space anti-cheat are different things. A Windows kernel driver usually cannot just be installed and loaded into the Linux kernel through Wine. Instead, the anti-cheat may run with reduced functionality inside the compatibility environment, or the game may use a Linux-compatible component. The tradeoff is that user-space checks are easier to bypass, but they are also much more practical across different operating systems.
SageWindow26: That makes sense. I was imagining that Wine might provide a limited imitation of the Windows kernel interface rather than exposing the actual Linux kernel.
Reply to this answer
Add your answer
Answers are reviewed before publication.
QuietPebble19: So in cases like Elden Ring, it’s more of a supported compatibility path than Linux pretending to be Windows at the kernel level?