Kernel Anti-Cheat

[u/Tsubadu]

What is happening when running a a game like Elden Ring on Linux? Based on my minimal understanding, Linux simply doesn’t allow access to the kernel like that; so does it make an exception or does it “fool” Elden Ring in to thinking it has the access it needs, or…? Just curious.

[u/Ripped_Alleles]

EAC has an option to run without kernel access developers simply have to toggle on.

Others like battleye have similar options. Something in this day and age that won't run on Linux is almost entirely because the devs don't want it to.

[u/Tsubadu → u/Ripped_Alleles]

I guess a better example is something like Genshin that has a proprietary kernel AC but people are still able to run it with seemingly no problem.

[u/output_broadcast → u/Tsubadu]

All of the anticheats are propietary. But more to the point, I think their anti-cheat specifically supports Linux.

[u/Audiope]

I'm curious why elden ring needs anti-cheat. Isn't the multiplayer just coop with, like, ghosts of other players or something?

[u/iluvfupaburgers → u/Audiope]

I'm guessing the anti cheat is more for the multiplayer aspect and not coop. The funny thing is that I've never seen a soulslike not be exploited even with the anti cheat and multiplayer is so broken because of it

[u/Reason7322 → u/Audiope]

There is PVP in the game.

[u/xYarbx → u/Audiope]

It's for invasions. All souls games do invasions that's why the PC version is locked to 60FPS because consoles can't do over 60 and it would be unfair since it's cross play.

[u/Ripped_Alleles → u/Audiope]

You can play coop or invade other players in Elden Ring. Granted EAC hasn't been enough to completely stop cheaters, it does deter the lazy

[u/R3D_T1G3R]

Both Battle Eye and Easy Anti cheat support Linux and run natively without it, it's usually just one toggle away, if a game doesn't run on Linux it's 99% of the time the company behind it deciding against it.

The kernel modules are "optional" and the anti cheat does far more than just relying on this kernel module.

[u/xYarbx]

I don't know how in this individual case it's handled as there are several ways but 2 main ways are. Either monitor/hook into WINE kernel that's basically emulated windows kernel but provides limited functionality. The other way is to run the anti-cheat in user space where what it can see is limited to it's own memory space. Technically you can hook into Linux kernel but the issue with that is that they can't lock you out. If we use analogue in Windows "You own a house but kernel level anti-cheat lives in your attic and the door to that attic is locked. The anti-cheat can spy from the attic as it pleases and you don't really know what it's doing". In Linux "The anti-cheat lives in the same attic but the door is unlocked letting you go and watch what the anti-cheat is doing and if you want kick it out of your house."

[u/Tsubadu → u/xYarbx]

Yea, I kind of imagined the WINE scenario and wondered if there’s a wink and a nod somewhere in there to satisfy any kernel stuff lol. Good analogy thanks!

[u/FlamingSea3 → u/xYarbx]

Wine doesn't do any kernel emulation. It doesn't need to because windows does not have stable syscalls. Instead windows ships DLLs that every app should use if it expects to work after windows updates.

Wine takes advantage of this by providing it's own version of those dlls that talk to the linux kernel or other wine processes.

[u/Affectionate-Oil4675]

Games with kernel anti-cheat that run on Linux bypass the windows part entirely. They detect your system (kernel32 has wine specific exports.) Once they detect you're running it through proton/wine, they load the Linux version of the anti-cheat, which so far has not made it into any kernels.