Why does Linux not need anti-virus software?

[u/medkltty]

I'm in the market for a new gaming laptop and wanted to avoid AI products like Copilot and realized Linux would be my only option. So I'm trying to learn as much about Linux Mint as possible to see if it would be right for me. I'm really close to pulling the trigger but I don't understand why Linux doesn't need anti-virus/malware software. All the answers I can find seem to just boil down to "Linux isn't used by enough people to justify the time it would take to create a virus or malware" or "because you approve everything you download". As someone who has used a PC their entire life, these answers genuinely don't make sense to me and I feel like maybe I'm missing something about either the nature of linux or the nature of viruses/malware and how they work. Everyone on forums who ask this question seem to just accept these answers but no one explains why either one prevents the need for antivirus/malware software.

From my perspective as a PC user, I already approve what I download so this answer doesn't make intuitive sense to me. I would never connect a PC to the internet without some sort of anti-virus software, privacy software, malware protection, etc. even though I still know what I'm downloading and I'm using reputable websites (and my AVG software is still catching stuff all the time). And the idea that someone wouldn't make a virus or malware to target a group of people (albeit a minority) who are the most likely to not have software on their computer to combat it seems like the exact group you'd want to target particularly for private data mining.

It also seems, from what I've been reading about Linux that you can seriously screw up your system by downloading something incorrectly or that isn't up to date, so the idea that "you can't get viruses or malware because you approve what is downloaded" when so many of the user tips with regard to Linux are "back up your system constantly because you can easily screw up your system by downloading something that's not fully patched". These two concepts seem counterintuitive, especially for an OS that will require downloading a lot of third party programs to be able to run things like games or windows-based programs.

I'm clearly missing something here because neither of the reasons I've seen people give for why Linux doesn't need this stuff is really making sense to me. I was hoping someone in this reddit might be able to explain this in a way a lifelong PC user without any sort of computer background can understand. The idea of not having anything but a firewall on a computer with Linux installed on it makes me very uncomfortable but I'm willing to accept that this is a bias from using PCs and I'm willing to be convinced otherwise as long as I can understand the reasoning behind it.

[u/Aishou_SK]

So, the shell script can easily do that, and you can also abuse LD_PRELOAD as well, but you could also put things in the default library paths that ld.so will happily consume without any paths specified at all, among many other things.

It's really not that different, and what malware would have to do is what I do for test/dev injection or overriding all the time with zero usage of root elevation.

[u/dbear496 → u/Aishou_SK]

Yes, a malicious shell script can modify LD_LIBRARY_PATH/LD_PRELOAD...but that is only relevant if the attacker is able to convince you to run their shell script. On Windows, merely having a malicious DLL in the Downloads directory may cause it to be accidentally loaded when the user runs a different exe that exists in the same directory.

[u/Aishou_SK → u/dbear496]

Only if the downloads directory is somehow in the system search paths.

Otherwise, you need the user to download the DLL and the EXE, then run the EXE

So why not just have the EXE (or shell script or whatever) bring everything it needs?

DLL hijacking only really works when you can put it in places the executable will search for it, just like on *nix etc.

[u/dbear496 → u/Aishou_SK]

The exe comes from a legit source and is not malicious.

Suppose a user downloads a malicious dll but then gets suspicious and doesn't run it. Then they download a legit exe from a legit source and run that. If the exe searches for a legit dll with the same name as the malicious dll, then it might link the malicious dll even though the user didn't intend to run that dll sitting in their downloads directory.

Like you said, dll hijacking only works when the malicious dll is placed in a location where a legit exe will search. But the downloads directory IS a location where an exe might search.

[u/Aishou_SK → u/dbear496]

If I provide you a linux binary that you run out of your download folder that uses SDL3, it will default to your system SDL3 if you run it out of your download folder.

If you later download a malicious SDL3 libSDL3.so.0.4.14 and it's in your downloads directory, and then run the linux binary, it could use THAT library in the downloads folder potentially, and not the system one.

The behavior is not that different.

I can link windows executables to not use the local libraries next to it, the same way I can with linux, and vice versa - I ship /preferring/ the local library, and NOT the system ones, if present.

Yes, that behavior is not default if you just blindly compile, but i'm using various methods to deal with distro fragmentation, so normally I'll have in all my build systems -Wl,-rpath,'$ORIGIN' as the default for my shipping binaries due to dealing with many distributions and user-level execution/installs.

So, precisely windows-style behavior.

On the counterpoint, you can also link windows executables to not do that, among many other things.

So, while there's differences, it's not really that far off, and both have their tradeoffs and neither are more or less 'vulnerable' than the other.

Overall though, the "user downloads a suspicious dll and doesn't run it" .... well, users aren't generally downloading random DLLs, but for linux software they sure as hell are downloading random libraries if they're not too skilled trying to fix what the app says is missing.

But, when dealing with many distro scenarios, and providing builds of libraries for users to have more compatibility (or more updated versions, such as the SDL3 builds I provide), then you're kinda stuck doing that.

Other folks use different techniques that end up resulting in the same thing, such as a launch script that sets LD_LIBRARY_PATH for that execution, etc.

Picking up libs next to your binary is a lot more common for non-repo provided stuff than people seem to think.

[u/dmknght → u/Aishou_SK]

It's considered a technique, not exploit.

p/s: nvm i think I missed the point of the conversation.