--- title: Epic Games rebuilds Easy Anti-Cheat for Linux with... description: Epic Games is rebuilding Easy Anti-Cheat for Linux as EAC Linux v2, replacing the old approach with a systemd service paired with eBPF kernel programs that... canonical: https://daily.dev/posts/epic-games-rebuilds-easy-anti-cheat-for-linux-with-systemd-and-ebpf-sodohgtio twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Epic Games rebuilds Easy Anti-Cheat for Linux with systemd and eBPF | daily.dev og:description: Epic Games is rebuilding Easy Anti-Cheat for Linux as EAC Linux v2, replacing the old approach with a systemd service paired with eBPF kernel programs that... og:url: https://daily.dev/posts/epic-games-rebuilds-easy-anti-cheat-for-linux-with-systemd-and-ebpf-sodohgtio og:image: https://api.daily.dev/og/posts/SoDohGtIo.png og:image:alt: Epic Games rebuilds Easy Anti-Cheat for Linux with systemd and eBPF og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Epic Games rebuilds Easy Anti-Cheat for Linux with systemd and eBPF **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary Epic Games is rebuilding Easy Anti-Cheat for Linux as EAC Linux v2, replacing the old approach with a systemd service paired with eBPF kernel programs that only runs while a protected game is active. It relies on UEFI Secure Boot, signed kernels, and attestation, with approved signing authorities including Canonical, Fedora, Universal Blue, Debian, SUSE, Rocky Linux, and Microsoft's UEFI CA. Distro maintainers are being asked to align configurations so their keys can join a key list Epic plans to eventually open source. Steam Deck lacks the needed functionality today, though Epic says it's working with Valve on support. The change ships alongside a preview Epic Games Launcher with Linux support, continuing efforts toward bringing Fortnite to Linux. ## Content Epic Games is rebuilding Easy Anti-Cheat for Linux. The new version, EAC Linux v2, is meant to close the protection gap with Windows that has kept many multiplayer games off Linux and the Steam Deck. Fortnite is the first title planned to use it. ## How it works EAC Linux v2 doesn't use a Windows-style kernel driver. It runs as a systemd service paired with eBPF programs that watch for tampering. The service launches only when a protected game runs and can be unloaded afterward. To make that trustworthy, Epic leans on the Linux security stack: - UEFI Secure Boot with attestation - TPM 2.0 and measured boot - A signed kernel and signed kernel modules - IOMMU, kernel lockdown in integrity mode, disabled kexec, and LSM BPF Secure Boot keys must come from a recognized signer. Canonical, Fedora, Universal Blue, Debian, SUSE and Rocky Linux are named, as is Microsoft's UEFI CA. If a system fails the check, the protected game won't launch, but it doesn't trigger a ban. ## What distros need to do Distribution maintainers are being asked to align their configurations with EAC's requirements so their signing keys can go on a well-known key list. Epic eventually plans to open source that list. Planned support covers Ubuntu 22.04+, Fedora 43+ and Debian 12+, once maintainers meet the requirements. Epic says it will share these improvements with other developers, and it is working with Fedora Project leader Jef Spaleta. Steam Deck support isn't ready. The Deck lacks some of the required functionality, and Epic says it is talking with Valve about adding it. The push comes alongside a preview of a new Epic Games Launcher with Linux support. The goal is for more Windows-only games, Fortnite included, to run on Linux through Wine/Proton. ## The bypass problem Security researcher Matthew Garrett says the TPM measurements can be bypassed. A detailed walkthrough lays out two routes: 1. Reset the TPM through a hardware pin, then replay a fake measurement log. 2. Swap in an external USB-to-SPI TPM module, roughly $20, in place of the motherboard's TPM, and program it with trusted-looking measurements. Either works because the remote attestation server can't verify which specific TPM belongs to a given system. The analysis concludes that this might raise the cost enough to deter casual cheaters, but the scheme isn't technically robust. That seems about right to me. Anti-cheat has never been about making cheating impossible, only expensive enough to be not worth the bother. Whether a $20 gadget and some soldering-level effort clears that bar is something Epic will find out quickly once Fortnite is live on Linux. ## Questions this post answers ### How does EAC Linux v2 work without a kernel module? It replaces the old kernel driver approach with a systemd service paired with eBPF kernel programs, which starts only while a protected game is running and can be unloaded afterward. Integrity checks rely on existing Linux features: signed kernels, signed kernel modules, and UEFI Secure Boot with attestation, rather than a persistent closed-source kernel driver. _Anyone tracking Linux gaming compatibility can follow anti-cheat architecture shifts like this on daily.dev._ ### What do Linux distributions need to do to support Easy Anti-Cheat's new eBPF system? Distributions must support UEFI Secure Boot with keys signed by a recognized authority, and maintainers are being asked to align their configurations with EAC's requirements so their signing keys can be added to a well-known key list, which Epic plans to eventually open source. Canonical, Fedora, Universal Blue, Debian, SUSE, and Rocky Linux are among those already covered. _Distro maintainers weighing Secure Boot and signing requirements can keep up with changes like this on daily.dev._ ### Does the Steam Deck support the new Easy Anti-Cheat Linux v2 system? Not yet. The Steam Deck currently lacks the functionality EAC Linux v2 requires, and Epic says it is working with Valve to add the needed support so protected games using the new anti-cheat system can run on the device. _Steam Deck owners and Linux gaming developers can track compatibility updates like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 202 comments across hackernews, lobsters (as of 2026-10-17). **TL;DR:** Awesome Gaming on Linux Without Cheating: Reactions are dominated by concern that EAC Linux v2's reliance on signed kernels, secure boot, and attestation hands control to Epic and distro gatekeepers, though some welcome that it's eBPF-based rather than a kernel driver and could finally bring more Windows-only games to Linux. Epic's EAC2 v2 seems fairly easily bypassable: Commenters largely agree the technical bypass is plausible, with many debating whether hardware-level mitigations (fTPM whitelisting, certificate chains) could close the gap, while others argue dedicated cheaters will always route around software-based anti-cheat entirely. **Sentiment:** 14% positive · 31% mixed · 55% skeptical **The case for** - Using eBPF instead of a proprietary kernel module is seen as safer and less likely to cause a CrowdStrike-style crash. - Requiring even a cheap external TPM dongle could be enough friction to deter casual cheaters even if determined ones can bypass it. - It could finally enable previously Windows-only or EAC-blocked games (like Apex Legends) to return to Linux. - Restricting attestation to CPU-integrated fTPMs with a vendor-rooted certificate chain could close the specific bypass described. - Some argue the approach is more private than Windows anti-cheat since lockdown mode also restricts what EAC itself can read. **The pushback** - Requiring signed kernels/modules from approved vendors excludes popular distros like Arch, Gentoo, and NixOS and removes the ability to run a custom-compiled kernel. - Remote attestation schemes asking a potentially compromised system to vouch for itself have failed repeatedly over the past 20 years. - Many see attestation and lockdown as primarily about vendor control and lock-in rather than real security, since a leaked signing key defeats the whole scheme. - Hardcore cheaters already use DMA PCIe cards and HDMI/USB hardware interception, which no software or TPM-based anti-cheat can prevent. - Concerns that this normalizes remote attestation creep into other software (banking apps, etc.) and pushes Linux toward Android-style lockdown. **By community** - hackernews (heated): A long, contentious thread pits strong distro-freedom objections (signed kernels, secure boot, IOMMU) against commenters defending the requirements as reasonable security trade-offs, with side debates on Valve/Proton's role and whether Linux gaming is really affected. - lobsters (mixed): Discussion leans cautiously accepting of the eBPF-based, measured-boot approach as better than a kernel driver, while still flagging real concerns about root-level trust, distro gatekeeping, and whether it actually stops cheating. **Hottest debate:** Awesome Gaming on Linux Without Cheating: Whether locking down kernels/boot with vendor-approved signing keys is a legitimate security trade-off or primarily a control/lock-in mechanism that excludes popular enthusiast distros. **Open questions** - Will Valve bring SteamOS/Steam Deck into compliance with these requirements, and what happens to Linux gaming adoption if it doesn't? - Can TPM whitelisting reliably distinguish a genuine CPU-integrated fTPM from a spoofed external module in practice? - Will NixOS and similar source-based or reproducible-build distros ever be able to meet the signed-kernel requirement given their build model? - Could IOMMU/VT-d and USB heuristics meaningfully curb DMA- and injection-based cheating even if TPM attestation is hardened? - Will this scheme actually reduce cheating meaningfully, given that hardware- and video-based cheats remain unaffected? **Highlights** > Burying the lede: The anticheat used in Fortnite and other titles will support Linux soon. Support will be done via eBPF rather than kernel modules, and will require a measured boot with only a few trusted Linux distribution keys. > — [calvin on lobsters · 30 points](https://lobste.rs/s/x9fqa4/awesome_gaming_on_linux_without_cheating#c_ykiod1) > I suspect that they will end up only allowing fTPMs built into CPUs. Most CPUs already have that anyway (from what I can find, Intel has it since Skylake, which is 10 years old, and AMD since Zen 1). I don’t buy the argument that cheaters would avoid spending 20$ or so on an external TPM when they already spend more than that on cheating tools. I also wouldn’t be surprised if they already enforce this kind of thing on Windows, especially considering Windows 11 requires a TPM (though it’s bypassable). > — [pta2002 on lobsters · 2 points, 1 comments](https://lobste.rs/s/1iin5o/epic_s_eac2_v2_seems_fairly_easily#c_qcuyqq) > I've been saying for years that this is the the only "solution" epic would accept. "We support gaming on Linux ... as long as you give up the freedom of controlling the software that runs on your computer." They also require kernel lockdown, which makes sense given their goals. But they didn't mention that kernel lockdown currently means suspend to disk (or actually the resume-from side) doesn't work (although I would welcome this being fixed). Another fun obstacle: say goodbye to Nvidia DKMS modules (or any other DKMS), they won't work here. They talk about how extremely lucrative the cheating industry is. But they conveniently omit the fact that their anti-cheat solution doesn't actually stop all cheating. For sure, at this point it has had a big impact. But, the cheating industry is more than capable of and happy to sell you hardware which implements much more subtle cheats I'm a way entirely transparent to the computer, by processing video signals and emulating inputs. You can't implement wallhacks like this, but you can still implement effective aimbot, aim assist, and auto trigger, and anyone playing against such a cheater would struggle to realise that they're even cheating. So Epic offers the _feeling_ of not playing against cheaters in exchange for control of what you run on your computer. It's crazy to see just how overtly slimey they are in every word they use in this article. Their Q&A reads like a politician answering carefully curated questions that are superficially representative of concerns but are in reality designed to mislead. So what that there is no Kernel module? You still have unfettered access to what I do on my computer. I can use my own SB keys? Cool, yes, but not to boot the OS for the purposes of using this. The year of the Linux desktop is never coming, instead it will be the year of the Windows distribution of Linux desktop. Note to anyone who is thinking of retroactively using this for their game that I already paid for: I will demand my money back. > — [atk on lobsters · 2 points, 1 comments](https://lobste.rs/s/x9fqa4/awesome_gaming_on_linux_without_cheating#c_ebp28r) > From what I'm told by friends who work in the gaming industry, there are hardcore cheaters that hook into the HDMI and USB via an external computer. Assuming this hearsay is viable, I don't think you can really prevent dedicated cheaters while keeping the games playable. > — [orib on lobsters · 1 points, 1 comments](https://lobste.rs/s/1iin5o/epic_s_eac2_v2_seems_fairly_easily#c_kbxcew) > There have been many attempts to do remote attestation, going back to the mid 2000's. Variations like NAC, SoH, trusted computing, etc. All of these attempts failed. Why? Because you're asking a potentially compromised system if it's compromised. That can't end well. TPMs help a bit, as you get at least the promise that a private key isn't being leaked. But so what? You don't have to crack that. You can just ask the people involved to compromise the systems on your behalf. So it's been 20 years, and people are still trying to do the same thing which won't work. > — [alandekok on lobsters · 1 points](https://lobste.rs/s/1iin5o/epic_s_eac2_v2_seems_fairly_easily#c_1uky04) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50088166) · 58 points · 149 comments - [lobsters](https://lobste.rs/s/x9fqa4/awesome_gaming_on_linux_without_cheating) · 34 points · 36 comments - [lobsters](https://lobste.rs/s/1iin5o/epic_s_eac2_v2_seems_fairly_easily) · 25 points · 15 comments - [hackernews](https://news.ycombinator.com/item?id=50110229) · 3 points · 2 comments ## Similar posts on daily.dev - [Epic's Linux anti-cheat wants TPM 2.0 and a stack of settings, and you can check your own PC in about five minutes](https://daily.dev/posts/epic-s-linux-anti-cheat-wants-tpm-2-0-and-a-stack-of-settings-and-you-can-check-your-own-pc-in-abou-tt1efqg0h) · XDA Developers · 3 upvotes · 1 comments - [Linux's Easy Anti-Cheat problem might finally get fixed as Epic Games posts an interesting job listing](https://daily.dev/posts/linux-s-easy-anti-cheat-problem-might-finally-get-fixed-as-epic-games-posts-an-interesting-job-listi-e8icrkksy) · XDA Developers · 0 upvotes · 0 comments - [Good News\! EA Is Expanding Its Anti-Cheat to ARM64, and Linux Could Be Next](https://daily.dev/posts/good-news-ea-is-expanding-its-anti-cheat-to-arm64-and-linux-could-be-next-uv08uvfcp) · It's Foss · 1 upvotes · 0 comments - [TLAC Aims To Be An Open-Source Alternative To Kernel-Level Anti-Cheat Systems](https://daily.dev/posts/tlac-aims-to-be-an-open-source-alternative-to-kernel-level-anti-cheat-systems-p8tn2zd0q) · Phoronix · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/epic-games-rebuilds-easy-anti-cheat-for-linux-with-systemd-and-ebpf-sodohgtio) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Epic Games rebuilds Easy Anti-Cheat for Linux with systemd and eBPF","url":"https://daily.dev/posts/epic-games-rebuilds-easy-anti-cheat-for-linux-with-systemd-and-ebpf-sodohgtio","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/epic-games-rebuilds-easy-anti-cheat-for-linux-with-systemd-and-ebpf-sodohgtio"},"datePublished":"2026-10-15T00:51:46.443Z","dateModified":"2026-10-17T08:43:49.721Z","description":"Epic Games is rebuilding Easy Anti-Cheat for Linux as EAC Linux v2, replacing the old approach with a systemd service paired with eBPF kernel programs that...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4e9aacb3e8b118cc800cb2705773611?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4e9aacb3e8b118cc800cb2705773611?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/epic-games-rebuilds-easy-anti-cheat-for-linux-with-systemd-and-ebpf-sodohgtio","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Epic Games rebuilds Easy Anti-Cheat for Linux with systemd and eBPF"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/epic-games-rebuilds-easy-anti-cheat-for-linux-with-systemd-and-ebpf-sodohgtio#faq","mainEntity":[{"@type":"Question","name":"How does EAC Linux v2 work without a kernel module?","acceptedAnswer":{"@type":"Answer","text":"It replaces the old kernel driver approach with a systemd service paired with eBPF kernel programs, which starts only while a protected game is running and can be unloaded afterward. Integrity checks rely on existing Linux features: signed kernels, signed kernel modules, and UEFI Secure Boot with attestation, rather than a persistent closed-source kernel driver. Anyone tracking Linux gaming compatibility can follow anti-cheat architecture shifts like this on daily.dev."}},{"@type":"Question","name":"What do Linux distributions need to do to support Easy Anti-Cheat's new eBPF system?","acceptedAnswer":{"@type":"Answer","text":"Distributions must support UEFI Secure Boot with keys signed by a recognized authority, and maintainers are being asked to align their configurations with EAC's requirements so their signing keys can be added to a well-known key list, which Epic plans to eventually open source. Canonical, Fedora, Universal Blue, Debian, SUSE, and Rocky Linux are among those already covered. Distro maintainers weighing Secure Boot and signing requirements can keep up with changes like this on daily.dev."}},{"@type":"Question","name":"Does the Steam Deck support the new Easy Anti-Cheat Linux v2 system?","acceptedAnswer":{"@type":"Answer","text":"Not yet. The Steam Deck currently lacks the functionality EAC Linux v2 requires, and Epic says it is working with Valve to add the needed support so protected games using the new anti-cheat system can run on the device. Steam Deck owners and Linux gaming developers can track compatibility updates like this on daily.dev."}}]} ```