← Back to blog

RakuOS 2026.10.17: a locked-down boot chain, signed drivers, and ready for Easy Anti-Cheat v2

October 17, 2026 · Announcements

This update changes how RakuOS boots and loads drivers. The kernel, its boot arguments and every out-of-tree driver have been reworked so RakuOS meets the requirements of Epic's Easy Anti-Cheat (EAC) Linux v2. Along the way we fixed how the bootloader is kept up to date, added a rescue mode to the boot menu, made dual boot work better, rewrote our documentation, and started publishing documentation written specifically for AI assistants.

The last feature update for RakuOS 44

This is the last feature update for stable (RakuOS 44). From here on stable gets bug fixes only, until the RakuOS 45 release. That work is going full steam ahead on the staging channel, where our kernels, packages and images are already built for RakuOS 45. If you want to help test it, you can switch to staging in RakuOS System; if you'd rather have a quiet life, stay on stable.

The kernel

The RakuOS kernel is now signed with the RakuOS Secure Boot key, and the same key is built into the kernel to check the drivers it loads. Fedora's signed shim and GRUB start it once that key is enrolled on your machine (see "Secure Boot and the RakuOS key" below).

The kernel is now built with AppArmor as its only access-control system, with the BPF LSM enabled. SELinux is gone from the kernel entirely, so the old selinux=0, security=apparmor and apparmor=1 boot arguments are no longer needed and are no longer passed. The security modules load in this order: lockdown, yama, integrity, apparmor, bpf, landlock.

New default boot arguments

Every RakuOS image now boots with these arguments (from /usr/lib/bootc/kargs.d/10-rakuos.toml):

  • lockdown=integrity: kernel lockdown in integrity mode. Nothing can modify the running kernel from user space.
  • module.sig_enforce=1: only kernel modules with a valid signature load.
  • intel_iommu=on, iommu.passthrough=0, iommu.strict=1: the IOMMU is on and devices can't access memory directly without going through it. (AMD systems have it on by default.)
  • sysctl.kernel.kexec_load_disabled=1: kexec is disabled from boot, so a running kernel can't be swapped out for another one.

What you might notice:

  • Only signed kernel modules load. Drivers RakuOS ships are signed (see below). A driver built on your own machine is not, and the kernel refuses it.
  • Lockdown blocks writing to CPU registers (MSRs) and raw /dev/mem access. Undervolting and TDP tools that work that way stop working.
  • Lockdown also blocks hibernation. Suspend (sleep) is not affected.

You can still add your own boot arguments in RakuOS System › System › Kernel Parameters. They are added on top of the image's arguments and don't replace them. There is no switch to turn lockdown or signature enforcement off: these are deliberate security settings and exactly what anti-cheat checks for.

To see what's in effect:

cat /proc/cmdline
cat /sys/kernel/security/lockdown                  # shows [integrity]
cat /sys/module/module/parameters/sig_enforce      # shows Y

More: Kernel arguments.

Secure Boot and the RakuOS key

With Secure Boot on, the installer queues the RakuOS certificate (CN=RakuOS Secure Boot) for enrollment. At the first boot a blue MOK Manager screen appears: choose Enroll MOK, Continue, type the password rakuos, confirm, and reboot.

Earlier installers also created a per-machine module signing key ("RakuOS Machine Module Signing Key"). That key is no longer created or needed. To clean it up, and any other locally generated key left over from DKMS, akmods or an older install, run:

sudo rakuos enroll-secureboot-key

It keeps the RakuOS key, Universal Blue's keys and the keys of Microsoft and the major Linux and BSD vendors, and queues everything else for deletion. At the next boot MOK Manager offers Delete MOK: choose it, Continue, password rakuos, confirm, reboot.

A tip we learned the hard way: these keys live in your motherboard's firmware, not on the disk. Reformatting the drive doesn't remove them, so a key enrolled by a distribution you used years ago can still be there. The command above cleans those up too.

If you want to turn Secure Boot on later, run sudo rakuos enroll-secureboot-key first, then enable Secure Boot in the firmware settings and complete MOK Manager on that boot. The RakuOS kernel only boots with Secure Boot on once its key is enrolled.

More: Secure Boot.

Drivers: prebuilt and signed, nothing compiled on your PC

Out-of-tree kernel drivers used to be built during the image build, or on your own machine with akmods or DKMS. Now RakuOS builds them in CI, signs them with the RakuOS key, checks the signatures and publishes them as rakuos-kmod-* packages for every RakuOS kernel: each CPU level (v2, v3, v4), stable and staging, and the Steam Deck kernel used by the gamescope image (the -deck packages).

Every image ships these:

  • Broadcom Wi-Fi (wl)
  • v4l2loopback (virtual cameras, for example for OBS)
  • Xbox controllers: xone, xpadneo, xpad-noone
  • Racing wheels: hid-fanatecff (Fanatec), hid-tmff2 and t150-driver (Thrustmaster), new-lg4ff and logitech-trueforce (Logitech)
  • AYANEO LEDs (ayaneo-leds)
  • xtables-addons
  • Intel IPU6 and Intel Vision cameras
  • sc0710 capture cards
  • Sensors: nct6687d, ryzen_smu, zenergy

An image build now fails if any of these doesn't match the image's kernel, so an image can't ship with a driver built for an older kernel.

NVIDIA: use an NVIDIA image. RakuOS System › System lets you switch between Standard, Nvidia (the current driver) and Nvidia Legacy (the 580xx driver, the last one for Maxwell, Pascal and Volta GPUs). Each comes with its signed driver built in. Please don't use rakuos setup-nvidia or RPM Fusion's akmod-nvidia: they build the driver on your machine, and that driver won't load any more.

Opt-in drivers. Three drivers are built but not included in the images:

  • VirtualBox, because it pulls in VirtualBox itself. Turn on RPM Fusion (see below), then install it together with the signed module:

    sudo rum install VirtualBox rakuos-kmod-VirtualBox

  • OpenRazer, because its driver misbehaved with Razer's RGB hub. If you have Razer gear and want it, turn on Terra, then:

    sudo rum install rakuos-kmod-openrazer

  • MediaTek MT7927 Wi-Fi, because it caused problems with a MediaTek USB Wi-Fi adapter. If your MT7927 card needs it:

    sudo rum install rakuos-kmod-mediatek-mt7927

On staging the packages end in -staging (rakuos-kmod-VirtualBox-staging, rakuos-kmod-openrazer-staging); rpm -qa 'rakuos-kmod-*' shows which names your system uses. Reboot afterwards.

If you installed akmod-* or dkms-* packages yourself: they build unsigned drivers that the kernel now refuses. Remove them (sudo rum remove akmod-<name>); for every driver listed above, the RakuOS package already does the job. If you need a driver we don't build yet, ask on Discord or at rakuos.org/bugs and we'll add it.

More: Drivers.

Easy Anti-Cheat Linux v2

EAC Linux v2 only runs on a system with a locked-down, verifiable boot chain. RakuOS now checks those requirements for you:

sudo rakuos eac-check

It tests nine things: Secure Boot is on, every enrolled key is a well-known one, no unsigned module is loaded and signatures are enforced, a TPM 2.0 is present, measured boot is working, the IOMMU is on without passthrough, kernel lockdown is set at boot, kexec is disabled at boot, and the BPF LSM is active. Anything that fails comes with a "Fix:" line.

The same check is the Anti-Cheat button in RakuOS System › System. Click it for the details of each item.

Common fixes:

  • Secure Boot off: run sudo rakuos enroll-secureboot-key first, then turn on Secure Boot in the firmware settings and complete MOK Manager.
  • "Not well-known: …" keys: run sudo rakuos enroll-secureboot-key and choose Delete MOK at the next boot.
  • No TPM: enable fTPM (AMD) or PTT (Intel) in the firmware settings.
  • An unsigned module loaded: remove the akmod or DKMS package that built it.

Where things stand: on a correctly set up machine the result is yellow, not green. RakuOS meets every requirement on its side, but the RakuOS key still has to be added to Epic's list of well-known keys. We're waiting on Epic for that step, and EAC v2 games depend on it. On the Steam Deck there is one more limit: Epic doesn't support EAC Linux v2 on it yet.

More: Anti-cheat.

The boot menu and bootloader

shim and GRUB stay up to date. Until now, the shim and GRUB on your EFI system partition stayed at whatever version you installed with; on some machines that was months old. A new service, rakuos-bootloader-update, now updates them from the image at boot. It follows the same rules as Fedora's own updater: it only ever upgrades (a rollback never downgrades your bootloader), it only replaces the files it installed, and it uses Fedora's signed files unchanged. With Secure Boot on, it only updates if your firmware trusts Microsoft's 2023 UEFI certificate; if not, it skips the update and logs why. A firmware update (fwupdmgr update, or your PC maker's tool) fixes that. Check what it did with:

journalctl -b -u rakuos-bootloader-update

RakuOS rescue. The GRUB menu has a new RakuOS rescue (text console, user packages off) submenu, with an entry for each image you have installed. A rescue entry boots that image to a text login without your installed packages, without the overlay sync and without the boot splash, and leaves everything in /var/lib/rakuos as it was. It's meant for the case where a soft reset or a reinstall of your packages fails at every boot and you never reach the desktop. Pick the rescue entry, log in, back up your package list and reset:

cp /var/lib/rakuos/packages.list ~/packages.list.bak
sudo rakuos reset-overlay --confirm     # full reset: back to the image's own packages
sudo rakuos reset-overlay --soft        # or: reinstall your list, if the cause is gone

then reboot normally. On an image without the submenu you can do the same by hand: press e on the normal entry, add this to the end of the line starting with linux, and boot with Ctrl+X:

rakuos.rescue rd.systemd.mask=rakuos-overlay-mount.service systemd.mask=rakuos-overlay-sync.service systemd.unit=multi-user.target

The rescue entries are kept current automatically: after every update, at boot, and right after a rollback. More: Rescue mode.

Windows, other Linux distributions and BSD. After each update RakuOS looks for other operating systems on your disks and adds them to the GRUB menu. It uses os-prober (Windows and the like) and also scans every EFI system partition for other systems' bootloaders: other distributions' shim or GRUB, systemd-boot, FreeBSD's loader, rEFInd and so on. Other Linux distributions are started through their own bootloader, because starting their kernels directly from RakuOS's GRUB doesn't work with Secure Boot on. With Secure Boot on, a bootloader without a signature is marked "(needs Secure Boot off)". The installer does the same on a new install. If you install another system and don't want to wait for the next update:

sudo /usr/libexec/rakuos/os-entries --dry-run     # shows what it found
sudo /usr/libexec/rakuos/os-entries               # adds it now; visible at the next boot

The menu now reads, top to bottom: RakuOS (newest first), your other systems, RakuOS rescue, and UEFI Firmware Settings. More: Boot menu and dual boot.

The GRUB theme. The theme is now installed while an update is applied, so a new theme shows on the very first boot of the new image. Before, it was copied at every boot, one boot late. A GRUB password set with grub2-setpassword is no longer wiped at the next boot.

All of this works with /boot kept read-only. Each of these tools makes /boot writable only for itself, for as long as it needs it.

RPM Fusion is now off by default

RPM Fusion is now disabled by default, like Terra. Both are optional. This also applies to existing installs: after this update RPM Fusion is off, so if you use apps or packages from it (VirtualBox, certain codecs or apps), you'll need to turn it back on. Do that in the Welcome app's Third-Party Repositories page or in the Software Center's repository settings, or from a terminal:

sudo rum config-manager --set-enabled 'rpmfusion-*'
sudo rum config-manager --set-enabled terra

(--set-disabled turns them off again.) RakuOS's own drivers, NVIDIA included, don't need RPM Fusion any more. More: Repositories.

New documentation

The documentation at rakuos.org/documentation has been rewritten from the ground up and is far more complete. It's written from what the RakuOS code actually does, and covers everything in this post and more:

  • Getting Started: system requirements, making a USB stick, installing, and the first boot (including enrolling the RakuOS key)
  • Installing Software: the Software Center, rum, Flatpaks, AppImages, Distrobox, local RPM files, and repositories like RPM Fusion and Terra
  • A rum reference: how rum works, every command, its settings and its error messages
  • Updates and Images: updating, rolling back, and switching desktops, channels, CPU levels and NVIDIA drivers
  • Drivers and Secure Boot: the RakuOS key, signed drivers, NVIDIA and Nvidia Legacy, VirtualBox and OpenRazer, kernel arguments, and anti-cheat
  • Boot Menu and Recovery: dual boot, rescue mode, resetting your apps, and fixing boot problems
  • Getting Help: common problems, reporting bugs, and using AI assistants with RakuOS

Old documentation links still work and take you to the matching new page. The docs now live alongside our code, so they get updated together with it as RakuOS changes.

RakuOS documentation for AI assistants

A lot of you ask an AI assistant for help, and most of them still answer as if RakuOS were plain Fedora Workstation or Silverblue. That advice can break a RakuOS system: rpm-ostree isn't installed, dnf is rum, packages live in an overlay on /usr, and drivers must be signed. So we now publish documentation written for AI assistants, generated from our source code and updated as things change:

  • MCP server, no API key needed: https://rakuos.org/mcp. Add it to Claude, Cursor or any client that supports MCP, and the assistant can look up how RakuOS actually works before answering. In Claude Code, for example:

    claude mcp add --transport http rakuos https://rakuos.org/mcp

  • The full documentation: rakuos.org/ai (index: rakuos.org/llms.txt, everything in one file: rakuos.org/ai/llms-full.txt)

  • A short version to attach to any chat: rakuos.org/ai/rakuos-core.md

The docs tell an assistant to start with read-only checks, to say what any system-changing command does, how to undo it and whether it needs a reboot, and they list the Fedora and Silverblue advice that doesn't apply. They include troubleshooting guides for common problems, such as an update that isn't applied after a reboot, a driver that won't load, or anti-cheat not being ready. The pages are also open to AI crawlers, so over time the big AI models should learn how RakuOS really works and give better answers on their own.

More: AI assistants.

After updating

  1. Reboot.
  2. Run sudo rakuos eac-check to see where your system stands, and fix anything it flags.
  3. If you use anything from RPM Fusion, turn it back on (Welcome app or Software Center). For VirtualBox or OpenRazer, turn on the repository it needs and install the opt-in package as described above.
  4. If you installed akmod-* or dkms-* packages yourself, remove them.

If anything goes wrong, pick the previous image in the GRUB menu, or run sudo bootc rollback and reboot. Then tell us on Discord or at rakuos.org/bugs, so we can fix it. For step-by-step help with any of this, see the documentation.