# Ujust check-anticheat Output

**URL:** <https://universal-blue.discourse.group/t/ujust-check-anticheat-output/12704>\
**Category:** Bazzite\
**Created:** [November 3, 2026, 11:04pm UTC](https://universal-blue.discourse.group/t/ujust-check-anticheat-output/12704 "2026-11-03T23:04:15Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dallebrinaar](https://avatars.discourse-cdn.com/v4/letter/d/c77e96/32.png) [@dallebrinaar](https://universal-blue.discourse.group/u/dallebrinaar)\
**Post date:** [November 3, 2026, 11:04pm UTC](https://universal-blue.discourse.group/t/ujust-check-anticheat-output/12704/1 "2026-11-03T23:04:15Z")

</div>

I tried out Bazzite 45’s `ujust check-anticheat` and am posting the output just for visibility. At this point in time, I don’t think I’m going to do anything about the Fails.

**`Easy Anti-Cheat Linux v2 readiness check`** ` `  
`Requirements: ``https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2`` `  
` `  
**`[PASS`**`]Signed kernel`  
` Kernel 7.2.15-ogc1.1.fc45.x86_64 is signed by 'ublue kernel'`  
**`[PASS`**`]Signed kernel modules`  
` All 117 loaded modules are signed`  
**`[PASS`**`]TPM 2.0`  
**`[PASS`**`]Secure Boot enabled`  
**`[FAIL`**`]Only well-known Machine Owner Keys`  
` Not well-known: 'grub' 'Ventoy Secure Boot Root CA'. Export them with 'mokutil --export', then remove each with 'sudo mokutil --dele`  
`te MOK-000N.der' `  
**`[PASS`**`]Measured boot`  
` The boot manager recorded its measurements`  
**`[PASS`**`]IOMMU enabled, passthrough disabled`  
**`[FAIL`**`]Kernel lockdown integrity mode`  
` Lockdown mode is 'none'. Run 'rpm-ostree kargs --append-if-missing=lockdown=integrity'`  
**`[FAIL`**`]Kexec disabled`  
` Run 'rpm-ostree kargs --append-if-missing=sysctl.kernel.kexec_load_disabled=1'`  
**`[PASS`**`]BPF LSM active`  
` `  
**`3 of 10 checks failed`** `.Fix the items above, then reboot and run this again.`  
`Kernel argument changes take effect after a reboot.`

EDIT: I’ve done a bit of research on the Fails, above. The first one: `Only well-known Machine Owner Keys Not well-known: 'grub' 'Ventoy Secure Boot Root CA'`seems odd. The MOK for grub is not well-known? Wouldn’t deleting its key keep the system from booting?

The other two Fails look like they’d be good things to implement: `lockdown=integrity` and `sysctl.kernel.kexec_load_disabled=1`. I’m not knowledgeable about this to speak reasonably, but is there some reason those aren’t the standard settings?