Download Little Snitch for Linux

We offer packages for the three major 64-bit CPU architectures found in desktop and laptop computers today. For each architecture, we provide .deb (Debian, Ubuntu, Mint, Kali, …), .rpm (Fedora, RHEL, openSUSE, CentOS, …) and .pkg.tar.zst (Arch, Manjaro, CachyOS, EndeavourOS, …). Choose the right combination from the list below.

Minimum system requirements

Kernel version

Little Snitch for Linux requires Linux kernel 6.12 or newer, built with BTF support. In practice this means Debian 13, Ubuntu 25.04, Mint 22, Fedora 40, RHEL 10, or any current rolling-release distribution such as Arch or Manjaro. If you're unsure which kernel you're running, uname -r will tell you.

The 6.12 requirement exists because that release significantly improved the eBPF verifier's ability to follow program logic, which reduces the number of code paths it needs to analyze. There is some hope that a future refactor of the eBPF code could bring compatibility down to kernel 5.17, but that hasn't happened yet.

BTF support

BTF is what makes CO-RE (Compile Once – Run Everywhere) possible. This mechanism lets Little Snitch run across different kernel versions without needing to be recompiled for each one, the way a traditional loadable kernel module would. It works by reading kernel-provided metadata from /sys/kernel/btf/, which describes the data structures and function addresses of the running kernel.

All major distributions enable BTF by default, and its presence is easy to verify: if /sys/kernel/btf/ exists, you're good. The exception is kernels built for embedded systems or low-memory hardware, which sometimes omit BTF to save space. Those kernels are incompatible with Little Snitch regardless of their version number.

Verifying download integrity

To check the integrity of downloaded packages, download the following two files and follow the instructions in the .hashes.txt file.