8

I just came to realize that my system is not limiting the amount of processes per user properly thus not preventing a user from doing a fork-bomb and crashing the entire system:

user@thebe:~$ cat /etc/security/limits.conf | grep user
user        hard    nproc   512
user@thebe:~$ ulimit -u
1024
user@thebe:~$ :(){ :|:& };:
[1] 2559
user@thebe:~$ ht-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
...
Connection to thebe closed by remote host.

Is this a bug or why is it ignoring the limit in limits.conf and why is not applying the limit that ulimit -n claims it to be?

PS: I really don't think the memory limit is hit before the process limit. This machine has 8GB ram and it was using only 4% of it at the time when I dropped the fork bomb.

EDIT:

I managed to reproduce this on a live CD. So I guess this must be a bug. It basically ends up killing all processes, including system critical things like X11, SSHD etc.

Any user can crash the system.

3
  • -n is the number of file descriptors, not processes. You want ulimit -u
    – psusi
    Mar 23, 2012 at 22:18
  • @psusi, thanks, but that gives the same result :s user@thebe:~$ ulimit -u 1024 Mar 23, 2012 at 22:31
  • When I run ulimit -u I get 31325. When I run ulimit -u 512 it goes go 512. When I run that fork-bomb, the rest of my system is just fine.
    – psusi
    Mar 24, 2012 at 1:14

1 Answer 1

8

Turns out that /etc/security/limits.conf does work, but needs reboot before it gets interpreted. A log-out is not sufficient.

I recommend to anybody to a limit to the config file like

user hard nproc 512

Replace user with any username that you would want to limit.

Or, better:

@group hard nproc 512

Replace group with any user-group that you want to limit.

1
  • Depending on software you use, even a single-user system might need more processes than 512. If you find things mysteriously don't work after implementing this, you may need to adjust the actual number of processes you permit.
    – Zeiss Ikon
    Feb 7, 2017 at 20:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .