Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I just came to realize that my system is not limiting the amount of processes per user properly thus not preventing a user from dring a fork-bomb and crashing the entire system:

user@thebe:~$ cat /etc/security/limits.conf | grep user
user        hard    nproc   512
user@thebe:~$ ulimit -u
1024
user@thebe:~$ :(){ :|:& };:
[1] 2559
user@thebe:~$ ht-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
-bash: fork: Cannot allocate memory
...
Connection to thebe closed by remote host.

Is this a bug or why is it ignoring the limit in limits.conf and why is not applying the limit that ulimit -n claims it to be?

PS: I really don't think the memory limit is hit before the process limit. This machine has 8GB ram and it was using only 4% of it at the time when I dropped the fork bomb.

EDIT:

I managed to reproduce this on a live CD. So I guess this must be a bug. It basically ends up killing all processes, including system critical things like X11, SSHD etc.

Any user can crash the system.

share|improve this question
    
-n is the number of file descriptors, not processes. You want ulimit -u –  psusi Mar 23 '12 at 22:18
    
@psusi, thanks, but that gives the same result :s user@thebe:~$ ulimit -u 1024 –  d_inevitable Mar 23 '12 at 22:31
    
When I run ulimit -u I get 31325. When I run ulimit -u 512 it goes go 512. When I run that fork-bomb, the rest of my system is just fine. –  psusi Mar 24 '12 at 1:14
add comment

1 Answer

up vote 6 down vote accepted

Turns out that /etc/security/limits.conf does work, but needs reboot before it gets interpreted. A log-out is not sufficient.

I recommend to anybody to a limit to the config file like

user hard nproc 512

Replace user with any username that you would want to limit.

Or, better:

@group hard nproc 512

Replace group with any user-group that you want to limit.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.