Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 41 down vote favorite
16

I heard someone talking about a fork bomb, I did some research and found some dreadful information about some strange looking characters people can have you type at the command line and as a result do bad things on the computer. I certainly would not issue commands I do not understand but one never knows what can happen.

I heard that some OS allows the administrator to place some limit on user processes to mitigate the effects of fork bombs, is this protection in Ubuntu by default or would a person with sudo privilege have to set this? If so, how?

share|improve this question

2 Answers

up vote 45 down vote accepted

You can easily limit the amount of processes that can be spawned in Ubuntu and most other Linux distributions by modifying /etc/security/limits.conf

sudoedit /etc/security/limits.conf

Then add this line to the bottom of that file

*    hard     nproc     800

You can raise this to whatever number you want - nproc is simply the maximum number of processes that can exist simultaneously on the machine. On my Lucid laptop running standard things: Gwibber, email client, web browser, chat I have about 200 processes running simultaneously - so you may need to adjust the number to your needs.

After this limit is put into place, you'll need to reboot, but it will affect each account on the system. So if a fork bomb is executed as any user (root included) it'll have that hard limit.

If you're not looking to restart anytime soon, you can use sudo ulimit -u 800 which will place the restriction only on the current running session. After restart, whatever is in /etc/security/limits.conf will be used (until ulimit is run again).

Some additional information about fork bombs. They aren't malware or anything dreadful. They typically consist of something as basic as a script that calls itself twice - thereby growing its presence on the machine exponentially. Even though they have a small memory footprint given the rapid pace they multiple they quickly fill all available RAM and the machine reboots. The only danger is loosing unsaved information. I would classify a forkbomb much more as a prank than malicious.

An important reminder:

You should rarely ever execute anything in commandline when you aren't 98% certain of its action. If you can't read the commands you're executing - don't do it. This applies double to unreadable chunks of hex/base64 characters, which can be used to obscure all sorts of nastiness. If you're uncertain of a command you can always search for it's actions in the Ubuntu Manpages and be extra cautions when using sudo since that will execute as the root user.

share|improve this answer
I hardly need to reboot a linux system. A look at the /proc part of the system yields many limit-files, find /proc/ -name "*limit*" 2>/dev/null shows such files for every process, and i.E.: cat /proc/31750/limit displays, for example: Max processes unlimited unlimited processes . So maybe, it is sufficient to modify the parent process with sudo, and relogin? – user unknown Feb 2 '11 at 6:53
@userunknown That won't work. If you're looking for a way to affect the current running session you can type ulimit -u 800 which would place the limit on all the current and future running processes until you restart. – Marco Ceppi♦ Feb 2 '11 at 12:25
2  
+1 for the warning at the end. – jrg♦ Feb 2 '11 at 12:39
4  
While the warning is definitely useful, it's often difficult to fully heed it. If inexperienced people ask for advice regarding certain problems, the command line often comes into play. Seeing the way some commands look like a cat walked over a keyboard, especially when regex or sed are involved, it's difficult even for experienced users to fully grasp what a command does, especially so because it's the solution to a problem they had to ask other people about in the first place. – Christoph Jun 23 '11 at 16:42
up vote -11 down vote

Well, with sudo privileges you can practically do anything; so the protection would be to double check whatever you are executing under sudo and try to do most commands under a normal user profile.

For example, you should NEVER run sudo rm -rf / (It will delete everything in your hard drive)

share|improve this answer
"It will delete everything..." - In theory yes...but would the "remove" process not halt at one point because it would be trying to delete some file that was locked for being in use? – Mussnoon Jan 27 '11 at 16:04
9  
No. Unix kernels do not automatically prevent access to files because some other process has them open - that is a silly Windowsism. – psusi Jan 27 '11 at 20:51
1  
@Mussnoon: The POSIX rm man page says, "If this fails for any reason, rm shall write a diagnostic message to standard error, do nothing more with the current file, and go on to any remaining files." It also says the -f option means "Do not prompt for confirmation.…" Ubuntu's main rm man page isn't nearly as specific, but I betcha Ubuntu's rm behaves as described in the POSIX manpage. – Firefeather Jan 27 '11 at 22:30
16  
Of course you don't need root rights to crash your system with a fork bomb, so this answer doesn't really apply to the specific question. – sepp2k Jan 28 '11 at 0:03
6  
--preserve-root is the default since at least 5-6 years ago in coreutils, so sudo rm -rf / will not delete root. – Chan-Ho Suh Jul 4 '12 at 22:25
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.