72

I heard someone talking about a fork bomb, I did some research and found some dreadful information about some strange looking characters people can have you type at the command line and as a result do bad things on the computer. I certainly would not issue commands I do not understand but one never knows what can happen.

I heard that some OS allows the administrator to place some limit on user processes to mitigate the effects of fork bombs, is this protection in Ubuntu by default or would a person with sudo privilege have to set this? If so, how?

73

You can easily limit the amount of processes that can be spawned in Ubuntu and most other Linux distributions by modifying /etc/security/limits.conf

sudoedit /etc/security/limits.conf

Then add this line to the bottom of that file:

*    hard     nproc     nnn

where:

  • hard sets the limit at the kernel level so that it cannot be changed without rebooting.
  • nproc is the maximum number of processes per user.
  • nnn is a number that you should calculate for your system by:

    ps aux -L | cut --delimiter=" " --fields=1 | sort | uniq --count | sort --numeric-sort | tail --lines=1
    

The above command will list all processes for all users including threads, sum them up and list the user name with the largest amount of processes. To be on the safe side, open as many applications as you normally need before running the above command and then double that number for safety.

After this limit is put into place, you'll need to reboot, but it will affect each non-root user on the system. So if a fork bomb is executed by any non-root user it'll have that hard limit.

Group and wildcard limits do not apply to the root user by default. Use the literal username root in the rules if you want to apply a rule to the superuser.

Also, if you're not looking to restart any time soon, you can use sudo ulimit -u 800 which will place the restriction only on the running session but can be easily circumvented by a fork bomb with sudo privileges!

After restart, whatever is in /etc/security/limits.conf will then be used.

Some additional information about fork bombs: They aren't malware or anything dreadful. They typically consist of something as basic as a script that calls itself twice - thereby growing its presence on the machine exponentially. Even though they have a small memory footprint given the rapid pace they multiple they quickly fill all available RAM and the machine freezes or reboots. The only danger is loosing unsaved information. I would classify a forkbomb much more as a prank than malicious software.

An important reminder:

You should rarely ever execute anything in command line when you aren't 98% certain of its action. If you can't read the commands you're executing - don't do it. This applies double to unreadable chunks of hex/base64 characters, which can be used to obscure all sorts of nastiness. If you're uncertain of a command you can always search for it's actions in the Ubuntu Manpages and be extra cautions when using sudo since that will execute as the root user.

  • @MarcoCeppi: your number wasn't far off for a typical Unity user: the output to the calculation is currently 404 for my system... – Fabby Mar 12 '16 at 2:16
  • 1
    If I, say, put something like alias ":(){ :|: & };:"="echo 'No.'" in my .bashrc - will it execute every login? – UniversallyUniqueID Apr 18 '16 at 16:15
  • Is there a disadvantage to picking a higher nproc limit? It seems like there's not much room with a limit at or even double the current # of processes, would a limit much higher, even 10,000 or more, still be effective against a fork bomb? About how much ram does each fork/process consume? Maybe there's a more universal RAM-derived limit? – Xen2050 Mar 10 '17 at 7:54
1

A simple way I like is to create an alias though alias' aren't always applied, check the answer above.

alias :="echo No."

Now

$ :(){ :|: & };:
bash: syntax error near unexpected token `('
  • 22
    surely, this is a common solution; how does this stop a(){ a|a & };a? (or any other function name?) – cat Jan 2 '16 at 3:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.