5

We've all seen the "fork bomb" that will render a host non-responsive, even if executed in an unprivileged shell:

Warning: Do not execute the following shell script. Just don't.

:(){ :|:& };:

I'm also aware of cgroups, the Linux kernel-level process grouping structure that can assign "controllers" to limit memory, CPU consumption, I/O scheduling priority, etc.

Theoretically, it should be possible to use this control mechanism to allow a user to execute a fork bomb in their own shell without it bringing the host system to a crawl.

Since I'm not really aware of how a fork bomb consumes resources, I'm not sure how to use cgroups to do this.

amphetamachine
  • 5,517
  • 2
  • 35
  • 43
  • 1
    On a BSD machine (at least OpenBSD/MirBSD), this is mostly safe, except as root: ulimits are in place that prevent a user from spawning more than 128 processes. You’ll just need some help from root to kill them afterwards. – mirabilos Nov 13 '14 at 17:25
  • You might be interested in footnote #5 here: http://unix.stackexchange.com/questions/92525/can-linux-run-out-of-ram/92544#92544 – goldilocks Nov 13 '14 at 17:25

1 Answers1

5

As far as I'm concerned, I think cgroups would be overkill here. However, I tend to use ulimit whenever I run something witk a fork system call in it (bad experiences made it a habit...) :

$ ulimit -u 2500
$ ./mypotentiallydeadlyprogram

This way, I put a 2500 processes limit on my current shell. Thanks to this, my fork calls will end up failing if they get too numerous, hence preventing the system from going down, and allowing me to furiously hit Ctrl + C.

On my machine, I find 2500 to be a good limit, but you might want to increase/decrease this value according to what your machine can take, and how far you want your fork bomb to go. Also remember that your machine needs to spawn things to survive, don't suffocate it. I have seen people writing this in their ~/.bashrc, therefore restricting even their session's main bash. While this was very funny to the sysadmin, the user was very unhappy to freeze after login.

While ulimit can be used to set up a temporary limit, you can set something more permanent if you have root access (and want to enforce the limit on specific users). This can be done through /etc/security/limits.conf:

# <domain>      <type>      <item>      <value>
youruser        soft        nproc       2500
youruser        hard        nproc       2750

In the above setup, youruser has got a soft limit of 2500 processes (max. 2750). This file allows you to set up various kinds of limits, for various entities on your system (users, groups, ...). Have a look at its documentation if you need more information. Note however that this is system-wide configuration, which means that this limit isn't applied per-shell for youruser.

By the way, /proc/sys/kernel/pid_max will contain the maximum PID which can be granted by your kernel. Since PIDs are reusable, you may consider this really close from your maximum number of processes.

John WH Smith
  • 15,880