1 Understanding the Bash Fork Bomb
2 ================================
3 :author: Aaron Ball
4 :email: nullspoon@iohq.net
5 :revdate: November 12, 2015
6
7
8
9 I suspect that most Linux users, new and old, have at some point seen the
10 stereotypical fork bomb, whether they knew what it was or not.
11
12 :(){ :|:& };:
13
14 A very cryptic statement that appears to have various forms of smiley faces in
15 it. But what does it do and how does it work?
16
17
18 == What is a fork bomb?
19
20 First, let's start by describing a fork. When a process creates another
21 process, that's called a process fork. For example, a program needs to read
22 data from two log files at the same time, so the main program process forks
23 two children processes, each to read data from the log file into memory. While
24 those two processes are running, the program consistes of three running
25 processes: the parent and two children.
26
27 To see this in action, a fun command to run is
28
29 ps -ef --forest
30
31 That command will show you a graphical representation of parent processes and
32 their children (and their children's children and so on).
33
34
35 A fork bomb is is a process that forks off children processes, each of which
36 forks off its own children processes. For example, assuming each process
37 creates two, the parent process would create two children processes, each of
38 which creates two more. The result becomes 1 -> 2 -> 4 -> 16 -> 256 -> 65536.
39
40 The key concept that makes a fork bomb work [so deviously] is that the parent
41 process of any child processes won't exit until the children exit. In the case
42 of a fork bomb, the task of a child process is to create more children
43 processes, thus they never exit because there is no terminus for process
44 creation.
45
46 To summarize, a fork bomb could fill up a system's process table very fast. In
47 the example where we created 2 new children for each process, it took 6 steps
48 before we hit 65536 processes, which would crash many systems.
49
50
51 == How does this fork bomb work?
52
53
54 To better understand the stereotypical bash forkbomb, let's expand it into more
55 human-readable code. First, the original forkbomb for easy no-scroll reference.
56
57 :(){ :|:& };:
58
59 Now, let's break the function apart. In bash, there are two ways to define a
60 function
61
62 function some_name {
63 # Do stuff here
64 }
65
66 and...
67
68 some_name() {
69 }
70
71 The forkbomb mentioned at the beginning of this post uses the second function
72 syntax. As you can see, using that syntax, it creates a function called *:*.
73 Now, let's expand this into a much less compressed format now, by using the
74 first syntax, breaking it into multiple lines, and renaming the function from
75 *:* to *foo*
76
77 function foo {
78 foo|foo&
79 }
80 foo
81
82
83 Now that's much easier to understand. It's fairly clear now that this creates
84 a function called foo that calls foo, piping the output to another call of foo
85 that's backgrounded so it can continue (the &), then finishes the function
86 definition and calls foo to start things off.
87
88 As mentioned, once the function is called, it calls _foo|foo&_, which
89 basically executes foo, piping the function's output (nothing) to a new
90 instance of the foo function, and backgrounding that process. However, within
91 the foo function, it calls foo again, which inside, has two more calls to foo,
92 etc. Effectively, it recursively creates two children functions that never
93 close because they each create two children functions that never close because
94 they each create two children functions... Get the idea?
95
96 Ironically enough, despite how impacting this function can be, it actually does
97 relatively little work except to create new instances of the function. Kind of
98 devious that a function that does no real processing can bury a system with
99 load.
100
101
102 [role="datelastedit"]
103 Last edited: {revdate}
104
105 // vim: set syntax=asciidoc:
|
