The fork() System Call

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

/*
 * ANALYSIS ONLY - DO NOT RUN
 * 
 * The Infamous Bash Fork Bomb:
 * :(){ :|:& };:
 * 
 * Let's decode this line by line:
 */
 
:()          /* Define a function named ':' (colon is a valid function name) */
{            /* Function body starts */
    :        /* Call the function recursively */
    |        /* Pipe output to... */
    :        /* Another recursive call */
    &        /* Run the pipeline in background */
}            /* Function body ends */
;            /* Statement separator */
:            /* Call the function to start the bomb */
 
/*
 * More readable equivalent:
 *
 * bomb() {
 *     bomb | bomb &
 * }
 * bomb
 *
 * What happens:
 * 1. bomb() is called
 * 2. It forks to create "bomb | bomb" pipeline
 * 3. The pipeline runs in background (&)
 * 4. Each bomb in the pipeline calls bomb() again
 * 5. Exponential growth: 1 → 2 → 4 → 8 → 16 → 32 → ...
 * 
 * Time to exhaust system: seconds on unprotected system
 */

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

/*
 * C Fork Bomb - ANALYSIS ONLY - DO NOT COMPILE OR RUN
 * 
 * This is shown purely to understand the mechanics.
 */
 
#include <unistd.h>
 
int main() {
    /*
     * The infinite loop + fork creates exponential processes:
     * 
     * Iteration 1: 1 process forks → 2 processes
     * Iteration 2: 2 processes fork → 4 processes
     * Iteration 3: 4 processes fork → 8 processes
     * ...
     * Iteration 20: 2^19 processes → 2^20 = 1,048,576 processes
     * 
     * Most systems can't handle more than ~32,000 processes total.
     * A fork bomb reaches this in ~15 iterations (~milliseconds).
     */
    while (1) {
        fork();
    }
    
    return 0;  /* Never reached */
}
 
/*
 * Growth analysis:
 * 
 * Time (ms)   Processes   Effect
 * 0           1           Started
 * 1           2           First fork
 * 2           4           Doubling
 * 5           32          Still manageable
 * 10          1,024       System starting to strain
 * 15          32,768      Process table nearly full
 * 16          65,536      System unresponsive
 * 
 * Total time to denial-of-service: ~20 milliseconds
 * Far too fast for human intervention.
 */

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

Timeline of an Unprotected System Under Fork Bomb Attack:
=========================================================
 
T+0ms:     Fork bomb started (1 process)
T+1ms:     2 processes
T+5ms:     32 processes
T+10ms:    1,024 processes - System slowing noticeably
T+15ms:    32,768 processes - Very slow, swap thrashing 
T+17ms:    Process limit reached - fork() starts failing
T+18ms:    Existing processes fill remaining slots immediately
T+20ms:    System completely unresponsive
           - No new SSH connections possible
           - Existing shells cannot run commands
           - Even root cannot intervene
T+varies:  OOM killer activates (if memory exhausted)
           - May kill some bomb processes
           - But survivors immediately refill slots
           - Cat-and-mouse continues
 
Recovery:
- Reboot is often the only option on unprotected systems
- May require physical access or out-of-band management (IPMI/iLO)
- Data loss possible if filesystems not synced

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

Process Table Before Attack:
┌─────────────────────────────────────────────────────────────┐
│ PID    State     User       Command                        │
├─────────────────────────────────────────────────────────────┤
│ 1      Running   root       /sbin/init                      │
│ 2      Sleeping  root       [kthreadd]                      │
│ ...    ...       ...        [kernel threads]                │
│ 1055   Running   root       /usr/sbin/sshd                  │
│ 2101   Running   user       /bin/bash                       │
│ 2150   Running   user       vim document.txt                │
│                                                             │
│ Used: 150/32768   Free slots: 32618                         │
└─────────────────────────────────────────────────────────────┘
 
Process Table During Attack (T+15ms):
┌─────────────────────────────────────────────────────────────┐
│ PID    State     User       Command                        │
├─────────────────────────────────────────────────────────────┤
│ 1      Running   root       /sbin/init                      │
│ 1055   Running   root       /usr/sbin/sshd                  │
│ 2101   Running   user       /bin/bash                       │
│ 2200   Running   attacker   :                               │
│ 2201   Running   attacker   :                               │
│ 2202   Running   attacker   :                               │
│ ... (32,000+ copies of ':' function)                        │
│ 34200  Running   attacker   :                               │
│                                                             │
│ Used: 32768/32768   Free slots: 0                           │
└─────────────────────────────────────────────────────────────┘
 
Every slot filled with bomb processes. No room for:
- New SSH connections
- New shells
- Even root's ps command to see what's happening

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Scheduler Performance Degradation:
 
Normal operation (100 processes):
- Context switches per second: ~1,000
- Scheduler overhead: <1% CPU
- Process selection: log₂(100) ≈ 7 operations
 
Under fork bomb (32,000 processes):
- Context switches per second: saturated
- Scheduler overhead: significant
- Process selection: log₂(32000) ≈ 15 operations
- But millions of selections per second needed
 
The scheduler itself becomes a bottleneck:
- Most CPU time spent deciding what to run
- Actual useful work approaches zero
- Timer interrupts consume remaining CPU
- Even "priority" processes get starved

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

#!/bin/bash
# Understanding and configuring process limits
 
# View current soft limit (can be raised up to hard limit)
ulimit -u
# Example output: 15000
 
# View current hard limit (maximum, set by root or pam)
ulimit -Hu
# Example output: 30000
 
# View all limits
ulimit -a
# core file size          (blocks, -c) unlimited
# data seg size           (kbytes, -d) unlimited
# max user processes              (-u) 15000    ← This is RLIMIT_NPROC
# ...
 
# Lower your own soft limit (without root)
ulimit -u 100
 
# Try to raise above hard limit (will fail without root)
ulimit -u 50000  
# bash: ulimit: max user processes: cannot modify limit: Operation not permitted
 
# As root, raise hard limit
sudo bash -c 'ulimit -Hu 50000'
 
# Check system-wide default for all users
cat /etc/security/limits.conf
# *    soft    nproc    15000
# *    hard    nproc    30000

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

File: /etc/security/limits.conf
================================
 
# Syntax: <domain> <type> <item> <value>
#
# domain: username, @group, or * (all users)
# type: soft (default limit) or hard (maximum limit)
# item: nproc (max processes), etc.
# value: number or "unlimited"
 
# Recommended settings for fork bomb prevention:
 
# All regular users: max 500 processes
*               soft    nproc           500
*               hard    nproc           1000
 
# Allow www-data (web server) more for worker processes
www-data        soft    nproc           2000
www-data        hard    nproc           4000
 
# Database user needs more for connection handling
postgres        soft    nproc           3000
postgres        hard    nproc           5000
 
# Developers might need more
@developers     soft    nproc           1500
@developers     hard    nproc           3000
 
# Root is unlimited (but root shouldn't run untrusted code anyway)
root            soft    nproc           unlimited
root            hard    nproc           unlimited
 
# IMPORTANT: After editing, users must log out and back in.
# Existing sessions keep their old limits.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

/*
 * Safe Fork Bomb Test with ulimit Protection
 * 
 * This demonstrates how ulimit protects the system.
 * STILL RUN ONLY IN ISOLATED VM!
 */
 
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <sys/resource.h>
 
int main() {
    int process_count = 1;
    struct rlimit rl;
    
    /* Check current limit */
    getrlimit(RLIMIT_NPROC, &rl);
    printf("RLIMIT_NPROC: soft=%lu, hard=%lu\n", rl.rlim_cur, rl.rlim_max);
    
    /* Set a low limit for testing (if we have permission) */
    rl.rlim_cur = 50;
    if (setrlimit(RLIMIT_NPROC, &rl) == 0) {
        printf("Set process limit to 50 for this test\n");
    } else {
        printf("Could not lower limit: %s\n", strerror(errno));
        printf("Current limit will be used\n");
    }
    
    printf("Starting controlled fork test...\n");
    
    while (1) {
        pid_t pid = fork();
        
        if (pid == -1) {
            /* fork() failed - likely hit the limit */
            printf("fork() failed after creating %d processes\n", process_count);
            printf("Error: %s\n", strerror(errno));
            printf("\nSYSTEM PROTECTED! Fork bomb prevented.\n");
            break;
        }
        
        if (pid == 0) {
            /* Child: just wait (don't exit, to consume process slot) */
            pause();
            _exit(0);
        }
        
        /* Parent: count and continue */
        process_count++;
        
        if (process_count % 10 == 0) {
            printf("Created %d processes...\n", process_count);
        }
    }
    
    /* Clean up: kill all children */
    printf("Cleaning up child processes...\n");
    while (wait(NULL) > 0);
    
    return 0;
}
 
/*
 * Expected output (with ulimit -u 50):
 * 
 * RLIMIT_NPROC: soft=50, hard=1000
 * Starting controlled fork test...
 * Created 10 processes...
 * Created 20 processes...
 * Created 30 processes...
 * Created 40 processes...
 * fork() failed after creating 47 processes
 * Error: Resource temporarily unavailable
 * 
 * SYSTEM PROTECTED! Fork bomb prevented.
 */

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

#!/bin/bash
# cgroups v2 fork bomb prevention example
# Requires cgroups v2 (default in modern Linux)
 
# Create a cgroup for limited users
sudo mkdir -p /sys/fs/cgroup/limited_users
 
# Enable the PID controller
echo "+pids" | sudo tee /sys/fs/cgroup/limited_users/cgroup.subtree_control
 
# Create a specific user's cgroup
sudo mkdir /sys/fs/cgroup/limited_users/testuser
 
# Limit to 100 processes maximum
echo 100 | sudo tee /sys/fs/cgroup/limited_users/testuser/pids.max
 
# Move current shell into this cgroup
echo $$ | sudo tee /sys/fs/cgroup/limited_users/testuser/cgroup.procs
 
# Now THIS shell and all processes it spawns are limited to 100 total
 
# Check current count
cat /sys/fs/cgroup/limited_users/testuser/pids.current
# Output: 2 (bash and cat)
 
# If you try to fork bomb now:
# :(){ :|:& };:
# It will quickly hit the limit and stop at 100 processes
# System remains responsive!
 
# Clean up: move out of cgroup and remove
echo $$ | sudo tee /sys/fs/cgroup/cgroup.procs
sudo rmdir /sys/fs/cgroup/limited_users/testuser
sudo rmdir /sys/fs/cgroup/limited_users

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

# File: /etc/systemd/system/user-.slice.d/50-limits.conf
# This limits ALL user sessions
 
[Slice]
# Maximum number of tasks (processes + threads) per user
TasksMax=500
 
# Memory limit per user (optional)
MemoryMax=4G
 
# CPU quota (optional)
CPUQuota=100%
 
 
# For a specific user, create:
# /etc/systemd/system/user-1001.slice.d/50-limits.conf
# (where 1001 is the UID)
 
[Slice]
TasksMax=200
MemoryMax=2G
 
 
# Apply changes:
sudo systemctl daemon-reload
 
# Check current limits:
systemctl show user-1001.slice | grep Tasks
# TasksMax=200
# TasksCurrent=15

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

#!/bin/bash
# Docker fork bomb protection
 
# Run container with PID limit
docker run --pids-limit 100 -it ubuntu bash
 
# Inside container, a fork bomb will fail:
# :(){ :|:& };:
# bash: fork: retry: Resource temporarily unavailable
# (after hitting 100 processes)
 
# Without --pids-limit:
docker run -it ubuntu bash
# Fork bomb would work! Container could DoS host!
 
# Default PID limit in Docker daemon config
# /etc/docker/daemon.json:
# {
#   "default-pids-limit": 100
# }
 
# Check container's current PID usage
docker stats --no-stream --format "{{.Name}}: {{.PIDs}} processes"
 
# Combine with other limits for defense in depth
docker run \
  --pids-limit 100 \
  --memory 512m \
  --cpus 0.5 \
  -it ubuntu bash

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

# Kubernetes Pod with PID limits
apiVersion: v1
kind: Pod
metadata:
  name: limited-pod
spec:
  containers:
  - name: app
    image: myapp:latest
    resources:
      limits:
        # These require PID limit feature (alpha/beta in some versions)
        # May also be configured cluster-wide via kubelet
      requests:
        cpu: "100m"
        memory: "128Mi"
 
# Kubelet configuration for PID limits
# /var/lib/kubelet/config.yaml
# podPidsLimit: 100   # Per-pod PID limit
# 
# Or via kubelet flags:
# --pod-max-pids=100
 
# For production, also set:
# --feature-gates=SupportPodPidsLimit=true

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

# Recovery Method 1: cgroups Kill (if fork bomb is in a cgroup)
# This is why running untrusted code in cgroups is essential!
echo 1 | sudo tee /sys/fs/cgroup/user.slice/user-1001.slice/cgroup.kill
 
 
# Recovery Method 2: From existing shell (race the bomb!)
# If you have a shell already open, you MIGHT be able to run this
# before all process slots are consumed:
 
# Option A: Kill by process name (if you know it)
killall -9 bash  # Or whatever the bomb process is named
 
# Option B: Kill by pattern (if bomb processes have common signature)
pgrep -f ':' | xargs kill -9  # The Bash fork bomb uses ':' as name
 
# Option C: Kill entire user's processes
pkill -9 -u attacker_username
 
# Option D: Kill everything in a cgroup (use cgexec if bomb is contained)
# systemctl kill --signal=SIGKILL user-1000.slice
 
 
# Recovery Method 3: Magic SysRq (if you have keyboard access)
# Must have been enabled: echo 1 > /proc/sys/kernel/sysrq
 
# Step 1: Enable verbose mode to see what's happening
Alt+SysRq+R   # Take keyboard from raw mode
Alt+SysRq+E   # Send SIGTERM to all processes (gentle)
 
# Wait a few seconds...
 
Alt+SysRq+I   # Send SIGKILL to all processes (forceful)
 
# If still stuck:
Alt+SysRq+S   # Sync filesystems
Alt+SysRq+U   # Remount filesystems read-only
Alt+SysRq+B   # Reboot immediately
 
# Mnemonic: "REISUB" ("busier" backwards) = safe reboot sequence
 
 
# Recovery Method 4: Out-of-band management (IPMI)
ipmitool -I lanplus -H server-bmc -U admin -P password chassis power reset
 
 
# Recovery Method 5: Hard reboot
# Push power button, hold 5 seconds
# Or: yank power cord (last resort!)
# DATA LOSS POSSIBLE if filesystems not synced

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

#!/bin/bash
# Fork Bomb Protection Audit Script
 
echo "=== Fork Bomb Protection Audit ==="
echo
 
# Check 1: System-wide process limit
echo "1. Max PIDs:"
cat /proc/sys/kernel/pid_max
echo "   (Should be reasonable, default 32768 is OK)"
echo
 
# Check 2: Current user process limit
echo "2. Your process limits:"
ulimit -u
echo "   (Should NOT be 'unlimited' for regular users)"
echo
 
# Check 3: limits.conf
echo "3. Checking /etc/security/limits.conf for nproc:"
grep -E "^*|^@|^[a-z]" /etc/security/limits.conf | grep nproc || echo "   No nproc limits found!"
echo
 
# Check 4: SystemD default TasksMax
echo "4. SystemD UserTasksMax:"
grep -r TasksMax /etc/systemd/system.conf /etc/systemd/user.conf 2>/dev/null || echo "   Using default"
echo
 
# Check 5: cgroups v2 PID controller
echo "5. cgroups v2 PID controller:"
cat /sys/fs/cgroup/cgroup.controllers | grep pids && echo "   PID controller available" || echo "   WARNING: PID controller not available!"
echo
 
# Check 6: Magic SysRq
echo "6. Magic SysRq:"
cat /proc/sys/kernel/sysrq
echo "   (Should be >0 for emergency recovery capability)"
echo
 
# Check 7: Docker default pids-limit
echo "7. Docker default pids-limit:"
docker info 2>/dev/null | grep -i pids || echo "   Docker not installed or not running"
echo
 
echo "=== Audit Complete ==="