Understanding the Fork Bomb :(){ :|:& };: in Linux

Nuking my system by installing Arch Linux was not enough, so I used a Fork Bomb.

Just kidding!

You might have already seen a cute looking but dangerous Linux command which is made of just special characters:

:(){ :|:& };:

This is called bash fork bomb and it is enough to bring down your system by consuming all the system resources. It goes away after a system reboot, though.

In this article, I’ll discuss:

What is a fork bomb in general
How does the :(){ :|:& };: turn into a fork bomb
Why the fork bomb is likely not to do any damage (yes, your distro might be bombproof)
Quick tip on preventing fork bombs

What is a fork bomb?

You can think of a fork bomb as a DoS (denial of service) attack, as it replicates existing processes till your system utilizes 100% of system resources and makes it completely unusable.

Unix programs are executed through a combination of two system calls called fork and exec. One process spawns another either by replacing itself when it’s done — an exec — or, if it needs to stay around, by making a copy of itself — a fork.

The fork bomb is basically the process of creating forks after forks infinitely until your system doesn’t have anymore resources left.

Well, this is what the famous fork bomb does to your system. And if you’re curious to know those 11 spooky characters, here you go:

:(){ :|:& };:

As of now, you might have no idea how it works. Well, Let me break it down for you:

:() defines the function named as : and will accept no arguments.
{} is where the function starts and ends. In simple terms, it includes commands that will crash your machine eventually.
:|: is where the recursion starts (function calling itself). To be more precise, It loads a : function in memory, pipe (|) its own output to another copy of the : function which is also loaded into system memory as well.
& will execute the whole function in the background so that no child process is killed.
; separates each child function from the chain of multiple executions.
And : runs recently created function, hence the chain reaction begins!

task manager when I ran the fork bomb in my testing.

check this answer on tweaking systemd config.

How to Prevent fork bomb?

As everything is related to processes, you just have to limit them. And the maximum processes that can run through a signed-in user can be checked through a given command:

ulimit -u

ulimit -S -u 5000

sudo nano /etc/security/limits.conf

For example, I want to apply this to all users who are in wheel group, so I’d be adding the following lines at the end of the config file:

@wheel           hard    nproc           5000

Whereas for any specific user (sagar in my case) it would be this:

sagar           hard    nproc           5000

fork bomb was created by open source software developer Jaromil. He thinks it is a work of art.

I kind of agree with Jaromil. It is indeed a work of art. Just 11 special characters and you get yourself a nasty program that has the capability to bring down a system.

I guess you have a better understanding of the fork bomb now. Let me know if you have questions or suggestions.