What's the best way to clean up after a fork bomb?

Posted by raldi on Server Fault See other posts from Server Fault or by raldi
Published on 2008-10-07T22:19:02Z Indexed on 2010/06/06 8:12 UTC
Read the original article Hit count: 342

Filed under:

unix

|

fork

$ ls
bash: no more processes

Uh oh. Looks like someone made a fork bomb. Where I used to work, this pretty much meant that the shared server would need to be power-cycled, since even the sysadmins with root often couldn't get the problem cleaned up. Often, they couldn't even get a prompt.

I've heard a few tricks (notably, to send STOP signals rather than KILL signals, since the latter would allow the remaining threads to immediately replace the killed ones), but I've never seen a comprehensive guide entitled So, You Have Yourself a Fork Bomb?

Let's make one.

© Server Fault or respective owner

Related posts about unix

polkit: disable all users except those in group wheel?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Is it possible to do the following using 1 polkit .pkla file? Disable all users except those in the wheel group from using polkit. The users in the wheel group will need to provide the root password when using polkit. /etc/polkit-1/localauthority/50-local.d/wheel-only.pkla [disable all users… >>> More
How to find other end of unix socket connection?

as seen on Server Fault - Search for 'Server Fault'
I have a process (dbus-daemon) which has many open connection over UNIX sockets. One of these connections is fd #36: =$ ps uw -p 23284 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND depesz 23284 0.0 0.0 24680 1772 ? Ss 15:25 0:00 /bin/dbus-daemon --fork… >>> More
Meaning of directories on Unix and Unix like systems

as seen on Server Fault - Search for 'Server Fault'
I've been using Linux for a couple of years now but I still haven't figured out what the origin or meaning of some the directory names are on Unix and Unix like systems. E.g. what does etc stand for or var? Where does the opt name come from? And while we're on the topic anyway. Can someone give a… >>> More
Easy understanding of UNIX and UNIX shell scripting!!

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi All, I am beginner to UNIX,UNIX Shell Scripting. Can you please guide me through any excellent sites for unix(which are easy to understand),some study materials(tutorials),video tutorials. Please help!! Thanks! >>> More
Is Mac OS X a licensed Unix or Unix-like clone that conforms to Unix specification?

as seen on Super User - Search for 'Super User'
Is Mac OS X developed on a licensed Unix or is it a Unix-like clone that, unlike Linux, conforms to Unix specification well enough to be registered as a Unix OS. Not until Leopard, Mac OS X did not gain the Unix certification. But in Leopard, Terminal still print: GNU bash, version 3.2.48(1)-release… >>> More

Related posts about fork

fork() within a fork()

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi Is there any way to differentiate the child processes created by different fork() functions within a program. global variable i; SIGCHLD handler function() { i--; } handle() { fork() --> FORK2 } main() { while(1) { if(i<5) { i++; if( (fpid=fork())==0)… >>> More
Fork bomb protection not working : Amount of processes not limited

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I just came to realize that my system is not limiting the amount of processes per user properly thus not preventing a user from dring a fork-bomb and crashing the entire system: user@thebe:~$ cat /etc/security/limits.conf | grep user user hard nproc 512 user@thebe:~$ ulimit -u 1024 user@thebe:~$… >>> More
fork() in perl on windows

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm using fork() on PERL in windows (activeperl) for a basic socket server, but apparently there are problems (it won't accept connections after a few times), is there any workaround? while($client = $bind->accept()) { $client->autoflush(); if(fork()){ $client->close(); } else… >>> More
Behavior of a pipe after a fork()

as seen on Stack Overflow - Search for 'Stack Overflow'
When reading about pipes in Advanced Programming in the UNIX Environment, I noticed that after a fork that the parent can close() the read end of a pipe and it doesn't close the read end for the child. When a process forks, does its file descriptors get retained? What I mean by this is that before… >>> More
How does fork() return for child process

as seen on Stack Overflow - Search for 'Stack Overflow'
I know that fork() returns differently for the son and father processes, but I'm unable to find information on how this happens. How does the son process receive the return value 0 from fork? And what is the difference in regards to the call stack? As I understand it, for the father it goes something… >>> More