Fork Bomb Analysis – Where is the fork() in ‘:(){ :|: & };:’?

linuxshellsystem-calls

Warning: Running this command in most shells will result in a broken system that will need a forced shutdown to fix

I understand the recursive function :(){ :|: & };: and what it does. But I don't know where is the fork system call. I'm not sure, but I suspect in the pipe |.

Best Answer

As a result of the pipe in x | y, a subshell is created to contain the pipeline as part of the foreground process group. This continues to create subshells (via fork()) indefinitely, thus creating a fork bomb.

$ for (( i=0; i<3; i++ )); do
>     echo "$BASHPID"
> done
16907
16907
16907
$ for (( i=0; i<3; i++ )); do
>     echo "$BASHPID" | cat
> done
17195
17197
17199

The fork does not actually occur until the code is run, however, which is the final invocation of : in your code.

To disassemble how the fork bomb works:

  • :() - define a new function called :
  • { :|: & } - a function definition that recursively pipes the calling function into another instance of the calling function in the background
  • : - call the fork bomb function

This tends to not be too memory intensive, but it will suck up PIDs and consume CPU cycles.

Related Question