41

I looked at this page and can't understand how this works.

This command "exponentially spawns subprocesses until your box locks up".

But why? What I understand less are the colons.

user@host$ :(){ :|:& };:

4
  • I'm sure this is an exact duplicate, but I can't find the original question right now. Feb 5, 2009 at 13:46
  • I've had varying effects when trying this. Depending (I believe) on the configured upper limit for the number of processes and the CPU power, it caused barely a bump on some systems while completely freezing others. Feb 5, 2009 at 13:47
  • @SpoonMeiser perhaps this is it?: askubuntu.com/questions/159491/…
    – tox123
    Aug 5, 2016 at 15:39
  • explainshell.com/…
    – Tom M
    Sep 20, 2018 at 8:16

4 Answers 4

84
:(){ :|:& };:

..defines a function named :, which spawns itself (twice, one pipes into the other), and backgrounds itself.

With line breaks:

:()
{
    :|:&
};
:

Renaming the : function to forkbomb:

forkbomb()
{
    forkbomb | forkbomb &
};
forkbomb

You can prevent such attacks by using ulimit to limit the number of processes-per-user:

$ ulimit -u 50
$ :(){ :|:& };:
-bash: fork: Resource temporarily unavailable
$

More permanently, you can use /etc/security/limits.conf (on Debian and others, at least), for example:

* hard nproc 50

Of course that means you can only run 50 processes, you may want to increase this depending on what the machine is doing!

5
  • 12
    Upvoted - giving the : function a clearer name is exactly how I would have unobfuscated the code.
    – slim
    Feb 9, 2009 at 10:44
  • 1
    Why the pipe |? Golfing (&& could be used?) or is there a function? Aug 21, 2014 at 20:01
  • 3
    @CiroSantilli: && runs the commands sequentially. | runs both simultaneously, with standard file handles redirected to a pipe.
    – Ben Voigt
    Aug 21, 2014 at 20:40
  • Wouldn't recursebomb have the same effect? recursebomb () { recursebomb }; recursebomb
    – mpersico
    Sep 8, 2017 at 20:49
  • 1
    @mpersico Your example is just an infinite loop, not a fork bomb.
    – Flux
    Jun 21, 2019 at 9:16
67

That defines a function called : which calls itself twice (Code: : | :). It does that in the background (&). After the ; the function definition is done and the function : gets started.

So every instance of : starts two new : and so on... Like a binary tree of processes...

Written in plain C that is:

fork();
fork();
1
  • 2
    Closer C version: while (fork() == 0 || fork() == 0);
    – Ben Voigt
    Aug 21, 2014 at 20:38
1

Just to add to the above answers, the behavior of pipe | is to create two processes at once and connect them with pipe(pipe is implemented by the operating system itself), so when we use pipe, each parent processes spawn two other processes, which leads to utilization of system resource exponentially so that resource is used up faster.

Also & is used to background the process and in this case prompts returns immediately so that the next call executes even faster.

Exponential growth
Conclusion :
|: To use system resource faster( with exponential growth)
&: background the process to get process started faster

0

This defines a function called : (:()). Inside the function ({...}), there's a :|:& which is like this:

  • : calls this : function again.
  • | signifies piping the output to a command.
  • : after | means pipe to the function :.
  • &, in this case, means run the preceding in the background.

Then there's a ; that is known as a command separator.

Finally, the : starts this "chain reaction", activating the fork bomb.

The C equivalent would be:

#include <sys/types.h>
#include <unistd.h>
int main()
{
    fork();
    fork();
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.