Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Got introduced to the fascinating world of UNIX about a year ago, but after, for lack of a better expression, "the waste-matter colliding with the rapidly spinning blades" today as a result of my tinkering; I decided it may be time to get a bit of advice from the professionals.

I was just wondering what my options were for protecting a computer running OS X 10.6 from fork-bombs. I ask this because (being the complete tit that I am) I somehow assumed, that as the system wasn't vulnerable to the standard BASH fork-bomb, giving me the following when run:

"-bash: fork: Resource temporarily unavailable"

That it also wouldn't be vulnerable to a one-liner written in C. Suffice to say I ran it, everything ground to a halt and obviously there was nothing I could do (apart from reboot) because I wasn't able to start any new processes. I had a look at ulimit but it's all a bit over my head at the moment.

If I set a (lower?) process limit per user with ulimit, could I then ssh in as another user, and somehow kill the fork bomb? I'm fairly new to all this, as you can see - and thinking about it i'm not sure how I would actually kill the thing.

Anyway, I want to know how I can prevent a fork-bomb (when running the same forking C program) from happening again, I know this may be a bit overkill for a personal machine, but if I can make the system a bit less vulnerable to a user being able to cause a crash, I would like to do that. For my own peace of mind if nothing else.

To summarise (sorry for my long and disjointed rambling, it's late here and as you can probably tell - I don't post online much. I'm much more of a lurker to be honest; aka please don't eat me alive if i've posted a stupid question! :-p

  • How can I protect my Mac from a fork-bomb run from the shell? (using ulimit if that is the best way to do it)

  • If ulimit is how to do it, How do I make the ulimit change stick? It resets to default on a reboot if i'm not mistaken.

  • After doing the above two points, how would I kill a running fork-bomb called say, DO_NOT_EXECUTE that is multiplying all over the place and has filled up all of my process slots? Ideally I would like the same errors to come up as those given by the BASH f-b, when I run the C Executable and allow me to simply CTRL-C to exit, but i'll take any method I can find that allows me to recover without a reboot.

Thank you all for your patience (and any help you may be able to give me),

oms

share|improve this question
add comment

2 Answers

Take a look at sysctl to adjust the kernel's limits. For some reason, the MacOS X man page doesn't mention kern.maxprocperuid, as mentioned years ago on Mac OS X Hints.

As for getting rid of lots of processes quickly, I'd use killall.

share|improve this answer
add comment

Mac OS X … “fork: Resource temporarily unavailable”

covers this ground completely, including making the required changes persist. I would have thought you would be protected against this based on the difference between the limits shown at

$ sysctl kern.maxproc kern.maxprocperuid

of course if you were the user that launched the fork bomb, no such luck!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.