You may have seen this before: :(){ :|:&};: usually as a joke about new emoji support in Linux terminals.
If you run it you will probably see something like this:
Then your system becomes completely unusable.
Well, let's explain what is going on, by breaking it up into multiple lines.
:(){
: | : &
}
:
So, it's a function :() that contains { itself : a pipe | to itself : that runs in the background & then closes the contains } and finally calls itself ; starting the whole loop.
Is is much easier to understand if you rename the function to something other than : for instance this is the exact same thing:
fork(){
fork | fork &
}
fork
Using this updated code the one line version would be fork(){ fork | fork &}; fork
Well, it initially starts, calls itself and passes itself to itself in the background making child processes of itself, each one doing the exact same thing, making children that make children ad infinitum. Quickly making the computer or server run out of resources, and it happens very fast.
Because it can be run with absolutely no permissions other than login, and will take it down in seconds.
Good news if you run a server with systemd, It should prevent this by limiting the users to 33% of max cpu time. But, it wouldn't hurt to look at the soft and hard limits anyway.
The best protection is to limit the number of background processes a user can spawn, which by default is usually 10k. This can be check with the command ulimit -u if you would like to lower it, you can manually limit it by setting soft and hard limits with ulimit -S -u 5000. If you want a permanent solution you would need to edit the file /etc/security/limits.conf which has examples of settings you can set, but should look something like this:
@users hard nproc 5000
Thereby setting the group users hard limit to the number of processes to 5000
