What this command :(){ :|: & };: does?

Question

What does this shell command do in Linux

:(){ :|: & };:

How can it be used in Denial of Service attacks?

Solution

It's a fork bomb. I actually have that written on my whiteboard (as a joke) as I speak. Don't run it.

:()         # define a function named :, () defines a function in bash
{           
    : | :;  # the pipe needs two instances of this function, which forks two shells
}
;           # end function definition
:           # run it

So, the first run makes 2 subshells, which then each runs 2 more subshells...

: is a built in command in bash. It's kind of a "null" no-op command. It used to be the comment character, before there was a comment character. Now, it's got a small use as a no-op, but really used here because it's more cryptic, you look at :() and think WTH is that?

Comments

[Julian]

cyberciti.biz/faq/understanding-bash-fork-bomb

[Keith Thompson]

: isn't an operator, it's a built-in command that does nothing. This definition defines a function called :, which hides the built-in command. Here's a clearer and equivalent version DON'T RUN THIS EITHER bomb() { bomb | bomb & ) ; bomb

[HikeMike]

Why is everyone saying to not run this? Either Mac OS X is too clever or too broken to let this cause any damage. Just a bunch of -bash: fork: Resource temporarily unavailable, then the prompt is back within a second or so.

[Rich Homolka]

@DanielBeck I (knowingly) ran this on Solaris many years ago, needed to force a logout, though I actually just rebooted (my desktop Sparc).

[Fiasco Labs]

Forking exponential user created memory leak. Depending on the OS, hilarity or disaster ensues. Mac knows users will do anything despite? ulimit set to prevent it from working?