1

i was working on writing a wrapper script for a tool. the wrapper script should prepare the environment and then call the tool in background then exit. it looks something like this:

#!/bin/bash
export FOO=1
tool "$@" &

nothing spectacular here. except i erroneously did not call the tool (/usr/bin/tool) and instead effectively called the wrapper script itself (~/bin/tool). unknowingly i ran the wrapper script and nothing happened. at least nothing visible.

i wondered why nothing happened. open the script again. see the error (not calling /usr/bin/tool). fix it to run the actual tool and saved. suddenly the tool popped up. after some pondering i recognized that the wrapper script was running itself in background over and over again. and when i edited the script to call the actual tool the next invocation of the script immediately called the tool and stopped the chain.

since it does not fork it is no fork bomb. but it seems to be a recursive ghost. i recreated the silent recursive wrapper and tried to detect. my knowledge is limited. i am no guru. i tried tools like ps and pgrep. i gave the script a catchy name to pgrep. but pgrep sees nothing most of the time. running pgrep in a loop will sometimes catch the runaway script. about once every ten seconds? i did not do statistics.

the recursive ghost script is benign. barely eats any resources. perhaps the only sort of visible effect is that it causes the PID to raise quickly. because every new invocation gets a new PID.

how to detect and stop a runaway recursive ghost scripts which call itself in background and exits?

here is how to reproduce:

  1. create script called woop with following content

     #!/bin/sh
 ./woop &

  2. open two terminals and have the script open in a text editor

  3. in one terminal run ./woop. notice nothing visible happens. it will return to prompt immediately.

  4. in second terminal run while true; do pgrep -fa woop; done. see one result every ten seconds or so.

  5. in text editor change line ./woop & to ./woops & or something and save. notice error in first terminal (./woop: line 2: ./woops: No such file or directory)

  6. notice in second terminal does not find any result anymore.

Improve this question
0

1 Answer 1

Reset to default
1

Using forkstat if available should give a good indication if any process is running amok. E.g:

forkstat -e fork

When identified do either or all of:

  • chmod -x /path/to/file
  • mv ...
  • rm ...

Optionally use the -S flag (here simplified stats):

$ forkstat -S
... loads of lines
^C
 Fork     Exec     Exit  ...   Total Process
11546    11532    11547  ...   34625 /bin/bash - ./woop
...

Related:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .