修复 macOS 上内核更新后启动即被 SIGKILL 的问题（原地覆写可执行文件导致） - #233
Open
dont-see-big-shark wants to merge 2 commits into
Open
dont-see-big-shark wants to merge 2 commits into
dont-see-big-shark wants to merge 2 commits into
Conversation
问题现象：macOS 上 CPA 内核启动后立即退出，错误信息为 "CPA 内核启动后立即退出: signal: 9 (SIGKILL)"（见 router-for-me#224）。 根因：macOS 内核会按文件（vnode/inode）缓存代码签名校验结果。 内核更新流程 overlay_directory 对已存在的二进制直接 fs::copy 原地覆写，导致同一 inode 的缓存签名失效；此后对该文件的每一次 exec 都会在 main() 之前被内核以 SIGKILL 杀死。字节完全相同的 副本（新 inode）可以正常执行，只有被原地覆写过的那个文件被杀， 且在本次开机会话内无法自愈。 修复： - overlay_directory 改为 copy_file_replace：先写入同目录临时 文件再原子 rename 替换目标文件，更新后的内核始终是全新 inode， 不再触发签名失效； - start_core_process_inner 检测到子进程被 SIGKILL 立即退出时， 自动用同样的"临时副本 + rename"方式重物化内核二进制并重试一次， 已中毒的旧安装无需重装即可自愈；仍失败时提示重新安装内核； - 内核 stderr 改为写入 logs/core-start-output.log（此前为 Stdio::null 丢弃），"exit code: 0" 这类静默退出可以据此排查； - 新增回归测试，用 inode 断言确保更新不会原地覆写可执行文件。 验证：cargo check 通过；tests::core_runtime 26/26 通过； 新增 3 个测试通过；在 macOS 26 实机复现并验证修复后内核可正常 启动并监听管理端口。
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8d4a7f003b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Collaborator
|
感谢您的贡献，为了保持git commit消息的一致，请使用英文提交commit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
关联 Issue
Fixes #224（内核启动后立即退出：
signal: 9 (SIGKILL)/exit code: 0）问题现象
macOS 上 CPA 内核启动后立即退出，GUI 报错：
CPA 内核启动后立即退出: signal: 9 (SIGKILL)CPA 内核启动后立即退出: exit code: 0的变体根因分析
macOS 内核会按文件（vnode/inode）缓存代码签名校验结果：
overlay_directory对已存在的二进制直接fs::copy原地覆写（同一 inode，内容被改写）；main()之前被内核直接 SIGKILL；实测复现（macOS 26）：
cp出的字节相同副本：正常启动；而
exit code: 0变体的成因是 GUI 启动内核时stdout/stderr均为Stdio::null()，内核启动后正常打印日志并干净退出时（例如配置目录类错误），用户只能看到空白的 "exit code: 0"，无从排查。修复内容
copy_file_replace，overlay_directory对文件改为「写入同目录临时文件 +fs::rename原子替换」。更新后的内核二进制始终是全新 inode，不会再触发签名失效缓存；start_core_process_inner检测到子进程被 SIGKILL 立即退出时（macOS），自动用同样的「临时副本 + rename」重物化内核二进制并重试一次。已中毒的旧安装无需重装内核即可自愈；重试仍失败时，错误信息提示重新安装内核；logs/core-start-output.log（位于内核安装目录上一级），exit code: 0这类静默退出可据此看到内核的真实输出；打开失败时自动回退Stdio::null()，不影响启动；copy_file_replace_*与overlay_directory_replaces_existing_binary_with_fresh_inode，使用 inode 断言确保更新流程永不原地覆写可执行文件。测试情况
cargo check --tests通过；cargo test --bin cpa-gui -- tests::core_runtime：26/26 通过（含新增 3 个）；对受影响用户的临时解决办法（在未合入本 PR 前退出）
删除整个
cpa-core目录后，在 GUI 内重新下载/安装内核（目录不存在时安装走fs::rename整目录替换，新 inode，可正常启动）：注意：仅在 GUI 内反复重试无效，因为更新流程会再次原地覆写同一 inode。