refactor(core): 缝合 Systemd 架构，修复 PR #25 中的管道符闪退及 oneshot 守护进程死锁漏洞

2026-06-28 04:41:41 +08:00 · 2026-04-20 16:24:32 +00:00
parent 2d680c5fc7
commit 201df489db
8 changed files with 49 additions and 146 deletions
--- a/core/install.sh
+++ b/core/install.sh
@@ -10,7 +10,7 @@
 # ==========================================================
 if [ "$EUID" -ne 0 ]; then
  echo -e "\033[31m❌ 权限被拒绝: 部署 IP-Sentinel 需要最高系统权限。\033[0m"
-  echo -e "💡 请使用 \033[36msudo bash $0\033[0m 或切换到 root 用户 (su root) 后重新执行指令。"
+  echo -e "💡 请使用 \033[36msudo bash -c \"\$(curl -fsSL ...)\"\033[0m 或切换到 root 执行。"
  exit 1
 fi

@@ -638,17 +638,19 @@ echo $(date +%s) > "${INSTALL_DIR}/core/.ua_last_update"
 # [修复竞态]: 提前写入公网 IP 缓存，彻底阻断 agent_daemon 首次启动时的抢跑推送
 echo "$SAFE_PUBLIC_IP" > "${INSTALL_DIR}/core/.last_ip"

-# 7. 配置系统定时任务 (高频调度与看门狗)
-echo -e "\n[7/7] 正在注入系统定时任务与看门狗进程..."
-if command -v systemctl >/dev/null 2>&1; then
-    echo "💡 检测到 Systemd 环境，正在部署 Systemd 服务单元..."
+# 7. 配置系统任务与原生守护进程
+echo -e "\n[7/7] 正在注入系统任务与守护进程..."
+crontab -l 2>/dev/null | grep -v "ip_sentinel" > /tmp/cron_backup || true

-    # 1. 编写 Runner 核心养护模块服务
+echo $(date +%s) > "${INSTALL_DIR}/core/.ua_last_update"
+
+if command -v systemctl >/dev/null 2>&1; then
+    echo "💡 检测到 Systemd 环境，正在部署 Systemd 调度单元..."
+    
    cat > /etc/systemd/system/ip-sentinel-runner.service << EOF
 [Unit]
 Description=IP-Sentinel Runner Service
 After=network.target
-
 [Service]
 Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 SyslogIdentifier=ip-sentinel
@@ -659,28 +661,23 @@ CPUSchedulingPolicy=idle
 IOSchedulingClass=idle
 EOF

-    # 2. 编写 Runner 定时器 (每 30 分钟): 每次运行前随机休眠 0 到 180 秒
    cat > /etc/systemd/system/ip-sentinel-runner.timer << EOF
 [Unit]
 Description=Timer for IP-Sentinel Runner Service
-
 [Timer]
 OnBootSec=10
 OnUnitActiveSec=30min
 RandomizedDelaySec=180
 Persistent=true
 Unit=ip-sentinel-runner.service
-
 [Install]
 WantedBy=timers.target
 EOF

-    # 3. 编写 Updater 养料更新模块服务
    cat > /etc/systemd/system/ip-sentinel-updater.service << EOF
 [Unit]
 Description=IP-Sentinel Updater Service
 After=network.target
-
 [Service]
 Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 SyslogIdentifier=ip-sentinel
@@ -691,35 +688,28 @@ CPUSchedulingPolicy=idle
 IOSchedulingClass=idle
 EOF

-    # 4. 编写 Updater 定时器 (每天凌晨 3 点触发)
    cat > /etc/systemd/system/ip-sentinel-updater.timer << EOF
 [Unit]
 Description=Timer for IP-Sentinel Updater Service
-
 [Timer]
 OnCalendar=*-*-* 03:00:00
 Persistent=true
 Unit=ip-sentinel-updater.service
-
 [Install]
 WantedBy=timers.target
 EOF

-    # 重载服务配置并启动服务
    systemctl daemon-reload
    systemctl enable --now ip-sentinel-runner.timer
    systemctl enable --now ip-sentinel-updater.timer
-    # 强制重载服务，兼容 OTA
    systemctl restart ip-sentinel-runner.timer ip-sentinel-updater.timer

-    # 如果配置了联控，启动 Webhook 与战报任务
    if [[ -n "$TG_TOKEN" ]] && [[ -n "$CHAT_ID" ]]; then
-        # 编写 TG 战报服务
+        echo "$SAFE_PUBLIC_IP" > "${INSTALL_DIR}/core/.last_ip"
+        
        cat > /etc/systemd/system/ip-sentinel-report.service << EOF
 [Unit]
 Description=IP-Sentinel Telegram Report Service
-After=network.target
-
 [Service]
 Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 SyslogIdentifier=ip-sentinel
@@ -730,82 +720,55 @@ CPUSchedulingPolicy=idle
 IOSchedulingClass=idle
 EOF

-        # 编写 TG 战报服务定时器 (每天早上 8 点触发)
        cat > /etc/systemd/system/ip-sentinel-report.timer << EOF
 [Unit]
-Description=Timer for IP-Sentinel Telegram Report Service
-
+Description=Timer for IP-Sentinel Telegram Report
 [Timer]
 OnCalendar=*-*-* 08:00:00
 Unit=ip-sentinel-report.service
-
 [Install]
 WantedBy=timers.target
 EOF

-        # 编写 Agent 进程守护服务
+        # ⚠️ 已修复陷阱：改为 Type=simple，去除 Timer
        cat > /etc/systemd/system/ip-sentinel-agent-daemon.service << EOF
 [Unit]
 Description=IP-Sentinel Agent Daemon Service
 After=network.target
-
 [Service]
 Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 SyslogIdentifier=ip-sentinel
-Type=oneshot
+Type=simple
 ExecStart=/bin/bash ${INSTALL_DIR}/core/agent_daemon.sh
-KillMode=process
+Restart=always
+RestartSec=10
 User=root
 CPUSchedulingPolicy=idle
 IOSchedulingClass=idle
-EOF
-
-        # 编写 Agent Daemon 定时器 (每 1 分钟)
-        cat > /etc/systemd/system/ip-sentinel-agent-daemon.timer << EOF
-[Unit]
-Description=Timer for IP-Sentinel Agent Daemon Service
-
-[Timer]
-OnBootSec=10
-OnUnitActiveSec=1min
-Unit=ip-sentinel-agent-daemon.service
-
 [Install]
-WantedBy=timers.target
+WantedBy=multi-user.target
 EOF

-        # 重载服务配置并启动服务
        systemctl daemon-reload
        systemctl enable --now ip-sentinel-report.timer
-        systemctl enable --now ip-sentinel-agent-daemon.timer
-        # 安装时立刻启动一次边缘守护进程
-        systemctl start ip-sentinel-agent-daemon.service
-        # 强制重载服务，兼容 OTA
-        systemctl restart ip-sentinel-report.timer ip-sentinel-agent-daemon.timer
+        systemctl enable --now ip-sentinel-agent-daemon.service
+        systemctl restart ip-sentinel-report.timer ip-sentinel-agent-daemon.service
    fi
+
+    [ -f /tmp/cron_backup ] && crontab /tmp/cron_backup 2>/dev/null
+    rm -f /tmp/cron_backup
 else
    echo "💡 未检测到 Systemd (可能是 Alpine Linux)，回退到 Cron 调度模式..."
-
-    crontab -l 2>/dev/null | grep -v "ip_sentinel" > /tmp/cron_backup || true
-
-    # 核心养护模块: 每 30 分钟触发一次
    echo "*/30 * * * * ${INSTALL_DIR}/core/runner.sh >/dev/null 2>&1" >> /tmp/cron_backup
-    # 养料更新模块: (v3.3.0升级) 每天凌晨 3 点触发，由中枢自动进行分频调度
    echo "0 3 * * * ${INSTALL_DIR}/core/updater.sh >/dev/null 2>&1" >> /tmp/cron_backup

-    # 如果配置了联控，启动 Webhook 与战报任务
    if [[ -n "$TG_TOKEN" ]] && [[ -n "$CHAT_ID" ]]; then
-        # 每天早上 8 点发送昨天的统计战报
+        echo "$SAFE_PUBLIC_IP" > "${INSTALL_DIR}/core/.last_ip"
        echo "0 8 * * * ${INSTALL_DIR}/core/tg_report.sh >/dev/null 2>&1" >> /tmp/cron_backup
-        
-        # 双保险守护进程看门狗
        echo "@reboot nohup bash ${INSTALL_DIR}/core/agent_daemon.sh >/dev/null 2>&1 &" >> /tmp/cron_backup
-        echo "* * * * * nohup bash ${INSTALL_DIR}/core/agent_daemon.sh >/dev/null 2>&1 &" >> /tmp/cron_backup
-        
-        # 安装时立刻启动一次边缘守护进程
+        echo "* * * * * pgrep -f agent_daemon.sh >/dev/null || nohup bash ${INSTALL_DIR}/core/agent_daemon.sh >/dev/null 2>&1 &" >> /tmp/cron_backup
        nohup bash "${INSTALL_DIR}/core/agent_daemon.sh" >/dev/null 2>&1 &
    fi
-
    [ -f /tmp/cron_backup ] && crontab /tmp/cron_backup 2>/dev/null
    rm -f /tmp/cron_backup
 fi
--- a/core/mod_google.sh
+++ b/core/mod_google.sh
@@ -22,18 +22,13 @@ if ! type log >/dev/null 2>&1; then
        # [v3.4.0 核心] 提取当前配置中的版本锚点
        local local_ver="${AGENT_VERSION:-未知}"
        
-        # 保证日志目录存在
        mkdir -p "${INSTALL_DIR}/logs"
-    
-        # 日志格式注入 [版本号] 追踪标识
        local core_msg=$(printf "[v%-5s] [%-5s] [%-7s] [%s] %s" "$local_ver" "$2" "$1" "$REGION_CODE" "$3")
        echo "[$(date '+%Y-%m-%d %H:%M:%S')] $core_msg" >> "${INSTALL_DIR}/logs/sentinel.log"
-
        # 强制推送到 Systemd Journal (如果系统支持)
        if command -v logger >/dev/null 2>&1; then
            logger -t ip-sentinel "$core_msg"
        else
-            # 降级输出到 stdout，让 Systemd 捕获
            echo "$core_msg"
        fi
    }
--- a/core/runner.sh
+++ b/core/runner.sh
@@ -31,18 +31,12 @@ log() {
    # [v3.4.0 核心] 提取当前配置中的版本锚点
    local local_ver="${AGENT_VERSION:-未知}"
    
-    # 保证日志目录存在
    mkdir -p "${INSTALL_DIR}/logs"
-    
-    # 日志格式注入 [版本号] 追踪标识
    local core_msg=$(printf "[v%-5s] [%-5s] [%-7s] [%s] %s" "$local_ver" "$level" "$module" "$REGION_CODE" "$msg")
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $core_msg" >> "$LOG_FILE"
-
-    # 强制推送到 Systemd Journal (如果系统支持)
    if command -v logger >/dev/null 2>&1; then
        logger -t ip-sentinel "$core_msg"
    else
-        # 降级输出到 stdout，让 Systemd 捕获
        echo "$core_msg"
    fi
 }
--- a/core/uninstall.sh
+++ b/core/uninstall.sh
@@ -5,12 +5,9 @@
 # 核心功能: 无痕清理守护进程、定时任务、运行目录及临时缓存
 # ==========================================================

-# ==========================================================
-# 🛑 核心权限防线: 检查是否以 root 权限运行
-# ==========================================================
 if [ "$EUID" -ne 0 ]; then
  echo -e "\033[31m❌ 权限被拒绝: 卸载 IP-Sentinel 需要最高系统权限。\033[0m"
-  echo -e "💡 请使用 \033[36msudo bash $0\033[0m 或切换到 root 用户 (su root) 后重新执行指令。"
+  echo -e "💡 请使用 \033[36msudo bash -c \"\$(curl -fsSL ...)\"\033[0m 或切换到 root 执行。"
  exit 1
 fi

@@ -19,7 +16,6 @@ INSTALL_DIR="/opt/ip_sentinel"
 echo "========================================================"
 echo "      🗑️ 准备卸载 IP-Sentinel (边缘节点 Edge Agent)"

-# [核心: 动态读取并播报即将销毁的本地版本号]
 CONFIG_FILE="${INSTALL_DIR}/config.conf"
 if [ -f "$CONFIG_FILE" ]; then
    CURRENT_VER=$(grep "^AGENT_VERSION=" "$CONFIG_FILE" | cut -d'"' -f2)
@@ -27,35 +23,20 @@ if [ -f "$CONFIG_FILE" ]; then
 fi
 echo "========================================================"

-# 1. 停止并删除 Systemd 服务
-echo "[1/4] 正在停止并删除 Systemd 服务..."
+echo "[1/3] 正在终止后台守护进程与 Systemd 服务..."
 if command -v systemctl >/dev/null 2>&1; then
-    echo "[1/4] 💡 检测到 Systemd 环境，正在删除 Systemd 服务单元..."
    systemctl disable --now ip-sentinel-runner.service ip-sentinel-runner.timer \
        ip-sentinel-updater.service ip-sentinel-updater.timer \
        ip-sentinel-report.service ip-sentinel-report.timer \
-        ip-sentinel-agent-daemon.service ip-sentinel-agent-daemon.timer >/dev/null 2>&1
-    rm -f /etc/systemd/system/ip-sentinel-runner.service
-    rm -f /etc/systemd/system/ip-sentinel-runner.timer
-    rm -f /etc/systemd/system/ip-sentinel-updater.service
-    rm -f /etc/systemd/system/ip-sentinel-updater.timer
-    rm -f /etc/systemd/system/ip-sentinel-report.service
-    rm -f /etc/systemd/system/ip-sentinel-report.timer
-    rm -f /etc/systemd/system/ip-sentinel-agent-daemon.service
-    rm -f /etc/systemd/system/ip-sentinel-agent-daemon.timer
+        ip-sentinel-agent-daemon.service >/dev/null 2>&1
+    rm -f /etc/systemd/system/ip-sentinel-*.service
+    rm -f /etc/systemd/system/ip-sentinel-*.timer
    systemctl daemon-reload
    systemctl reset-failed
-else
-    echo "[1/4] 💡 未检测到 Systemd，跳过此步骤..."
 fi

-# 2. 停止运行中的守护进程与主控模块 (涵盖所有历史版本进程)
-echo "[2/4] 正在终止后台守护进程与所有养护任务..."
-
-# 使用 pkill 替代传统的 pgrep | xargs，指令更短、容错率更高
 pkill -9 -f "tg_daemon.sh" >/dev/null 2>&1
 pkill -9 -f "agent_daemon.sh" >/dev/null 2>&1
-# [v3.4.0 优化] 确保清理所有 python3 调起的 Webhook 实例
 pkill -9 -f "python3.*webhook.py" >/dev/null 2>&1
 pkill -9 -f "webhook.py" >/dev/null 2>&1
 pkill -9 -f "runner.sh" >/dev/null 2>&1
@@ -64,26 +45,22 @@ pkill -9 -f "tg_report.sh" >/dev/null 2>&1
 pkill -9 -f "mod_google.sh" >/dev/null 2>&1
 pkill -9 -f "mod_trust.sh" >/dev/null 2>&1

-# 3. 清除系统定时任务 (Cron)
-echo "[3/4] 正在清理系统定时任务 (Cron)..."
+echo "[2/3] 正在清理系统定时任务 (Cron)..."
 if crontab -l >/dev/null 2>&1; then
    crontab -l | grep -v "ip_sentinel" > /tmp/cron_backup
    crontab /tmp/cron_backup
    rm -f /tmp/cron_backup
 fi

-# 4. 删除所有文件、日志与临时缓存
-echo "[4/4] 正在抹除核心程序、配置文件与系统痕迹..."
+echo "[3/3] 正在抹除核心程序、配置文件与系统痕迹..."
 if [ -d "$INSTALL_DIR" ]; then
    rm -rf "$INSTALL_DIR"
 fi

-# 拔除 /tmp 目录下的所有更新下载临时文件和 V1/V2 遗留的偏移量记录
 rm -f /tmp/ip_sentinel_*.txt
 rm -f /tmp/ip_sentinel_*.json

 echo "========================================================"
 echo "✅ 卸载彻底完成！IP-Sentinel 已从您的系统中无痕移除。"
-echo "💡 提示：如果安装时在防火墙放行了 Webhook 随机端口，请您按需手动关闭。"
-echo "👋 感谢您的使用，期待未来再次为您守护资产！"
+echo "💡 提示：如果安装时在防火墙放行了 Webhook 随机端口，请按需手动关闭。"
 echo "========================================================"
--- a/core/updater.sh
+++ b/core/updater.sh
@@ -25,18 +25,12 @@ log() {
    # [v3.4.0 核心] 提取当前配置中的版本锚点
    local local_ver="${AGENT_VERSION:-未知}"
    
-    # 保证日志目录存在
    mkdir -p "${INSTALL_DIR}/logs"
-
-    # 日志格式注入 [版本号] 追踪标识
    local core_msg=$(printf "[v%-5s] [%-5s] [%-7s] [%s] %s" "$local_ver" "$2" "$1" "$REGION_CODE" "$3")
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $core_msg" >> "$LOG_FILE"
-
-    # 强制推送到 Systemd Journal (如果系统支持)
    if command -v logger >/dev/null 2>&1; then
        logger -t ip-sentinel "$core_msg"
    else
-        # 降级输出到 stdout，让 Systemd 捕获
        echo "$core_msg"
    fi
 }