From 7442dc24ddba1aae7392945f94b0b206ef369b67 Mon Sep 17 00:00:00 2001 From: Cobra Date: Mon, 6 Apr 2026 22:12:26 -0400 Subject: [PATCH] =?UTF-8?q?Fix=20CaptureBus=20cross-fork=20visibility=20?= =?UTF-8?q?=E2=80=94=20restart=20reader=20in=20each=20module=20subprocess?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With multiprocessing fork, threads are not inherited. The parent's CaptureBus reader thread runs in the parent but module subprocesses subscribe AFTER fork, so their SubscriberQueue entries are added to a child-local copy of _subscribers that the parent reader never sees. Fix: reset and restart CaptureBus in each module subprocess so it has its own reader thread on the inherited AF_PACKET socket. Each module gets independent packet delivery. Linux AF_PACKET allows multiple readers on the same interface. --- core/engine.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/core/engine.py b/core/engine.py index 62c1ede..bf3113c 100644 --- a/core/engine.py +++ b/core/engine.py @@ -176,6 +176,18 @@ def _module_runner(module_class: Type[BaseModule], bus_queue: multiprocessing.Qu state = StateManager(db_path=state_db_path) state.start() + # CaptureBus reader thread is not inherited across fork — restart it in + # this subprocess so the module's subscribe() calls reach a live reader. + for key in ("capture_bus", "_capture_bus"): + cb = config.get(key) + if cb is not None: + cb._running = False + cb._capture_thread = None + cb._sock = None + cb._subscribers = [] + cb.start() + break + module = module_class(bus=bus_proxy, state=state, config=config) # Signal handlers for graceful shutdown