src: add --disable-sigusr1 to prevent signal i/o thread

doc/api/cli.md

@@ -574,6 +574,17 @@ Disable the `Object.prototype.__proto__` property. If `mode` is `delete`, the
 property is removed entirely. If `mode` is `throw`, accesses to the
 property throw an exception with the code `ERR_PROTO_ACCESS`.
 
+### `--disable-sigusr1`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.2 - Release candidate
+
+Disable the ability of starting a debugging session by sending a
+`SIGUSR1` signal to the process.
+
 ### `--disable-warning=code-or-type`
 
 > Stability: 1.1 - Active development
@@ -1447,6 +1458,7 @@ added: v7.6.0
 
 Set the `host:port` to be used when the inspector is activated.
 Useful when activating the inspector by sending the `SIGUSR1` signal.
+Except when [`--disable-sigusr1`][] is passed.
 
 Default host is `127.0.0.1`. If port `0` is specified,
 a random available port will be used.
@@ -3073,6 +3085,7 @@ one is included in the list below.
 * `--conditions`, `-C`
 * `--diagnostic-dir`
 * `--disable-proto`
+* `--disable-sigusr1`
 * `--disable-warning`
 * `--disable-wasm-trap-handler`
 * `--dns-result-order`
@@ -3651,6 +3664,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [`--build-snapshot`]: #--build-snapshot
 [`--cpu-prof-dir`]: #--cpu-prof-dir
 [`--diagnostic-dir`]: #--diagnostic-dirdirectory
+[`--disable-sigusr1`]: #--disable-sigusr1
 [`--env-file-if-exists`]: #--env-file-if-existsconfig
 [`--env-file`]: #--env-fileconfig
 [`--experimental-addon-modules`]: #--experimental-addon-modules

src/env-inl.h

@@ -666,7 +666,8 @@ inline bool Environment::no_global_search_paths() const {
 }
 
 inline bool Environment::should_start_debug_signal_handler() const {
-  return (flags_ & EnvironmentFlags::kNoStartDebugSignalHandler) == 0;
+  return ((flags_ & EnvironmentFlags::kNoStartDebugSignalHandler) == 0) &&
+         !options_->disable_sigusr1;
 }
 
 inline bool Environment::no_browser_globals() const {

src/node_options.cc

@@ -386,6 +386,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             " (default: current working directory)",
             &EnvironmentOptions::diagnostic_dir,
             kAllowedInEnvvar);
+  AddOption("--disable-sigusr1",
+            "Disable inspector thread to be listening for SIGUSR1 signal",
+            &EnvironmentOptions::disable_sigusr1,
+            kAllowedInEnvvar,
+            false);
   AddOption("--dns-result-order",
             "set default value of verbatim in dns.lookup. Options are "
             "'ipv4first' (IPv4 addresses are placed before IPv6 addresses) "

src/node_options.h

@@ -116,6 +116,7 @@ class EnvironmentOptions : public Options {
   bool abort_on_uncaught_exception = false;
   std::vector<std::string> conditions;
   bool detect_module = true;
+  bool disable_sigusr1 = false;
   bool print_required_tla = false;
   bool require_module = true;
   std::string dns_result_order;

test/fixtures/disable-signal/sigusr1.js

@@ -0,0 +1,2 @@
+console.log('pid is', process.pid);
+setInterval(() => {}, 1000);

test/parallel/test-disable-sigusr1.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const { it } = require('node:test');
+const assert = require('node:assert');
+const { NodeInstance } = require('../common/inspector-helper.js');
+
+common.skipIfInspectorDisabled();
+
+it('should not attach a debugger with SIGUSR1', { skip: common.isWindows }, async () => {
+  const file = fixtures.path('disable-signal/sigusr1.js');
+  const instance = new NodeInstance(['--disable-sigusr1'], undefined, file);
+
+  instance.on('stderr', common.mustNotCall());
+  const loggedPid = await new Promise((resolve) => {
+    instance.on('stdout', (data) => {
+      const matches = data.match(/pid is (\d+)/);
+      if (matches) resolve(Number(matches[1]));
+    });
+  });
+
+  assert.ok(process.kill(instance.pid, 'SIGUSR1'));
+  assert.strictEqual(loggedPid, instance.pid);
+  assert.ok(await instance.kill());
+});