{"id":"53f8fc17-2e58-46af-a2d4-f5f45648c3d5","task":"Protect a bubblewrap (bwrap) sandbox against the TIOCSTI terminal-injection escape (CVE-2017-5226) by detaching it from the controlling terminal with --new-session, and understand the interactivity tradeoff involved.","domain":"github.com/containers/bubblewrap","steps":["Detach the sandbox from the controlling terminal before running any untrusted, non-interactive command: `bwrap --new-session --unshare-pid --ro-bind /usr /usr --proc /proc --dev /dev COMMAND`. Per bwrap.xml (https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml), '--new-session: Create a new terminal session for the sandbox (calls setsid()). This disconnects the sandbox from the controlling terminal which means the sandbox can't for instance inject input into the terminal.'","If `--new-session` cannot be used because the sandboxed program legitimately needs the real controlling TTY, mitigate the same risk with a seccomp filter blocking `ioctl(TIOCSTI)` instead — bwrap.xml states: 'if you don't use --new-session, it is recommended to use seccomp to disallow the TIOCSTI ioctl, otherwise the application can feed keyboard input to the terminal which can e.g. lead to out-of-sandbox command execution (see CVE-2017-5226).'","Reproduce the official minimal-shell example, which uses `--new-session` even for an interactive `bash`: `bwrap --ro-bind /usr /usr --symlink usr/lib64 /lib64 --proc /proc --dev /dev --unshare-pid --new-session bash` (README.md 'Usage' section).","Confirm the tradeoff by testing job control: after adding `--new-session`, a program expecting terminal-associated signals (e.g. Ctrl-C forwarding tied to the old session) inside the sandbox may behave differently, since the process is now in a new, detached session.","Default to `--new-session` unconditionally for batch/CI/non-interactive uses of bwrap, per README.md's Limitations section: 'If you are not filtering out TIOCSTI commands using seccomp filters, argument --new-session is needed to protect against out-of-sandbox command execution.'"],"gotchas":["The vulnerability this protects against is CVE-2017-5226, referenced both in bwrap.xml's `--new-session` docs and README.md's Limitations section (which links to https://github.com/containers/bubblewrap/issues/142).","`--new-session`'s documentation states the tradeoff directly — it 'disconnects the sandbox from the controlling terminal,' which also means the sandboxed process loses its controlling terminal and can break interactive tools relying on session-associated terminal signals.","Omitting both `--new-session` and a TIOCSTI-blocking seccomp filter leaves the sandbox able to 'feed keyboard input to the terminal,' the literal, documented mechanism of CVE-2017-5226 (bwrap.xml).","README.md's Limitations section frames this as effectively a binary choice — use `--new-session`, or explicitly filter `TIOCSTI` via seccomp; leaving both unaddressed is called out by the official docs as insecure."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T04:01:28.553Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T04:01:28.553Z"},"url":"https://mcp.waymark.network/r/53f8fc17-2e58-46af-a2d4-f5f45648c3d5"}