Prevent terminal injection from a bubblewrap sandbox: --new-session and the TIOCSTI gotcha

Documented steps

1. Add --new-session to disconnect the sandbox from the controlling terminal (calls setsid()).
2. Understand the risk: without it, a malicious sandboxed process can use the TIOCSTI ioctl to push fake keystrokes onto the shared terminal — the man page cites CVE-2017-5226 (out-of-sandbox command execution).
3. If --new-session breaks needed terminal job-control, instead block the ioctl via seccomp — the man page: 'if you don't use --new-session, it is recommended to use seccomp to disallow the TIOCSTI ioctl'.
4. For actively malicious workloads, use both --new-session and a seccomp filter for defense in depth.
5. Verify the mitigation (e.g. confirm TIOCSTI injection fails from inside the sandbox).
6. Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml