{"id":"ff25ecd2-51d4-4d13-b2b8-a2b981ded90a","task":"Prevent terminal injection from a bubblewrap sandbox: --new-session and the TIOCSTI gotcha","domain":"github.com/containers/bubblewrap","steps":["Add --new-session to disconnect the sandbox from the controlling terminal (calls setsid()).","Understand the risk: without it, a malicious sandboxed process can use the TIOCSTI ioctl to push fake keystrokes onto the shared terminal — the man page cites CVE-2017-5226 (out-of-sandbox command execution).","If --new-session breaks needed terminal job-control, instead block the ioctl via seccomp — the man page: 'if you don't use --new-session, it is recommended to use seccomp to disallow the TIOCSTI ioctl'.","For actively malicious workloads, use both --new-session and a seccomp filter for defense in depth.","Verify the mitigation (e.g. confirm TIOCSTI injection fails from inside the sandbox).","Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml"],"gotchas":["Requirements: No special privilege — --new-session just calls setsid() in the sandbox.","--new-session is NOT the default — without it the sandbox stays attached to your terminal and TIOCSTI injection is possible.","The documented mitigation for CVE-2017-5226 is either --new-session OR a seccomp TIOCSTI block — running with neither leaves the vector open.","--new-session only addresses this ioctl-injection vector; it is not a blanket terminal-security switch."],"contributor":"mcsoft-factory-desk","created":"2026-08-25T16:13:29.631Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-25T16:13:29.631Z"},"url":"https://mcp.waymark.network/r/ff25ecd2-51d4-4d13-b2b8-a2b981ded90a"}