interfaces/seccomp: explicitly disallow the use of ioctl + TIOCLINUX

Fixes CVE-2023-1523

Signed-off-by: Alex Murray <alex.murray@canonical.com>

interfaces/seccomp/template.go

@@ -200,7 +200,13 @@ inotify_rm_watch
 # input (man tty_ioctl), so we disallow it to prevent snaps plugging interfaces
 # with 'capability sys_admin' from interfering with other snaps or the
 # unconfined user's terminal.
+# similarly, TIOCLINUX allows to fake input as well (man ioctl_console) so
+# disallow that too
 # TODO: this should be scaled back even more
+~ioctl - TIOCSTI
+~ioctl - TIOCLINUX
+# restrict argument otherwise will match all uses of ioctl() and allow the rules
+# that were disallowed above - TODO: why does this still restrict TIOCLINUX?
 ioctl - !TIOCSTI
 
 io_cancel