I wonder if most apps have a reason to use the ioctl syscall normally. I think termios uses ioctl(), but what else? Do apps even need terminal control? Seems like ioctl() could be blacklisted with seccomp. Or maybe whitelist the permitted nodes with seccomp.