Allow tty ioctls in Landlock /dev grant

ober

30190955501129d8cfcc6b31c81b247447fbe674

diff --git a/support/landlock-shim.c b/support/landlock-shim.c
index a80a21a..7eed4b4 100644
--- a/support/landlock-shim.c
+++ b/support/landlock-shim.c
@@ -215,7 +215,13 @@ int jerboa_landlock_sandbox_ex(const char *packed_read,
         ADD_RULE("/sbin", ACCESS_FS_READ);
         ADD_RULE("/etc", ACCESS_FS_READ);
         ADD_RULE("/proc", ACCESS_FS_READ);
-        ADD_RULE("/dev", ACCESS_FS_READ | LANDLOCK_ACCESS_FS_WRITE_FILE);
+        /* /dev needs IOCTL_DEV (ABI 5+) so the child can run tty ioctls on
+         * /dev/tty and /dev/pts/* — without it, Node's tcgetattr/isatty on
+         * stdin/stdout returns EACCES and TUIs (claude, etc.) hang or fall
+         * back to non-tty mode. ADD_RULE masks (access) & handled, so the
+         * IOCTL_DEV bit is silently dropped on ABI < 5 kernels. */
+        ADD_RULE("/dev", ACCESS_FS_READ | LANDLOCK_ACCESS_FS_WRITE_FILE
+                         | LANDLOCK_ACCESS_FS_IOCTL_DEV);
 
         /* 4. Parse packed paths and add user rules */