Forward ioctl(TCSETSF) calls on host ttys to the host kernel.

We already forward TCSETS and TCSETSW.  TCSETSF is roughly equivalent but
discards pending input.

The filters were relaxed to allow host ioctls with TCSETSF argument.

This fixes programs like "passwd" that prevent user input from being displayed
on the terminal.

Before:
	root@b8a0240fc836:/# passwd
	Enter new UNIX password: 123
	Retype new UNIX password: 123
	passwd: password updated successfully

After:
	root@ae6f5dabe402:/# passwd
	Enter new UNIX password:
	Retype new UNIX password:
	passwd: password updated successfully
PiperOrigin-RevId: 214869788
Change-Id: I31b4d1373c1388f7b51d0f2f45ce40aa8e8b0b58

pkg/abi/linux/ioctl.go

@@ -21,6 +21,7 @@ const (
 	TCGETS     = 0x00005401
 	TCSETS     = 0x00005402
 	TCSETSW    = 0x00005403
+	TCSETSF    = 0x00005404
 	TIOCGPGRP  = 0x0000540f
 	TIOCSPGRP  = 0x00005410
 	TIOCOUTQ   = 0x00005411

pkg/sentry/fs/host/file.go

@@ -305,7 +305,7 @@ func (f *fileOperations) Ioctl(ctx context.Context, io usermem.IO, args arch.Sys
 		})
 		return 0, err
 
-	case linux.TCSETS, linux.TCSETSW:
+	case linux.TCSETS, linux.TCSETSW, linux.TCSETSF:
 		var termios linux.Termios
 		if _, err := usermem.CopyObjectIn(ctx, io, args[2].Pointer(), &termios, usermem.IOOpts{
 			AddressSpaceActive: true,

runsc/boot/filter/config.go

@@ -147,6 +147,11 @@ var allowedSyscalls = seccomp.SyscallRules{
 			seccomp.AllowValue(linux.TCSETS),
 			seccomp.AllowAny{}, /* termios struct */
 		},
+		{
+			seccomp.AllowAny{}, /* fd */
+			seccomp.AllowValue(linux.TCSETSF),
+			seccomp.AllowAny{}, /* termios struct */
+		},
 		{
 			seccomp.AllowAny{}, /* fd */
 			seccomp.AllowValue(linux.TCSETSW),