diff --git a/src/seccomp.c b/src/seccomp.c
index 9e009ab..bdff33c 100644
--- a/src/seccomp.c
+++ b/src/seccomp.c
@@ -42,6 +42,7 @@ void ruri_setup_seccomp(const struct RURI_CONTAINER *_Nonnull container)
 	}
 	seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(add_key), 0);
 	if (ruri_is_in_caplist(container->drop_caplist, CAP_SYS_ADMIN)) {
+		seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(ioctl), 1, SCMP_CMP(1, SCMP_CMP_EQ, TIOCSTI));
 		seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(bpf), 0);
 		seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(lookup_dcookie), 0);
 		seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(mount), 0);