Plash sandbox protection bypass

It's possible to execute any command via /dev/tty device...