tree-wide: acquire /dev/console lock around any attempts to reset TTY

src/basic/terminal-util.c

@@ -599,6 +599,10 @@ void reset_dev_console_fd(int fd, bool switch_to_text) {
 
         assert(fd >= 0);
 
+        _cleanup_close_ int lock_fd = lock_dev_console();
+        if (lock_fd < 0)
+                log_debug_errno(lock_fd, "Failed to lock /dev/console, ignoring: %m");
+
         r = terminal_reset_ioctl(fd, switch_to_text);
         if (r < 0)
                 log_warning_errno(r, "Failed to reset /dev/console, ignoring: %m");
@@ -1592,6 +1596,16 @@ int terminal_reset_defensive(int fd, bool switch_to_text) {
         return r;
 }
 
+int terminal_reset_defensive_locked(int fd, bool switch_to_text) {
+        assert(fd >= 0);
+
+        _cleanup_close_ int lock_fd = lock_dev_console();
+        if (lock_fd < 0)
+                log_debug_errno(lock_fd, "Failed to acquire lock for /dev/console, ignoring: %m");
+
+        return terminal_reset_defensive(fd, switch_to_text);
+}
+
 void termios_disable_echo(struct termios *termios) {
         assert(termios);
 

src/basic/terminal-util.h

@@ -30,6 +30,7 @@
 bool isatty_safe(int fd);
 
 int terminal_reset_defensive(int fd, bool switch_to_text);
+int terminal_reset_defensive_locked(int fd, bool switch_to_text);
 
 int terminal_set_cursor_position(int fd, unsigned row, unsigned column);
 

src/core/exec-invoke.c

@@ -660,6 +660,10 @@ static int setup_confirm_stdio(
         if (fd < 0)
                 return fd;
 
+        _cleanup_close_ int lock_fd = lock_dev_console();
+        if (lock_fd < 0)
+                log_debug_errno(lock_fd, "Failed to lock /dev/console, ignoring: %m");
+
         r = chown_terminal(fd, getuid());
         if (r < 0)
                 return r;

src/firstboot/firstboot.c

@@ -133,7 +133,7 @@ static void print_welcome(int rfd) {
         pn = os_release_pretty_name(pretty_name, os_name);
         ac = isempty(ansi_color) ? "0" : ansi_color;
 
-        (void) terminal_reset_defensive(STDOUT_FILENO, /* switch_to_text= */ false);
+        (void) terminal_reset_defensive_locked(STDOUT_FILENO, /* switch_to_text= */ false);
 
         if (colors_enabled())
                 printf("\nWelcome to your new installation of \x1B[%sm%s\x1B[0m!\n", ac, pn);

src/home/homectl.c

@@ -2438,7 +2438,7 @@ static int create_interactively(void) {
 
         (void) polkit_agent_open_if_enabled(arg_transport, arg_ask_password);
 
-        (void) terminal_reset_defensive(STDOUT_FILENO, /* switch_to_text= */ false);
+        (void) terminal_reset_defensive_locked(STDOUT_FILENO, /* switch_to_text= */ false);
 
         for (;;) {
                 username = mfree(username);

src/tty-ask-password-agent/tty-ask-password-agent.c

@@ -150,7 +150,7 @@ static int agent_ask_password_tty(
                 if (tty_fd < 0)
                         return log_error_errno(tty_fd, "Failed to acquire %s: %m", con);
 
-                (void) terminal_reset_defensive(tty_fd, /* switch_to_text= */ true);
+                (void) terminal_reset_defensive_locked(tty_fd, /* switch_to_text= */ true);
 
                 log_info("Starting password query on %s.", con);
         }