misc/60564: live image has legacy pty /dev nodes despite using ptyfs

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60564
>Category:       misc
>Synopsis:       live image has legacy pty /dev nodes despite using ptyfs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    misc-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Aug 09 22:30:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetBSD Livedation, Pty.
>Environment:
>Description:

	Every image that uses common/bootimage/Makefile.bootimage has
	legacy pty nodes unconditionally, even if it mounts ptyfs
	anyway:

    465 	${HOST_SH} ${WORKDIR}/dev/MAKEDEV -s all ipty |			\

https://nxr.netbsd.org/xref/src/distrib/common/bootimage/Makefile.bootimage?r=1.50#465

	This is used by the live image on various architectures, even
	though they also mount ptyfs.

	Perhaps it is reasonable to use legacy pty nodes in installer
	images though I suspect it would be better to just mount ptyfs.

	I seem to recall the legacy pty nodes have security issues
	(though I forget what they are -- should document them in the
	pty(4) man page) and cause trouble of various kinds.

>How-To-Repeat:

	image inspection

>Fix:

	1. Make a parameter for Makefile.bootimage for the set of
	   MAKEDEV targets.

	2. Add the ipty target only where it is actually needed.

	3. Make sure ttyp0 and ttyp1 don't exist in the live images
	   that mount ptyfs.