NetSurf: what GTK's images and libcurl's resolver needed

NetSurf (GTK 3) now starts under X and loads pages over HTTPS. Every icon
GTK draws goes gdk-pixbuf -> glycin -> a loader process -> a sealed memfd
-> GMappedFile, and each hop found something missing:

- mkaroot runs Alpine's package triggers in the root under bubblewrap.
  --no-scripts had skipped them, so there was no MIME cache, pixbuf loader
  list, compiled GSettings schemas, GIO module cache, font cache or busybox
  applet links.
- /usr/bin/bwrap is a stand-in that parses bubblewrap's options and runs
  the program with no sandbox: glycin starts its loaders only through bwrap,
  and real bwrap needs namespaces. schos-base replaces bubblewrap for it.
- ioctl: FIOCLEX, FIONCLEX, FIONBIO and FIOASYNC on any descriptor (Rust's
  std uses them; pipes and sockets answered ENOTTY).
- capget/capset: root has every capability, others none.
- socketpair accepts SOCK_DGRAM and SOCK_SEQPACKET, carried as a stream.
- waitpid and setpgid match children against the thread group leader, so a
  thread can wait for the process it spawned (ECHILD before).
- memfd: fstat reports the ftruncate length, not the page-rounded one; file
  seals (F_ADD_SEALS, F_GET_SEALS, MFD_ALLOW_SEALING) are recorded and
  enforced on later writes, truncation and writable mappings; MFD_CLOEXEC
  is honoured; read-only MAP_PRIVATE maps are allowed.
- recvfrom honours O_NONBLOCK and MSG_DONTWAIT. musl's resolver reads its
  socket until EAGAIN and blocked for ever after the first DNS answer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

include/uapi/fcntl.h

@@ -46,5 +46,15 @@
 #define F_OFD_GETLK      36
 #define F_OFD_SETLK      37
 #define F_OFD_SETLKW     38
+// memfd seals (Linux values).
+#define F_ADD_SEALS      1033
+#define F_GET_SEALS      1034
+#define F_SEAL_SEAL          0x01
+#define F_SEAL_SHRINK        0x02
+#define F_SEAL_GROW          0x04
+#define F_SEAL_WRITE         0x08
+#define F_SEAL_FUTURE_WRITE  0x10
+#define MFD_CLOEXEC          0x01
+#define MFD_ALLOW_SEALING    0x02
 
 #define FD_CLOEXEC 1

include/uapi/user.h

@@ -46,8 +46,7 @@ int alarm(int seconds);
 int waitpid(int pid, int *status, int options);
 int setsid(void);
 void* mmap(void*, uint64, int, int, int, uint64);
-// memfd_create(2). The flags argument exists for MFD_CLOEXEC and MFD_ALLOW_
-// SEALING, neither of which this kernel implements; pass 0.
+// memfd_create(2). flags: MFD_CLOEXEC, MFD_ALLOW_SEALING.
 int memfd_create(const char *name, uint flags);
 // Shared memory. shmat returns the attach address, or a small negative value
 // on failure — there is no errno in this runtime, so check for < 0.