NetSurf: what GTK's images and libcurl's resolver needed

NetSurf (GTK 3) now starts under X and loads pages over HTTPS. Every icon
GTK draws goes gdk-pixbuf -> glycin -> a loader process -> a sealed memfd
-> GMappedFile, and each hop found something missing:

- mkaroot runs Alpine's package triggers in the root under bubblewrap.
  --no-scripts had skipped them, so there was no MIME cache, pixbuf loader
  list, compiled GSettings schemas, GIO module cache, font cache or busybox
  applet links.
- /usr/bin/bwrap is a stand-in that parses bubblewrap's options and runs
  the program with no sandbox: glycin starts its loaders only through bwrap,
  and real bwrap needs namespaces. schos-base replaces bubblewrap for it.
- ioctl: FIOCLEX, FIONCLEX, FIONBIO and FIOASYNC on any descriptor (Rust's
  std uses them; pipes and sockets answered ENOTTY).
- capget/capset: root has every capability, others none.
- socketpair accepts SOCK_DGRAM and SOCK_SEQPACKET, carried as a stream.
- waitpid and setpgid match children against the thread group leader, so a
  thread can wait for the process it spawned (ECHILD before).
- memfd: fstat reports the ftruncate length, not the page-rounded one; file
  seals (F_ADD_SEALS, F_GET_SEALS, MFD_ALLOW_SEALING) are recorded and
  enforced on later writes, truncation and writable mappings; MFD_CLOEXEC
  is honoured; read-only MAP_PRIVATE maps are allowed.
- recvfrom honours O_NONBLOCK and MSG_DONTWAIT. musl's resolver reads its
  socket until EAGAIN and blocked for ever after the first DNS answer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

kernel/sys/sys_fs.c

@@ -482,6 +482,13 @@ sys_fcntl(void)
     case F_SETFL:
         f->nonblock = (arg & O_NONBLOCK) != 0;
         return 0;
+    case F_ADD_SEALS:
+    case F_GET_SEALS:
+        if (f->type != FD_MEMFD)
+            return -EINVAL;
+        if (cmd == F_ADD_SEALS && !f->writable)
+            return -EPERM;
+        return memfd_seals(f->memfd_seg, cmd == F_ADD_SEALS ? arg : -1);
     case F_GETLK: case F_SETLK: case F_SETLKW:
     case F_OFD_GETLK: case F_OFD_SETLK: case F_OFD_SETLKW: {
         // A pointer, which argint() above would have cut to 32 bits.
@@ -1547,6 +1554,28 @@ addr_t sys_ioctl(void)
         return 0;
     }
 
+    // The four that apply to any descriptor at all. Rust's standard library
+    // sets close-on-exec with FIOCLEX and non-blocking with FIONBIO rather
+    // than with fcntl, and on a pipe or a socket those fell through to the
+    // ENOTTY below: glycin's image loaders failed with "Not a tty" and GTK
+    // could load no icon.
+    if (request == 0x5451 || request == 0x5450) {        // FIOCLEX, FIONCLEX
+        if (request == 0x5451)
+            myproc()->files->flags[fd] |= FD_CLOEXEC;
+        else
+            myproc()->files->flags[fd] &= ~FD_CLOEXEC;
+        return 0;
+    }
+    if (request == 0x5421) {                             // FIONBIO
+        int on;
+        if (copy_from_user(&on, argp, sizeof(on)) < 0)
+            return -EFAULT;
+        f->nonblock = on != 0;
+        return 0;
+    }
+    if (request == 0x5452)                               // FIOASYNC
+        return 0;
+
     // /dev/fb0 (major 2) — geometry queries. This has to come before the
     // catch-all below, which answers every non-tty ioctl with 0: a program
     // asking FBIOGET_VSCREENINFO would have been told "success" and then