NetSurf: what GTK's images and libcurl's resolver needed

NetSurf (GTK 3) now starts under X and loads pages over HTTPS. Every icon
GTK draws goes gdk-pixbuf -> glycin -> a loader process -> a sealed memfd
-> GMappedFile, and each hop found something missing:

- mkaroot runs Alpine's package triggers in the root under bubblewrap.
  --no-scripts had skipped them, so there was no MIME cache, pixbuf loader
  list, compiled GSettings schemas, GIO module cache, font cache or busybox
  applet links.
- /usr/bin/bwrap is a stand-in that parses bubblewrap's options and runs
  the program with no sandbox: glycin starts its loaders only through bwrap,
  and real bwrap needs namespaces. schos-base replaces bubblewrap for it.
- ioctl: FIOCLEX, FIONCLEX, FIONBIO and FIOASYNC on any descriptor (Rust's
  std uses them; pipes and sockets answered ENOTTY).
- capget/capset: root has every capability, others none.
- socketpair accepts SOCK_DGRAM and SOCK_SEQPACKET, carried as a stream.
- waitpid and setpgid match children against the thread group leader, so a
  thread can wait for the process it spawned (ECHILD before).
- memfd: fstat reports the ftruncate length, not the page-rounded one; file
  seals (F_ADD_SEALS, F_GET_SEALS, MFD_ALLOW_SEALING) are recorded and
  enforced on later writes, truncation and writable mappings; MFD_CLOEXEC
  is honoured; read-only MAP_PRIVATE maps are allowed.
- recvfrom honours O_NONBLOCK and MSG_DONTWAIT. musl's resolver reads its
  socket until EAGAIN and blocked for ever after the first DNS answer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

kernel/sys/sys_proc.c

@@ -134,6 +134,39 @@ sys_wait4(void)
     return wpid;
 }
 
+// Capabilities: all of them for root, none for anyone else -- which is what
+// the permission checks here amount to. glycin asks before it sandboxes an
+// image loader, and stopped at ENOSYS.
+addr_t
+sys_capget(void)
+{
+    addr_t hdrp, datap;
+    uint32 hdr[2];
+    argaddr(0, &hdrp);
+    argaddr(1, &datap);
+    if (copy_from_user(hdr, hdrp, sizeof(hdr)) < 0)
+        return -EFAULT;
+    if (hdr[0] != 0x19980330 && hdr[0] != 0x20071026 && hdr[0] != 0x20080522) {
+        hdr[0] = 0x20080522;            // the version this kernel speaks
+        put_user(hdr[0], hdrp);
+        return -EINVAL;
+    }
+    if (datap == 0)
+        return 0;
+    int words = hdr[0] == 0x19980330 ? 1 : 2;
+    uint32 all = myproc()->euid == 0 ? 0xffffffffu : 0;
+    for (int i = 0; i < words; i++) {
+        uint32 d[3] = { all, all, 0 };  // effective, permitted, inheritable
+        if (copy_to_user(datap + i * sizeof(d), d, sizeof(d)) < 0)
+            return -EFAULT;
+    }
+    return 0;
+}
+
+// Dropping capabilities is accepted and changes nothing: there are none to
+// drop that the uid does not already decide.
+addr_t sys_capset(void) { return 0; }
+
 addr_t
 sys_clone(void)
 {