libinput, seatd and libseat; sockets from accept() can pass descriptors

Alpine's libinput, libseat, seatd, xf86-input-libinput and usbutils join the
image, and seatd runs from schinit. libinput lists the keyboard and pointer as
an ordinary user, Xorg now drives both through libinput, and a program linked
to libseat running as schos opens seat0 through seatd, is handed
/dev/input/event0 and reads its name through the descriptor.

Two kernel bugs stood in the way, and both would have stopped a Wayland
compositor too. The socket connect() queues for a listener was allocated with
its domain at zero, so sendmsg refused SCM_RIGHTS on the accepted end: a server
could receive descriptors and never send one. And sendmsg treated a control
buffer longer than its messages as an error, where Linux takes a following
header too short to be one as the end; seatd passes a zeroed CMSG_SPACE array
with one descriptor at the front.

Found with /proc/strace and a temporary kinfo in sendmsg's EINVAL sites.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EVRhxi9zpdW2uDUN4FVcao

docs/architecture/desktop.md

@@ -14,10 +14,10 @@ Wayland needs — udev, `/sys/devices`, libinput, a DRM device — is in [../pla
 Every Wayland compositor worth running — labwc, and everything built on wlroots — needs
 DRM/KMS, libinput, udev and libseat. DRM/KMS is the largest of them by far: a kernel graphics
 subsystem, and in practice a great deal taken from Linux. Xorg runs on a plain framebuffer
-through `fbdev` and reads input through `evdev`, both interfaces SchOS already had. That is
-the shorter road to a desktop by a long way, and it brings the window managers with it.
-DRM/KMS is not planned; libinput, udev and libseat are worth having for their own sake and
-may come later.
+through `fbdev`, which SchOS already had. That is the shorter road to a desktop by a long way,
+and it brings the window managers with it. udev, libinput and libseat are now in the image
+([udev.md](udev.md)); DRM/KMS is the part still missing, and it is the GPU plan
+([../plan/gpu.md](../plan/gpu.md)).
 
 ## What it stands on
 

docs/architecture/udev.md

@@ -80,6 +80,32 @@ and regular files in `/dev` are refused.
   A queue that is full drops the message, as Linux does, and `udevadm trigger`
   is how a reader recovers.
 
+## libinput and libseat
+
+`libinput` (Alpine) reads the evdev nodes udev tagged and `xf86-input-libinput`
+gives Xorg the same library; `libinput list-devices` as an ordinary user shows
+`SchOS keyboard` and `SchOS pointer`. Xorg's `40-libinput.conf` now claims both,
+and the log says `Using input driver 'libinput'`.
+
+`seatd` (job `etc/schinit/seatd.job`, socket `/run/seatd.sock`, group `video`)
+and `libseat` let a program that is not root take devices from the system. The
+client asks seatd for `seat0`; seatd takes the VT (`VT_SETMODE`, `KDSETMODE`,
+`KDSKBMODE`, all there already), opens the device as root and passes the
+descriptor back over the socket with `SCM_RIGHTS`. Checked as `schos` against
+`/dev/input/event0` and `event1` with a small program linked to libseat, reading
+the device's name through the descriptor it was handed.
+
+Getting there found two kernel bugs, both in descriptor passing:
+
+- **A socket returned by `accept()` was not an `AF_UNIX` socket as far as
+  `sendmsg` was concerned.** The end `connect()` queues for the listener was
+  allocated with its domain left at zero, and `sendmsg` refuses `SCM_RIGHTS` on
+  anything else. So a *server* could receive descriptors and never send one:
+  seatd, and equally a Wayland compositor handing a client a buffer.
+- **A control buffer longer than its messages was an error.** seatd passes a
+  zeroed array with one descriptor at the front; Linux treats a following header
+  too short to be one as the end. `sendmsg` now does too.
+
 ## What is not there
 
 - USB interfaces (`1-3:1.0`), `/dev/bus/usb` nodes, and PCI bridges as parents.
@@ -89,7 +115,7 @@ and regular files in `/dev` are refused.
   image, so `60-input-id` logs "returned non-zero" for the hwdb import. The
   properties that matter come from `input_id`.
 - Block device partitions, `by-id` / `by-uuid` links, and a `/sys/block`.
-- `libinput` and `libseat` (next; see [../plan/roadmap.md](../plan/roadmap.md)).
+- A compositor. libinput and libseat are in place, DRM is not; see [../plan/roadmap.md](../plan/roadmap.md).
 
 ## Testing
 

docs/plan/roadmap.md

@@ -62,12 +62,14 @@ compositor worth running is years of work that Alpine already packages.) The des
 Wayland compositor (labwc, sway, weston, a GNOME or KDE session) is the larger step. What Wayland — and a modern X — need
 from the system, in the order they are useful:
 
-1. **udev — done for the kernel's own devices** ([udev.md](../architecture/udev.md)). eudev runs from `schinit`, the uevent
-   netlink socket and the `/sys/devices` tree exist, devtmpfs takes udev's links, and Xorg finds its keyboard and mouse
-   through it. **Left:** PCI and USB devices in the same tree, with `add`/`remove` events from the hotplug thread, so a USB
-   keyboard or a GPU appears to udev; libinput then enumerates evdev devices through it.
-2. **libinput and libseat** (seatd is in Alpine): evdev with the properties libinput reads (`ID_INPUT_*` from udev), and a way
-   for a non-root compositor to take the keyboard and the display from the kernel — the `VT_PROCESS` handshake exists.
+1. **udev — done** ([udev.md](../architecture/udev.md)). eudev runs from `schinit`, the uevent netlink socket and the
+   `/sys/devices` tree exist, PCI and USB devices are in it with `add`/`remove` events from USB hot-plug, devtmpfs takes udev's
+   links, and Xorg finds its keyboard and mouse through it. **Left:** USB interfaces, PCI bridges as parents, `hwdb`.
+2. **libinput and libseat — done.** `libinput list-devices` sees the keyboard and the pointer as an ordinary user, Xorg now
+   drives both through `xf86-input-libinput`, and `seatd` runs from `schinit`: a non-root program opens `seat0` through
+   `libseat`, is handed `/dev/input/event0` over the socket, and reads it. Getting there found a real kernel bug (sockets
+   returned by `accept()` could not carry file descriptors) and a second one in `sendmsg`'s control-buffer parsing; both would
+   have stopped a Wayland compositor and its clients too. **Not yet tried:** a compositor.
 3. **A DRM device.** Wayland compositors want `/dev/dri/card0` with KMS, and Mesa wants `renderD128`. SchOS has neither: it has
    `/dev/fb0`. This is the GPU plan ([gpu.md](gpu.md)) — Linux's own `amdgpu` run by LDLS and `/dev/dri` served by that
    process — and, for machines without a real GPU driver, a *simple-framebuffer* DRM shim (Linux's `simpledrm`, which is a