libinput, seatd and libseat; sockets from accept() can pass descriptors

Alpine's libinput, libseat, seatd, xf86-input-libinput and usbutils join the
image, and seatd runs from schinit. libinput lists the keyboard and pointer as
an ordinary user, Xorg now drives both through libinput, and a program linked
to libseat running as schos opens seat0 through seatd, is handed
/dev/input/event0 and reads its name through the descriptor.

Two kernel bugs stood in the way, and both would have stopped a Wayland
compositor too. The socket connect() queues for a listener was allocated with
its domain at zero, so sendmsg refused SCM_RIGHTS on the accepted end: a server
could receive descriptors and never send one. And sendmsg treated a control
buffer longer than its messages as an error, where Linux takes a following
header too short to be one as the end; seatd passes a zeroed CMSG_SPACE array
with one descriptor at the front.

Found with /proc/strace and a temporary kinfo in sendmsg's EINVAL sites.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EVRhxi9zpdW2uDUN4FVcao

etc/schinit/seatd.job

@@ -0,0 +1,17 @@
+# The seat daemon: hands a Wayland compositor (through libseat) the input and
+# display devices it needs without running the compositor as root. seatd opens
+# them as itself and passes the file descriptors over its socket; the socket is
+# group `video`, which the first user is in.
+#
+# Alpine's seatd package. A compositor that runs as root, or one started with
+# seatd-launch, needs none of this.
+
+Label     = os.schos.seatd
+Program   = /usr/bin/seatd
+Args      = seatd -g video
+RunAtLoad = yes
+KeepAlive = yes
+ThrottleInterval = 3
+
+StandardOut   = /dev/null
+StandardError = /dev/null