fn create_memfd() -> Result<OwnedFd>
Create a memfd which allows sealing. Like systemd, ask for a non-executable one first, kernels before 6.3 reject that flag.