Small standards-conformant C library over the Linux syscall API; static-friendly, with CVE advisories