Merge "Further restrict socket ioctls available to apps" into nyc-dev