shm: add sealing API