New in this release:

• When a process encounters a seccomp policy failure, print the path to the failing policy.
• Add support for a text-based configuration file.
• Add support for setting and resetting the jailed process' environment.

Tons of stuff in this release, we haven't tagged a release in a while. We're lazy with highlights this time, so please just see the commit log.

New in this release:

• Provide idiomatic Rust wrappers for Minijail (allenwebb@google.com).

New in this release:

• Allow more than one @include per syscall filter (zachr@google.com).
• Close redirected fds after dup2()-ing them (mnissler@google.com).
• Return MINIJAIL_ERR_MOUNT instead of crashing if mount_one fails (fdegros@chromium.org).

• Support setting supplementary GIDs in the command line (speed47_github@speed47.net).
• Allow passing an environment to the sandboxed child in the LD_PRELOAD case (mnissler@google.com).

New in this release:

• Generate syscall frequency files in generate_seccomp_policy.py (delco@chromium.org).
• Clean up man pages (various).
• Add pull request closer for RO GitHub mirror (vapier@google.com).

New in this release:

• Better error diagnostics in the seccomp compiler (lhchavez@google.com).
• Small fixes.

New in this release:

• Preserve namespace file descriptors through fork+exec (jorgelo@google.com).
• Improvements to minijail_wait() and minijail_kill() (fdegros@google.com).
• Fixes for compile_seccomp_policy (delco@google.com).

New in this release:

• New standalone seccomp compiler (lhchavez@google.com).
• Add support for SECCOMP_RET_LOG (jorgelo@google.com).
• Allow passing a cap_from_text(3)-compliant string to -c (lhchavez@google.com).
• Add support for <, <=, >, >= to runtime seccomp compiler (lhchavez@google.com).
• Introduce the ~ unary operator and parenthesized constants (lhchavez@google.com).
• Allow passing a new environment to the child (jorgelo@google.com).