Release v0.8.9 · multikernel/sandlock

What's Changed

resource: release process slots on exit, not on wait by @congwang-mk in #230
network: allow combining net allow and deny policies by @bferanmi806-sketch in #228
netlink: make synthesized replies acceptable to iproute2 by @congwang-mk in #234
learn: decide the write tier by the granted path by @congwang-mk in #231
procfs: virtualize namespace files under every per-task spelling by @congwang-mk in #247
procfs: serve listed /proc/self reads to every task by @congwang-mk in #233
seccomp: vet the /proc target of an open done for a deny by @congwang-mk in #248
seccomp: open for the caller when an open is done for a deny by @congwang-mk in #250
netlink: answer non-dump RTM_GETLINK for lo by @congwang-mk in #245
Track the process groups a sandbox creates by @congwang-mk in #254
sandbox: kill the process group when the main process exits by @congwang-mk in #253
procfs: never grant Landlock what the handlers hide, and a faster open path by @congwang-mk in #255
control: use SEM_UNDO for sandbox name ownership and discovery by @congwang-mk in #256
seccomp: refuse clone3 and simplify netlink socket tracking by @congwang-mk in #257
procfs: serve listed writes to every task by @congwang-mk in #258
chroot: open COW layers confined to their roots by @congwang-mk in #260
procfs: isolate the sandbox network view by @congwang-mk in #259

Full Changelog: v0.8.8...v0.8.9