sanitize_fds: changed to use close_range(2) if available (by Arseny Maslennikov).
hasher-useradd: added new option: -r/--system (by Arseny Maslennikov).
Added hidepid=2 to builtin /proc mount options.

x11_parse_display: fixed hostname:displaynumber separation.
Do not issue the warning about X11 auth data mismatch when
Added /sys/fs/cgroup to the hardcoded fstab.
Removed mount, umount, makedev, maketty, and makeconsole
Introduced allowed_devices configuration option.

chrootuid: Implemented /dev/pts/ptmx support.
Hardened default mount options for builtin mount points.
Changed builtin devpts mount options to use "newinstance" feature.

Allowed group writable sticky directories to be used as
Added /dev/shm to the list of built-in mount points.

Made X11 forwarding work with network isolation enabled.
Allowed mount points to be owned by the first pseudouser
Hardened default mount options for built-in mount points.
Fixed purging IPC objects created by the first pseudouser.

Implemented mount namespace isolation.

Made IPC namespace isolation controllable by share_ipc environment

Merge "killuid1" and "killuid2" commands into new "killuid" command.

chrootuid: if unshare(2) fails with EPERM, treat it like ENOSYS.

Implemented System V IPC namespace isolation.
Implemented UTS namespace isolation.

Made some error messages a bit more specific.
By default, when network isolation is not enabled explicitly,

Handle child stderr before stdout.
Implemented network isolation (by Kirill A. Shutemov).

hasher-priv.conf.5.in: Updated information about default prefix values.
Fixed new compilation warnings about dereferencing type-punned pointers.

Extended command options syntax to allow zero subconfig

Changed work limits type to unsigned long.
If bind to /dev/log failed, do not attempt to chmod it.

hasher-useradd: Include subconfig number to default satellite user names.
Fixed build with fresh gcc.