Log Message:
Update sandboxctl to 1.1:

Changes in version 1.1
======================

**Released on 2019-01-14.**

* Fixed the `darwin-native` type to allow accessing the Oracle JRE from
  within the sandbox.

* Expose `/usr/local` in `darwin-native` so that third-party software
  installed on the host, such as OSXFUSE, can be found.

* Expose an empty `/private/var/mail` directory within the `darwin-native`
  sandbox so that programs that expect the directory to exist can work.

* Issue 2: Fixed access to the system keychain on `darwin-native`
  sandboxes, which allows, among other things, for HTTPS downloads to
  work properly.

* Issue 4: Fixed the `netbsd-native` type to recognize a `/boot` directory
  and to ignore the lack of `/netbsd`, as is the case for
  NetBSD/evbarm-earmv7hf 7.1 Raspberry Pi images.

* Issue 5: Fixed DNS resolution in `darwin-native` sandboxes, which
  apparently got broken in the macOS Sierra 10.12.4 update because SIP
  now prevents modifying the running mDNSResponder instance.

* Issue 7: Fixed execution of compilers and other Xcode tools within a
  `darwin-native` sandbox starting with High Sierra.  Unfortunately, we
  now require SIP to be disabled for these tools to work.

* Added support for XZ-compressed files to `sandbox_extract`.

* Added support for XZ-compressed release sets to `netbsd-native` and
  `netbsd-release`.  As a side-effect of this change, the
  `NETBSD_RELEASE_SETS` setting in `netbsd-release` now takes a list
  of set names *without* their extension.