linux: enable seccomp sandbox by default

build/common.gypi

 # Copyright (c) 2010 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # IMPORTANT:
 # Please don't directly include this file if you are building via gyp_chromium,
 # since gyp_chromium is automatically forcing its inclusion.
 {
   'variables': {
     # .gyp files or targets should set chromium_code to 1 if they build
@@ skipping 190 matching lines @@
 
     # Strip the binary after dumping symbols.
     'linux_strip_binary%': 0,
 
     # Enable TCMalloc.
     'linux_use_tcmalloc%': 1,
 
     # Disable TCMalloc's heapchecker.
     'linux_use_heapchecker%': 0,
 
+    # Turn on seccomp sandbox by default.
+    # (Note: this is disabled for official builds.)
+    'linux_use_seccomp_sandbox%': 1,
+
     # Set to select the Title Case versions of strings in GRD files.
     'use_titlecase_in_grd_files%': 0,
 
     # Used to disable Native Client at compile time, for platforms where it
     # isn't supported
     'disable_nacl%': 0,
 
     # Set Thumb compilation flags.
     'arm_thumb%': 0,
 
@@ skipping 729 matching lines @@
           }],
           ['no_strict_aliasing==1', {
             'cflags': [
               '-fno-strict-aliasing',
             ],
           }],
           ['linux_breakpad==1', {
             'cflags': [ '-gstabs' ],
             'defines': ['USE_LINUX_BREAKPAD'],
           }],
+          ['linux_use_seccomp_sandbox==1 and buildtype!="Official"', {
+            'defines': ['USE_SECCOMP_SANDBOX'],
+          }],
           ['library=="shared_library"', {
             # When building with shared libraries, remove the visiblity-hiding
             # flag.
             'cflags!': [ '-fvisibility=hidden' ],
             'conditions': [
               ['target_arch=="x64" or target_arch=="arm"', {
                 # Shared libraries need -fPIC on x86-64 and arm
                 'cflags': ['-fPIC']
               }]
             ],
@@ skipping 272 matching lines @@
     # and therefore SYMROOT, needs to be set at the project level.
     'SYMROOT': '<(DEPTH)/xcodebuild',
   },
 }
 
 # Local Variables:
 # tab-width:2
 # indent-tabs-mode:nil
 # End:
 # vim: set expandtab tabstop=2 shiftwidth=2: