linux: enable seccomp sandbox by default

chrome/browser/zygote_host_linux.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/zygote_host_linux.h"
 
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
@@ skipping 85 matching lines @@
     cmd_line.AppendSwitchWithValue(switches::kEnableLogging,
                                    browser_command_line.GetSwitchValueASCII(
                                        switches::kEnableLogging));
   }
   if (browser_command_line.HasSwitch(switches::kUserDataDir)) {
     // Append with value so logs go to the right file.
     cmd_line.AppendSwitchWithValue(switches::kUserDataDir,
                                    browser_command_line.GetSwitchValueASCII(
                                        switches::kUserDataDir));
   }
-  if (browser_command_line.HasSwitch(switches::kEnableSeccompSandbox)) {
+#if defined(USE_SECCOMP_SANDBOX)
+  if (browser_command_line.HasSwitch(switches::kDisableSeccompSandbox))
+    cmd_line.AppendSwitch(switches::kDisableSeccompSandbox);
+#else
+  if (browser_command_line.HasSwitch(switches::kEnableSeccompSandbox))
     cmd_line.AppendSwitch(switches::kEnableSeccompSandbox);
-  }
+#endif
 
   sandbox_binary_ = sandbox_cmd.c_str();
   struct stat st;
 
   if (!sandbox_cmd.empty() && stat(sandbox_binary_.c_str(), &st) == 0) {
     if (access(sandbox_binary_.c_str(), X_OK) == 0 &&
         (st.st_uid == 0) &&
         (st.st_mode & S_ISUID) &&
         (st.st_mode & S_IXOTH)) {
       using_suid_sandbox_ = true;
@@ skipping 155 matching lines @@
       !read_pickle.ReadBool(&iter, &tmp_child_exited)) {
     LOG(WARNING) << "Error parsing DidProcessCrash response from zygote.";
     return false;
   }
 
   if (child_exited)
     *child_exited = tmp_child_exited;
 
   return did_crash;
 }