linux: enable seccomp sandbox by default

build/common.gypi

Index: build/common.gypi
diff --git a/build/common.gypi b/build/common.gypi
index 3b8f20e8c20bbb279fed1b19ad91f3779c59c65d..2d0902a53678b94a1d22007cf1a7b1ac01781caf 100644
--- a/build/common.gypi
+++ b/build/common.gypi
@@ -208,6 +208,10 @@
     # Disable TCMalloc's heapchecker.
     'linux_use_heapchecker%': 0,
 
+    # Turn on seccomp sandbox by default.
+    # (Note: this is disabled for official builds.)
+    'linux_use_seccomp_sandbox%': 1,
+
     # Set to select the Title Case versions of strings in GRD files.
     'use_titlecase_in_grd_files%': 0,
 
@@ -957,6 +961,9 @@
             'cflags': [ '-gstabs' ],
             'defines': ['USE_LINUX_BREAKPAD'],
           }],
+          ['linux_use_seccomp_sandbox==1 and buildtype!="Official"', {
+            'defines': ['USE_SECCOMP_SANDBOX'],
+          }],
           ['library=="shared_library"', {
             # When building with shared libraries, remove the visiblity-hiding
             # flag.