linux: enable seccomp sandbox by default

build/common.gypi

 # Copyright (c) 2010 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # IMPORTANT:
 # Please don't directly include this file if you are building via gyp_chromium,
 # since gyp_chromium is automatically forcing its inclusion.
 {
   'variables': {
     # .gyp files or targets should set chromium_code to 1 if they build
@@ skipping 265 matching lines @@
     # Disable TCMalloc's debugallocation.
     'linux_use_debugallocation%': 0,
 
     # Disable TCMalloc's heapchecker.
     'linux_use_heapchecker%': 0,
 
     # Disable shadow stack keeping used by heapcheck to unwind the stacks
     # better.
     'linux_keep_shadow_stacks%': 0,
 
-    # Set to 1 to turn on seccomp sandbox by default.
-    # (Note: this is ignored for official builds.)
-    'linux_use_seccomp_sandbox%': 0,
+    # Turn on seccomp sandbox by default.
+    # (Note: this is disabled for official builds.)
+    'linux_use_seccomp_sandbox%': 1,
 
     # Set to 1 to link against libgnome-keyring instead of using dlopen().
     'linux_link_gnome_keyring%': 0,
 
     # Set to select the Title Case versions of strings in GRD files.
     'use_titlecase_in_grd_files%': 0,
 
     # Used to disable Native Client at compile time, for platforms where it
     # isn't supported
     'disable_nacl%': 0,
@@ skipping 1217 matching lines @@
     # and therefore SYMROOT, needs to be set at the project level.
     'SYMROOT': '<(DEPTH)/xcodebuild',
   },
 }
 
 # Local Variables:
 # tab-width:2
 # indent-tabs-mode:nil
 # End:
 # vim: set expandtab tabstop=2 shiftwidth=2: