linux: turn on -Wextra

sandbox/linux/seccomp/sandbox_impl.h

Index: sandbox/linux/seccomp/sandbox_impl.h
diff --git a/sandbox/linux/seccomp/sandbox_impl.h b/sandbox/linux/seccomp/sandbox_impl.h
index 0a9828376b2ee4edfa16e00542296d5e9c105441..18a359cd216106b6bee4663ce8d051e82c0d9666 100644
--- a/sandbox/linux/seccomp/sandbox_impl.h
+++ b/sandbox/linux/seccomp/sandbox_impl.h
@@ -268,7 +268,7 @@ class Sandbox {
   // Wrapper around "read()" that can deal with partial and interrupted reads
   // and that does not modify the global errno variable.
   static ssize_t read(SysCalls& sys, int fd, void* buf, size_t len) {
-    if (len < 0) {
+    if (static_cast<ssize_t>(len) < 0) {
       sys.my_errno = EINVAL;
       return -1;
     }