Ensure that chrome_sandbox doesn't have -rpath=$ORIGIN.

build/config/gcc/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/compiler/compiler.gni")
 import("//build/config/sanitizers/sanitizers.gni")
 import("//build/config/sysroot.gni")
 import("//build/toolchain/toolchain.gni")
 
 # This config causes functions not to be automatically exported from shared
@@ skipping 53 matching lines @@
     ldflags = [
       # Want to pass "\$". GN will re-escape as required for ninja.
       "-Wl,-rpath=\$ORIGIN/${rpath_link}",
       "-Wl,-rpath-link=${rpath_link}",
     ]
   }
 }
 
 # Settings for executables.
 config("executable_ldconfig") {
+  # WARNING! //sandbox/linux:chrome_sandbox will not pick up this
+  # config, because it is a setuid binary that needs special flags.
+  # If you add things to this config, make sure you check to see
+  # if they should be added to that target as well.

[Dirk Pranke, 2016/06/09 00:41:49]

In theory I could split this out into two configs and have them both be applied
in BUILDCONFIG.gn, or at least have the logic all live in a single file, but we
only need this in one place and there's really only one flag that I think might
matter at all, so it seemed like overkill.

Let me know if you disagree.

   ldflags = []
   if (is_android) {
     ldflags += [
       "-Bdynamic",
       "-Wl,-z,nocopyreloc",
     ]
   } else {
     # See the rpath_for... config above for why this is necessary for component
     # builds. Sanitizers use a custom libc++ where this is also necessary.
     if (is_component_build || using_sanitizer) {
@@ skipping 26 matching lines @@
       # and the new DT_RUNPATH doesn't work without --no-as-needed flag.
       "-Wl,--disable-new-dtags",
     ]
   }
 }
 
 config("no_exceptions") {
   cflags_cc = [ "-fno-exceptions" ]
   cflags_objcc = cflags_cc
 }