Avoid all library calls (including calls to destructors) after enabling the sandbox.

sandbox/linux/seccomp-bpf/sandbox_bpf.h

Index: sandbox/linux/seccomp-bpf/sandbox_bpf.h
diff --git a/sandbox/linux/seccomp-bpf/sandbox_bpf.h b/sandbox/linux/seccomp-bpf/sandbox_bpf.h
index 0d8b754c1044fe80b025de9aca52c479b56bd640..e4c8149a3b3356005cf1beb9cb4da35ed196655c 100644
--- a/sandbox/linux/seccomp-bpf/sandbox_bpf.h
+++ b/sandbox/linux/seccomp-bpf/sandbox_bpf.h
@@ -230,13 +230,14 @@ class Sandbox {
   static int getProcFd() { return proc_fd_; }
 
  private:
+  typedef std::vector<struct sock_filter> Program;
+
   static ErrorCode probeEvaluator(int signo);
   static bool      kernelSupportSeccompBPF(int proc_fd);
-
-  static bool    isSingleThreaded(int proc_fd);
-  static bool    disableFilesystem();
-  static void    installFilter();
-  static void    sigSys(int nr, siginfo_t *info, void *void_context);
+  static bool      isSingleThreaded(int proc_fd);
+  static bool      disableFilesystem();
+  static void      installFilter();
+  static void      sigSys(int nr, siginfo_t *info, void *void_context);
 
   static bool          suppressLogging_;
   static SandboxStatus status_;