Avoid all library calls (including calls to destructors) after enabling the sandbox.

sandbox/linux/seccomp-bpf/sandbox_bpf.h

Index: sandbox/linux/seccomp-bpf/sandbox_bpf.h
diff --git a/sandbox/linux/seccomp-bpf/sandbox_bpf.h b/sandbox/linux/seccomp-bpf/sandbox_bpf.h
index 3501e62807ffdb77882c354efe33b7625fb4e64b..82e4656b2df9b9df2c92bb2cc8ecc1eecca29cfd 100644
--- a/sandbox/linux/seccomp-bpf/sandbox_bpf.h
+++ b/sandbox/linux/seccomp-bpf/sandbox_bpf.h
@@ -224,13 +224,14 @@ class Sandbox {
   static int getProcFd() { return proc_fd_; }
 
  private:
+  typedef std::vector<struct sock_filter> Program;
+
   static ErrorCode probeEvaluator(int signo);
   static bool      kernelSupportSeccompBPF(int proc_fd);
-
-  static bool    isSingleThreaded(int proc_fd);
-  static bool    disableFilesystem();
-  static void    installFilter();
-  static void    sigSys(int nr, siginfo_t *info, void *void_context);
+  static bool      isSingleThreaded(int proc_fd);
+  static bool      disableFilesystem();
+  static void      installFilter();
+  static void      sigSys(int nr, siginfo_t *info, void *void_context);
 
   static bool          suppressLogging_;
   static SandboxStatus status_;