profiles: enable seccomp globally

Upstream has enabled this flag, should be fine for us too but do so
prior to syncing with upstream to test for sure.

Keeping seccomp disabled for bind-tools since it breaks
cross-compilation and fixing it isn't very important.

sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/use.mask

@@ -0,0 +1,2 @@
+# TODO(marineam): remove after portage-stable/profiles is updated.
+-seccomp

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults

@@ -32,6 +32,10 @@ USE="${USE} -zeroconf"
 # No need for OpenMP support in GCC and other apps
 USE="${USE} -openmp"
 
+# Test enabling seccomp globally prior to syncing other profile changes.
+# TODO(marineam): remove after portage-stable/profiles is updated.
+USE="${USE} seccomp"
+
 # Set SELinux policy
 POLICY_TYPES="targeted mcs mls"
 

sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use

@@ -41,7 +41,8 @@ app-shells/bash -net vanilla
 # disable nss utilities
 dev-libs/nss -utils
 
-# enable seccomp support in docker
-app-emulation/docker seccomp
-app-emulation/containerd seccomp
+# needed by docker
 sys-libs/libseccomp static-libs
+
+# bind-tools' configure script breaks when cross-compiling with seccomp enabled
+net-dns/bind-tools -seccomp