Once filesystem policies for seccomp-bpf filtering roll out, violations of the policy will trigger silent failures in the calling code. This can cause breakage that may be hard to trace back to sandboxing. The current patches log violations in DEBUG mode by default, but we probably want at least an environmental flag to enable the logging in release mode as well.