sys_trace_seccomp

seccomp--and presumably some other security features--can deliver a sigsys when operations are blocked.