@mattst88 Why guess when you can profile? ;)
Without AT_EACCESS in flags, faccessat really doesn't scale due to how access_override_creds works:
https://gist.github.com/amonakov/9281bba3974d931fe500eaad0369568c
The sandbox could probably use AT_EACCESS (which makes faccessat more efficient than fstatat).