It is one of these, but we do not know which one it is

          DevicePolicy = "closed";
          LockPersonality = true;
          MemoryDenyWriteExecute = true;
          NoNewPrivileges = true;
          PrivateDevices = false; # hides acceleration devices
          PrivateTmp = true;
          PrivateUsers = true;
          ProcSubset = "all"; # /proc/meminfo
          ProtectClock = true;
          ProtectControlGroups = true;
          ProtectHome = true;
          ProtectHostname = true;
          ProtectKernelLogs = true;
          ProtectKernelModules = true;
          ProtectKernelTunables = true;
          ProtectProc = "invisible";
          ProtectSystem = "strict";
          RemoveIPC = true;
          RestrictNamespaces = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          RestrictAddressFamilies = [
            "AF_INET"
            "AF_INET6"
            "AF_UNIX"
          ];
          SupplementaryGroups = [ "render" ]; # for rocm to access /dev/dri/renderD* devices
          SystemCallArchitectures = "native";
          SystemCallFilter = [
            "@system-service @resources"
            "~@privileged"
          ];
          UMask = "0077";

In reply to @connorbaker:matrix.org
If you all wanted to run a NixOS VM test in which a VM actually ran nix build, how would you prepopulate the VM store so it has all the necessary build dependencies (sources, etc.).
Alternatively, if you wanted to run NixOS VM tests without the sandbox (so the test itself wouldn’t produce a store path on successful run) how would you do that?

1. You can add the inputDerivation of whatever you want to build to the VM, IIRC there's an option to add paths to copy into the VM's Nix database

2. You can use the driverInteractive version and run run_tests() (or maybe there's even just driver?)