runInLinuxVM: permission deny when trying to copy files from /nix/store to $out

Describe the bug

runInLinuxVM makes file copying from the Nix store to $out during the build process fail like this:

cp: cannot create regular file '/nix/store/wl53956bqjl6ymd28lqx187pmwqszvgf-hello-nested/hello': Permission denied

Steps To Reproduce

Steps to reproduce the behavior:

cd path/to/nixpkgs
This one runs successfully: nix-build --no-out-link -E 'let lib = import ./lib; pkgs = import ./. { localSystem = "x86_64-linux"; }; in pkgs.runCommand "hello-nested" { } "mkdir -p $out; ${pkgs.tree}/bin/tree -a $out; stat ${pkgs.hello}/bin/hello; cp ${pkgs.hello}/bin/hello $out"'
This one fails: nix-build --no-out-link -E 'let lib = import ./lib; pkgs = import ./. { localSystem = "x86_64-linux"; }; in pkgs.vmTools.runInLinuxVM (pkgs.runCommand "hello-nested" { } "mkdir -p $out; ${pkgs.tree}/bin/tree -a $out; stat ${pkgs.hello}/bin/hello; cp ${pkgs.hello}/bin/hello $out")'

Build log:


this derivation will be built:
/nix/store/6xbf63lvjflcfhxc6whzqq8n2s1i7b05-hello-nested.drv
building '/nix/store/6xbf63lvjflcfhxc6whzqq8n2s1i7b05-hello-nested.drv'...
cSeaBIOS (version rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org)

iPXE (http://ipxe.org) 00:03.0 CA00 PCI2.10 PnP PMM+1EFD0E50+1EF30E50 CA00

Booting from ROM... Probing EDD (edd=off to disable)... oc[ 0.110877] sgx: There are zero EPC sections. loading kernel modules... [ 0.188481] Invalid ELF header magic: != ELF [ 0.191296] Invalid ELF header magic: != ELF [ 0.194280] Invalid ELF header magic: != ELF [ 0.196291] Invalid ELF header magic: != ELF [ 0.198334] Invalid ELF header magic: != ELF [ 0.247114] Invalid ELF header magic: != ELF [ 0.249700] Invalid ELF header magic: != ELF [ 0.255301] Invalid ELF header magic: != ELF [ 0.258524] Invalid ELF header magic: != ELF [ 0.260882] Invalid ELF header magic: != ELF [ 0.263839] Invalid ELF header magic: != ELF [ 0.276735] Invalid ELF header magic: != ELF [ 0.279200] Invalid ELF header magic: != ELF [ 0.281090] Invalid ELF header magic: != ELF [ 0.283462] Invalid ELF header magic: != ELF [ 0.285785] Invalid ELF header magic: != ELF [ 0.340156] Invalid ELF header magic: != ELF [ 0.349978] Invalid ELF header magic: != ELF [ 0.358162] Invalid ELF header magic: != ELF [ 0.363736] Invalid ELF header magic: != ELF [ 0.369319] Invalid ELF header magic: != ELF [ 0.373474] Invalid ELF header magic: != ELF mounting Nix store... mounting host's temporary directory... starting stage 2 (/nix/store/sgkjxjfw6dkgv7676vckh1nnkc4diaid-vm-run-stage2) /nix/store/wl53956bqjl6ymd28lqx187pmwqszvgf-hello-nested

0 directories, 0 files File: /nix/store/1pry7pnxqig0n2pkl4mnhl76qlmkk6vi-hello-2.12.1/bin/hello Size: 55656 Blocks: 112 IO Block: 131072 regular file Device: 0,24 Inode: 7881465 Links: 1 Access: (0555/-r-xr-xr-x) Uid: (65534/ UNKNOWN) Gid: (65534/ UNKNOWN) Access: 2023-04-05 20:30:02.082955430 +0000 Modify: 1970-01-01 00:00:01.000000000 +0000 Change: 2023-04-03 20:38:31.679184484 +0000 Birth: - cp: cannot create regular file '/nix/store/wl53956bqjl6ymd28lqx187pmwqszvgf-hello-nested/hello': Permission denied [ 1.000608] reboot: Power down error: builder for '/nix/store/6xbf63lvjflcfhxc6whzqq8n2s1i7b05-hello-nested.drv' failed with exit code 1; last 10 log lines:

File: /nix/store/1pry7pnxqig0n2pkl4mnhl76qlmkk6vi-hello-2.12.1/bin/hello Size: 55656 Blocks: 112 IO Block: 131072 regular file Device: 0,24 Inode: 7881465 Links: 1 Access: (0555/-r-xr-xr-x) Uid: (65534/ UNKNOWN) Gid: (65534/ UNKNOWN) Access: 2023-04-05 20:30:02.082955430 +0000 Modify: 1970-01-01 00:00:01.000000000 +0000 Change: 2023-04-03 20:38:31.679184484 +0000 Birth: - cp: cannot create regular file '/nix/store/wl53956bqjl6ymd28lqx187pmwqszvgf-hello-nested/hello': Permission denied [ 1.000608] reboot: Power down For full logs, run 'nix log /nix/store/6xbf63lvjflcfhxc6whzqq8n2s1i7b05-hello-nested.drv'.

Expected behavior

As stated in the comment above the runInLinuxVM implementation, any pure Nix derivation should run unmodified. Specifically, the two build commands in the reproduction steps should all pass.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

Notify maintainers

@alyssais @roberth (Not sure who are the maintainers. I just browsed the history and made a guess.)

Metadata

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.

[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 5.15.103, NixOS, 22.11 (Raccoon), 22.11.20230318.08ef7dc`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.11.1`
 - nixpkgs: `/nix/store/rksi78f7vq2xrfghg6jfg1r5dsa8lbv7-source`

NixOS / nixpkgs