Code change:
Describe the bug On NixOS and some other Linux distributions like Fedora is world-read-writable: This is not the case on other systems like Ubuntu and others from the Debian family, which instruct their users to get access to by adding user accounts to the group: When building a derivation that uses , like for example NixOS Tests or on such systems with Multi-User Nix and KVM installed, the build fails with an error message similar to this when booting the VM: To fix this users might try to add the users to the group, which has no effect because of the build sandbox. The only effective fix seems to be changing the permissions for to be world-read-writable: This fix is difficult to find for users that are not already very familiar with KVM (like me). Proposed fix Nix should detect the situation where a build is run in the sandbox and the permissions for are going to lead to a failure and emit a warning or build error that points people towards a working fix they can manually run. Potentially it would even be possible/desirable for the build to proceed without KVM/hardware acceleration, but I'm not sure because of the terrible performance impact. To Reproduce Steps to reproduce the behavior: a system that supports hardware virtualization ubuntu or another affected distro KVM (see for example ) Multi-User Nix a derivation that uses You can also manually change the permissions to to reproduce the issue. Expected behavior A more user-friendly failure mode, like what I wrote under proposed fix. Additional context There are also documented examples of other users running into this: and maybe also There is some relevant discussion here about the security impact of that permission change: Notify maintainers There are a lot of other people in git blame. I you two for now. Hope that's OK. Maintainer information:
VMs already proceed without hardware acceleration if KVM is not installed at all. I tested this with NixOS Tests on with NixOS. At least for that case the relevant code I found is this: I will submit a PR which fixes this check so that VMs also proceed without KVM in the scenario described above. I am not 100 % sure if that is the best fix and if it should close this issue, because firstly I think it would be good to make users aware when KVM is not enabled, when the hardware/software support would allow it: because it's not installed or because the permissions are broken. What would be a good way to emit such warnings? Secondly I am also a bit confused about there being flags for hardware acceleration here as well: This makes it seem like is treated inconsistently with other architectures and I don't understand why.

Related discussion:
text: else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'"; qemuBinary = qemuPkg: { <del> x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu max"; </del> <ins> x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu qemu64"; </ins> armv7l-linux = "${qemuPkg}/bin/qemu-system-arm -enable-kvm -machine virt -cpu host"; aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -enable-kvm -machine virt,gic-version=host -cpu host"; powerpc64le-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";