Describe the bug

Starting with Nix 2.4 and later, attempting to run nix --version (or nix-env --version) from within the macOS sandbox aborts with an uncaught exception caused by a deny file-read-metadata. The particular path it fails on differs between Nix 2.4 and Nix 2.5.1 but both fail. Nix 2.4 is failing on trying to read /nix/var/nix/profiles/per-user/root/channels/nixpkgs

Steps To Reproduce

1. Turn on the sandbox in /etc/nix/nix.conf (in my case I have sandbox = relaxed but true works too)
2. nix build --impure --expr 'with import (builtins.getFlake "github:NixOS/nixpkgs/77fda7f672726e1a95c8cd200f27bccfc86c870b") {}; runCommand "foo" { nativeBuildInputs = [ nix ]; } "nix --version"' (the rev here is the current nixpkgs/nixpkgs-unstable)
3. Also try nix build --impure --expr 'with import (builtins.getFlake "github:NixOS/nixpkgs/77fda7f672726e1a95c8cd200f27bccfc86c870b") {}; runCommand "foo" { nativeBuildInputs = [ nix_2_4 ]; } "nix --version"' for Nix 2.4

Nix 2.5.1

Output:

libc++abi: terminating with uncaught exception of type nix::SysError: error: getting status of /System/Library/LaunchDaemons/com.apple.oahd.plist: Operation not permitted
/private/tmp/nix-build-foo.drv-0/.attr-0l2nkwhif96f51f4amnlf414lhl4rv9vh8iffyp431v6s28gsr90: line 1: 91536 Abort trap: 6           nix --version

The system log lists a number of sandbox denies, but the final one is

error	16:29:03.475029-0800	kernel	Sandbox: nix(91536) deny(1) file-read-metadata /System/Library/LaunchDaemons/com.apple.oahd.plist

Nix 2.4

Output:

libc++abi: terminating with uncaught exception of type nix::SysError: error: getting status of /nix/var/nix/profiles/per-user/root/channels/nixpkgs: Operation not permitted
/private/tmp/nix-build-foo.drv-0/.attr-0l2nkwhif96f51f4amnlf414lhl4rv9vh8iffyp431v6s28gsr90: line 1: 91674 Abort trap: 6           nix --version

Again a number of denies in the system log, but the final one is

error	16:34:55.228713-0800	kernel	Sandbox: nix(91707) deny(1) file-read-metadata /nix/var/nix/profiles/per-user/root/channels

Expected behavior

This should work.

nix --version output

I've tested both with Nix 2.4 and Nix 2.5.1 as the driver, and the above repro steps use both Nix 2.4 and Nix 2.5.1 in the build command.

Additional context

I'm using a multi-user install on macOS. I don't know if anything differs in a single-user install.