aaa.sh

$ nix-build foo.nix -A hello
/nix/store/xmlhf8g9hgjycwwh7ac4i44ayc3wa9zg-hello
$ nix-build foo.nix -A menosandbox
these derivations will be built:
  /nix/store/g95122z1j2i9hh24irapybc4pmz36fsa-evil.drv
building '/nix/store/g95122z1j2i9hh24irapybc4pmz36fsa-evil.drv'...
chmod: changing permissions of '/nix/store/xmlhf8g9hgjycwwh7ac4i44ayc3wa9zg-hello/bin/hello': Operation not permitted
builder for '/nix/store/g95122z1j2i9hh24irapybc4pmz36fsa-evil.drv' failed with exit code 1

$ /nix/store/xmlhf8g9hgjycwwh7ac4i44ayc3wa9zg-hello/bin/hello

foo.nix

with import <nixpkgs> {};

rec {
  hello = runCommand "hello" {} ''
    mkdir -p $out/bin
    cat <<-EOF > $out/bin/hello
    #!/usr/bin/env bash
    echo "Hello World!"
    EOF
    chmod +x $out/bin/hello
  '';

  menosandbox = runCommand "evil" { inherit hello; } ''
    chmod -x $hello/bin/hello
  '';
}