Why would root be able to run a file, but another user gets "cannot execute binary file" in the same session?

Help
1

test.nix:

let
  pkgs = import (builtins.fetchTarball {
    name = "nixos-unstable-2024-07-27";
    url = "https://github.com/nixos/nixpkgs/archive/5ad6a14c6bf098e98800b091668718c336effc95.tar.gz";
    sha256 = "0qv7lfci4k1k5jh26hrx3kq1nm377pwg85vi0lixzy2f4jbn7ga9";
  }) { };
  nixosLib = import (pkgs.path + "/nixos/lib") { };

  machineName = "machine";
  username = "anybody";
in
nixosLib.runTest {
  hostPkgs = pkgs;

  name = "android-backup";

  nodes."${machineName}" =
    { config, ... }:
    {
      imports = [ ../modules/android-backup.nix ];
      programs.adb.enable = true;
      system.stateVersion = "24.05";
      users.users.default = {
        name = username;
        extraGroups = [ config.users.groups.adbusers.name ];
        isNormalUser = true;
      };
    };

  testScript = ''
    ${machineName}.start()

    ${machineName}.succeed("adb help")
    ${machineName}.succeed("su --login ${username} adb help")
  '';
}

The first adb command succeeds, but the second one, run by another user, fails:

/run/current-system/sw/bin/adb: cannot execute binary file

What’s going on? I’ve checked a few obvious things:

The user is a member of adbusers:

$ groups anybody
anybody : users adbusers

adb is executable by everyone:

$ ls -l /run/current-system/sw/bin/adb
lrwxrwxrwx 8 root root 72 Jan  1  1970 /run/current-system/sw/bin/adb -> /nix/store/k2r8z4jd7nxnpv1b4q4l3dp0g746wk11-android-tools-35.0.1/bin/adb
$ ls -l /nix/store/k2r8z4jd7nxnpv1b4q4l3dp0g746wk11-android-tools-35.0.1/bin/adb
-r-xr-xr-x 2 root root 3684232 Jan  1  1970 /nix/store/k2r8z4jd7nxnpv1b4q4l3dp0g746wk11-android-tools-35.0.1/bin/adb

Update: sudo -u anybody adb help does work. Is there something wrong with running a binary executable with su?

Update 2: su --login ${username} --command='adb help' works, so presumably that’s not equivalent to su --login ${username} adb help. man su is no help, so I don’t understand what the difference is.

2

su --login ${username} adb help seems to be equivalent to running su --login ${username} --command="$SHELL adb help", which was not the intention.