Index: head/share/mk/bsd.README
===================================================================
--- head/share/mk/bsd.README
+++ head/share/mk/bsd.README
@@ -566,7 +566,7 @@
 	all:
 		build the test programs.
 	check:
-		runs the test programs from CHECKDIR with kyua test.
+		runs the test programs with kyua test.
 
 		The beforecheck and aftercheck targets will be invoked, if
 		defined, to execute commands before and after the realcheck
@@ -574,8 +574,6 @@
 
 		The devel/kyua package must be installed before invoking this
 		target.
-
-		See CHECKDIR for more details.
 	clean:
 		remove the test programs and any object files.
 	cleandir:
@@ -602,10 +600,6 @@
 ATF_TESTS_CXX	The names of the ATF C++ test programs to build.
 
 ATF_TESTS_SH	The names of the ATF sh test programs to build.
-
-CHECKDIR	The directory that 'make check' executes tests from.
-
-		The value of CHECKDIR defaults to .OBJDIR.
 
 KYUAFILE	If 'auto' (the default), generate a Kyuafile out of the
 		test programs defined in the Makefile.  If 'yes', then a
Index: head/share/mk/bsd.lib.mk
===================================================================
--- head/share/mk/bsd.lib.mk
+++ head/share/mk/bsd.lib.mk
@@ -442,6 +442,12 @@
 .endfor
 .endif
 
+.if defined(HAS_TESTS)
+MAKE+=			MK_MAKE_CHECK_USE_SANDBOX=yes
+SUBDIR_TARGETS+=	check
+TESTS_LD_LIBRARY_PATH+=	${.OBJDIR}
+.endif
+
 .include <bsd.dep.mk>
 .include <bsd.clang-analyze.mk>
 .include <bsd.obj.mk>
Index: head/share/mk/bsd.opts.mk
===================================================================
--- head/share/mk/bsd.opts.mk
+++ head/share/mk/bsd.opts.mk
@@ -55,6 +55,7 @@
     INCLUDES \
     INSTALLLIB \
     KERBEROS \
+    MAKE_CHECK_USE_SANDBOX \
     MAN \
     MANCOMPRESS \
     NIS \
@@ -63,6 +64,7 @@
     PROFILE \
     SSP \
     SYMVER \
+    TESTS \
     TOOLCHAIN \
     WARNS
 
@@ -73,6 +75,7 @@
     STALE_STAGED
 
 __DEFAULT_DEPENDENT_OPTIONS = \
+    MAKE_CHECK_USE_SANDBOX/TESTS \
     STAGING_MAN/STAGING \
     STAGING_PROG/STAGING \
     STALE_STAGED/STAGING \
Index: head/share/mk/bsd.prog.mk
===================================================================
--- head/share/mk/bsd.prog.mk
+++ head/share/mk/bsd.prog.mk
@@ -301,6 +301,13 @@
 .include <bsd.man.mk>
 .endif
 
+.if defined(HAS_TESTS)
+MAKE+=			MK_MAKE_CHECK_USE_SANDBOX=yes
+SUBDIR_TARGETS+=	check
+TESTS_LD_LIBRARY_PATH+=	${.OBJDIR}
+TESTS_PATH+=		${.OBJDIR}
+.endif
+
 .if defined(PROG)
 OBJS_DEPEND_GUESS+= ${SRCS:M*.h}
 .endif
Index: head/share/mk/src.opts.mk
===================================================================
--- head/share/mk/src.opts.mk
+++ head/share/mk/src.opts.mk
@@ -160,7 +160,6 @@
     TCP_WRAPPERS \
     TCSH \
     TELNET \
-    TESTS \
     TEXTPROC \
     TFTP \
     TIMED \
Index: head/share/mk/suite.test.mk
===================================================================
--- head/share/mk/suite.test.mk
+++ head/share/mk/suite.test.mk
@@ -8,6 +8,8 @@
 .error suite.test.mk cannot be included directly.
 .endif
 
+.include <bsd.opts.mk>
+
 # Name of the test suite these tests belong to.  Should rarely be changed for
 # Makefiles built into the FreeBSD src tree.
 TESTSUITE?= FreeBSD
@@ -75,8 +77,6 @@
 	@mv ${.TARGET}.tmp ${.TARGET}
 .endif
 
-CHECKDIR?=	${DESTDIR}${TESTSDIR}
-
 KYUA= ${LOCALBASE}/bin/kyua
 
 # Definition of the "make check" target and supporting variables.
@@ -99,4 +99,26 @@
 		echo "LOCALBASE=\"${LOCALBASE}\""; \
 		false; \
 	fi
-	@${KYUA} test -k ${CHECKDIR}/Kyuafile
+	@env ${TESTS_ENV:Q} ${KYUA} test -k ${DESTDIR}${TESTSDIR}/Kyuafile
+
+MAKE_CHECK_SANDBOX_DIR=	${.OBJDIR}/checkdir
+CLEANDIRS+=	${MAKE_CHECK_SANDBOX_DIR}
+
+.if ${MK_MAKE_CHECK_USE_SANDBOX} != "no" && make(check)
+DESTDIR:=	${MAKE_CHECK_SANDBOX_DIR}
+
+beforecheck:
+.for t in clean depend all
+	@cd ${.CURDIR} && ${MAKE} $t
+.endfor
+	@cd ${SRCTOP} && ${MAKE} hierarchy DESTDIR=${DESTDIR}
+	@cd ${.CURDIR} && ${MAKE} install \
+	    DESTDIR=${DESTDIR}
+
+# NOTE: this is intentional to ensure that "make check" can be run multiple
+#       times. "aftercheck" won't be run if "make check" fails, is interrupted,
+#       etc.
+aftercheck:
+	@cd ${.CURDIR} && ${MAKE} clean
+
+.endif
Index: head/tools/build/options/WITHOUT_MAKE_CHECK_USE_SANDBOX
===================================================================
--- head/tools/build/options/WITHOUT_MAKE_CHECK_USE_SANDBOX
+++ head/tools/build/options/WITHOUT_MAKE_CHECK_USE_SANDBOX
@@ -0,0 +1,10 @@
+.\" $FreeBSD$
+Set to not execute
+.Dq Li "make check"
+in limited sandbox mode.
+This option should be paired with
+.Va WITH_INSTALL_AS_USER
+if executed as an unprivileged user.
+See
+.Xr tests 7
+for more details.