diff --git a/bin/ls/tests/Makefile b/bin/ls/tests/Makefile
--- a/bin/ls/tests/Makefile
+++ b/bin/ls/tests/Makefile
@@ -4,5 +4,6 @@
 # should be runnable as !root
 TEST_METADATA.ls_tests+=	required_user="unprivileged"
 TEST_METADATA.ls_tests+=	required_files="/usr/bin/awk /usr/bin/nc /usr/bin/sort"
+TEST_METADATA.ls_tests+=	execenv="host"
 
 .include <bsd.test.mk>
diff --git a/bin/pkill/tests/Makefile b/bin/pkill/tests/Makefile
--- a/bin/pkill/tests/Makefile
+++ b/bin/pkill/tests/Makefile
@@ -23,6 +23,7 @@
 TAP_TESTS_SH+=			pgrep-o_test
 TAP_TESTS_SH+=			pgrep-q_test
 TAP_TESTS_SH+=			pgrep-s_test
+TEST_METADATA.pgrep-s_test+=	execenv="host"
 TAP_TESTS_SH+=			pgrep-t_test
 TAP_TESTS_SH+=			pgrep-v_test
 TAP_TESTS_SH+=			pgrep-x_test
@@ -34,6 +35,7 @@
 TAP_TESTS_SH+=			pkill-g_test
 TAP_TESTS_SH+=			pkill-i_test
 TAP_TESTS_SH+=			pkill-j_test
+TEST_METADATA.pkill-j_test+=	execenv="host"
 TEST_METADATA.pkill-j_test+=	required_user="root"
 TEST_METADATA.pkill-j_test+=	required_programs="jail jls"
 TAP_TESTS_SH+=			pkill-s_test
diff --git a/bin/pwait/tests/Makefile b/bin/pwait/tests/Makefile
--- a/bin/pwait/tests/Makefile
+++ b/bin/pwait/tests/Makefile
@@ -1,4 +1,6 @@
 
 ATF_TESTS_SH=	pwait_test
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/bin/test/tests/Makefile b/bin/test/tests/Makefile
--- a/bin/test/tests/Makefile
+++ b/bin/test/tests/Makefile
@@ -9,4 +9,6 @@
 # requested.  See https://code.google.com/p/kyua/issues/detail?id=6
 TEST_METADATA.legacy_test+= required_user="unprivileged"
 
+TEST_METADATA.legacy_test+= execenv="host"
+
 .include <bsd.test.mk>
diff --git a/lib/atf/libatf-c/tests/detail/Makefile b/lib/atf/libatf-c/tests/detail/Makefile
--- a/lib/atf/libatf-c/tests/detail/Makefile
+++ b/lib/atf/libatf-c/tests/detail/Makefile
@@ -22,6 +22,8 @@
 SRCS.${_T}=	${_T}.c test_helpers.c
 .endfor
 
+TEST_METADATA.fs_test+=	execenv="host"
+
 .for p in process_helpers version_helper
 PROGS+=		${p}
 SRCS.${p}=	${p}.c
diff --git a/lib/libbe/tests/Makefile b/lib/libbe/tests/Makefile
--- a/lib/libbe/tests/Makefile
+++ b/lib/libbe/tests/Makefile
@@ -3,6 +3,8 @@
 
 ATF_TESTS_SH+= be_create
 
+TEST_METADATA+=	execenv="host"
+
 PROGS=		target_prog
 SRCS_target_prog=	target_prog.c
 BINDIR_target_prog=	${TESTSDIR}
diff --git a/lib/libc/tests/c063/Makefile b/lib/libc/tests/c063/Makefile
--- a/lib/libc/tests/c063/Makefile
+++ b/lib/libc/tests/c063/Makefile
@@ -16,6 +16,9 @@
 NETBSD_ATF_TESTS_C+=	unlinkat_test
 NETBSD_ATF_TESTS_C+=	utimensat_test
 
+TEST_METADATA.mknodat_test+=	execenv="host"
+TEST_METADATA.o_search_test+=	execenv="host"
+
 CFLAGS+= -D_INCOMPLETE_XOPEN_C063
 
 .include "../Makefile.netbsd-tests"
diff --git a/lib/libc/tests/gen/Makefile b/lib/libc/tests/gen/Makefile
--- a/lib/libc/tests/gen/Makefile
+++ b/lib/libc/tests/gen/Makefile
@@ -89,7 +89,11 @@
 SRCS.fmtcheck2_test=	fmtcheck_test.c
 SRCS.fnmatch2_test=	fnmatch_test.c
 
-TEST_METADATA.setdomainname_test+=	is_exclusive=true
+TEST_METADATA.nice_test+=		execenv="host"
+TEST_METADATA.posix_spawn_test+=	execenv="host"
+TEST_METADATA.setdomainname_test+=	execenv="host",is_exclusive=true
+TEST_METADATA.sethostname_test+=	execenv="host"
+
 TESTS_SUBDIRS=	execve
 TESTS_SUBDIRS+=	posix_spawn
 
diff --git a/lib/libc/tests/stdio/Makefile b/lib/libc/tests/stdio/Makefile
--- a/lib/libc/tests/stdio/Makefile
+++ b/lib/libc/tests/stdio/Makefile
@@ -34,6 +34,8 @@
 NETBSD_ATF_TESTS_C+=	printf_test
 NETBSD_ATF_TESTS_C+=	scanf_test
 
+TEST_METADATA.fopen_test+=	execenv="host"
+
 LIBADD.eintr_test+=	 md
 LIBADD.printfloat_test+= m
 LIBADD.scanfloat_test+=  m
diff --git a/lib/libc/tests/sys/Makefile b/lib/libc/tests/sys/Makefile
--- a/lib/libc/tests/sys/Makefile
+++ b/lib/libc/tests/sys/Makefile
@@ -10,6 +10,8 @@
 ATF_TESTS_C+=			queue_test
 ATF_TESTS_C+=			sendfile_test
 
+TEST_METADATA.sendfile_test+=	execenv_jail="ip4=inherit ip6=inherit"
+
 # TODO: clone, lwp_create, lwp_ctl, posix_fadvise, recvmmsg,
 # swapcontext
 NETBSD_ATF_TESTS_C+=		access_test
@@ -80,6 +82,29 @@
 TEST_METADATA.msgsnd_test+=	is_exclusive="true"
 TEST_METADATA.msgrcv_test+=	is_exclusive="true"
 
+TEST_METADATA.access_test+=		execenv="host"
+TEST_METADATA.chroot_test+=		execenv="host"
+TEST_METADATA.clock_gettime_test+=	execenv="host"
+TEST_METADATA.getlogin_test+=		execenv="host"
+TEST_METADATA.link_test+=		execenv="host"
+TEST_METADATA.listen_test+=		execenv="host"
+TEST_METADATA.mincore_test+=		execenv="host"
+TEST_METADATA.mkdir_test+=		execenv="host"
+TEST_METADATA.mkfifo_test+=		execenv="host"
+TEST_METADATA.mknod_test+=		execenv="host"
+TEST_METADATA.mlock_test+=		execenv_jail="allow.mlock"
+TEST_METADATA.msgctl_test+=		execenv_jail="allow.sysvipc"
+TEST_METADATA.msgget_test+=		execenv_jail="allow.sysvipc"
+TEST_METADATA.msgsnd_test+=		execenv="host"
+TEST_METADATA.msgrcv_test+=		execenv_jail="allow.sysvipc"
+TEST_METADATA.revoke_test+=		execenv="host"
+TEST_METADATA.setrlimit_test+=		execenv="host"
+TEST_METADATA.setuid_test+=		execenv="host"
+TEST_METADATA.socketpair_test+=		execenv_jail="ip4=inherit ip6=inherit"
+TEST_METADATA.stat_test+=		execenv_jail="ip4=inherit ip6=inherit"
+TEST_METADATA.truncate_test+=		execenv="host"
+TEST_METADATA.unlink_test+=		execenv="host"
+
 .include "../Makefile.netbsd-tests"
 
 SRCS.mlock_test+=		mlock_helper.c
diff --git a/lib/libcasper/services/cap_dns/tests/Makefile b/lib/libcasper/services/cap_dns/tests/Makefile
--- a/lib/libcasper/services/cap_dns/tests/Makefile
+++ b/lib/libcasper/services/cap_dns/tests/Makefile
@@ -3,6 +3,8 @@
 
 ATF_TESTS_C=	dns_test
 
+TEST_METADATA+=	execenv="host",is_exclusive=true
+
 .if ${MK_CASPER} != "no"
 LIBADD+=	casper
 LIBADD+=	cap_dns
diff --git a/lib/libcasper/services/cap_net/tests/Makefile b/lib/libcasper/services/cap_net/tests/Makefile
--- a/lib/libcasper/services/cap_net/tests/Makefile
+++ b/lib/libcasper/services/cap_net/tests/Makefile
@@ -3,6 +3,8 @@
 
 ATF_TESTS_C=	net_test
 
+TEST_METADATA+=	execenv_jail="ip4=inherit ip6=inherit"
+
 .if ${MK_CASPER} != "no"
 LIBADD+=	casper
 LIBADD+=	cap_net
diff --git a/lib/libcasper/services/cap_sysctl/tests/Makefile b/lib/libcasper/services/cap_sysctl/tests/Makefile
--- a/lib/libcasper/services/cap_sysctl/tests/Makefile
+++ b/lib/libcasper/services/cap_sysctl/tests/Makefile
@@ -3,6 +3,8 @@
 
 ATF_TESTS_C=	sysctl_test
 
+TEST_METADATA+=	execenv="host"
+
 .if ${MK_CASPER} != "no"
 LIBADD+=	casper
 LIBADD+=	cap_sysctl
diff --git a/lib/librt/tests/Makefile b/lib/librt/tests/Makefile
--- a/lib/librt/tests/Makefile
+++ b/lib/librt/tests/Makefile
@@ -4,6 +4,8 @@
 NETBSD_ATF_TESTS_C=	sched_test
 NETBSD_ATF_TESTS_C+=	sem_test
 
+TEST_METADATA.sched_test+=	execenv="host"
+
 .include <netbsd-tests.test.mk>
 
 .include <bsd.test.mk>
diff --git a/lib/libutil/tests/Makefile b/lib/libutil/tests/Makefile
--- a/lib/libutil/tests/Makefile
+++ b/lib/libutil/tests/Makefile
@@ -9,6 +9,8 @@
 ATF_TESTS_C+=	expand_number_test
 ATF_TESTS_C+=	forkpty_test
 
+TEST_METADATA.forkpty_test+=	execenv="host"
+
 WARNS?=		2
 LIBADD+=	util
 
diff --git a/lib/msun/tests/Makefile b/lib/msun/tests/Makefile
--- a/lib/msun/tests/Makefile
+++ b/lib/msun/tests/Makefile
@@ -71,6 +71,8 @@
 ATF_TESTS_C+=	rem_test
 ATF_TESTS_C+=	trig_test
 
+TEST_METADATA+=	execenv="host"
+
 .if !empty(PROG) && !empty(TAP_TESTS_C:M${PROG})
 CFLAGS+=	-O0
 .endif
diff --git a/libexec/rc/tests/Makefile b/libexec/rc/tests/Makefile
--- a/libexec/rc/tests/Makefile
+++ b/libexec/rc/tests/Makefile
@@ -1,3 +1,5 @@
 ATF_TESTS_SH+=  rc_subr_test
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/libexec/tftpd/tests/Makefile b/libexec/tftpd/tests/Makefile
--- a/libexec/tftpd/tests/Makefile
+++ b/libexec/tftpd/tests/Makefile
@@ -3,6 +3,7 @@
 
 ATF_TESTS_C=	functional
 TEST_METADATA.functional+=	timeout=15
+TEST_METADATA.functional+=	execenv_jail="ip4=inherit ip6=inherit"
 
 LIBADD=	util
 CSTD=	c11
diff --git a/sbin/bectl/tests/Makefile b/sbin/bectl/tests/Makefile
--- a/sbin/bectl/tests/Makefile
+++ b/sbin/bectl/tests/Makefile
@@ -3,4 +3,6 @@
 
 ATF_TESTS_SH+=	bectl_test
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/sbin/dhclient/tests/Makefile b/sbin/dhclient/tests/Makefile
--- a/sbin/dhclient/tests/Makefile
+++ b/sbin/dhclient/tests/Makefile
@@ -6,6 +6,8 @@
 # Tests assign a common IP address.
 TEST_METADATA.pcp+=	is_exclusive=true
 
+TEST_METADATA.pcp+=	execenv="host"
+
 PLAIN_TESTS_C=				option-domain-search_test
 SRCS.option-domain-search_test=		alloc.c convert.c hash.c options.c \
 					tables.c parse.c conflex.c tree.c fake.c \
diff --git a/sbin/growfs/tests/Makefile b/sbin/growfs/tests/Makefile
--- a/sbin/growfs/tests/Makefile
+++ b/sbin/growfs/tests/Makefile
@@ -1,4 +1,6 @@
 
 TAP_TESTS_PERL=	legacy_test
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/sbin/pfctl/tests/Makefile b/sbin/pfctl/tests/Makefile
--- a/sbin/pfctl/tests/Makefile
+++ b/sbin/pfctl/tests/Makefile
@@ -4,6 +4,8 @@
 ATF_TESTS_C=	pfctl_test
 ATF_TESTS_SH=	macro
 
+TEST_METADATA.pfctl_test+=	execenv_jail="ip4=inherit ip6=inherit"
+
 LIBADD+=	sbuf
 SUBDIR+=	files
 WARNS=6
diff --git a/sbin/ping/tests/Makefile b/sbin/ping/tests/Makefile
--- a/sbin/ping/tests/Makefile
+++ b/sbin/ping/tests/Makefile
@@ -9,6 +9,9 @@
 # Exclusive because each injection test case uses the same IP addresses
 TEST_METADATA.ping_test+=	is_exclusive="true"
 
+TEST_METADATA.ping_test+=	execenv="host"
+TEST_METADATA.test_ping.py+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+
 ${PACKAGE}FILES+= ping_c1_s56_t1.out
 ${PACKAGE}FILES+= ping_6_c1_s8_t1.out
 ${PACKAGE}FILES+= ping_c1_s56_t1_S127.out
diff --git a/sbin/route/tests/Makefile b/sbin/route/tests/Makefile
--- a/sbin/route/tests/Makefile
+++ b/sbin/route/tests/Makefile
@@ -7,4 +7,6 @@
 ${PACKAGE}FILES+=	\
 		utils.subr
 
+TEST_METADATA+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+
 .include <bsd.test.mk>
diff --git a/share/mk/atf.test.mk b/share/mk/atf.test.mk
--- a/share/mk/atf.test.mk
+++ b/share/mk/atf.test.mk
@@ -90,7 +90,7 @@
 .for _T in ${ATF_TESTS_KSH93}
 SCRIPTSDIR_${_T}= ${TESTSDIR}
 TEST_INTERFACE.${_T}= atf
-TEST_METADATA.${_T}+= required_programs="ksh93"
+TEST_METADATA.${_T}+= required_programs="ksh93" execenv="host"
 CLEANFILES+= ${_T} ${_T}.tmp
 # TODO(jmmv): It seems to me that this SED and SRC functionality should
 # exist in bsd.prog.mk along the support for SCRIPTS.  Move it there if
diff --git a/share/mk/suite.test.mk b/share/mk/suite.test.mk
--- a/share/mk/suite.test.mk
+++ b/share/mk/suite.test.mk
@@ -52,7 +52,7 @@
 .endif
 
 .for _T in ${_TESTS}
-_TEST_METADATA.${_T}= ${TEST_METADATA} ${TEST_METADATA.${_T}}
+_TEST_METADATA.${_T}= execenv="jail" ${TEST_METADATA} ${TEST_METADATA.${_T}}
 .endfor
 
 .if ${KYUAFILE:tl} == "auto"
diff --git a/tests/etc/rc.d/Makefile b/tests/etc/rc.d/Makefile
--- a/tests/etc/rc.d/Makefile
+++ b/tests/etc/rc.d/Makefile
@@ -3,4 +3,6 @@
 
 ATF_TESTS_SH+=	routing_test
 
+TEST_METADATA+=	execenv_jail="ip4=inherit ip6=inherit"
+
 .include <bsd.test.mk>
diff --git a/tests/examples/Makefile b/tests/examples/Makefile
--- a/tests/examples/Makefile
+++ b/tests/examples/Makefile
@@ -6,5 +6,7 @@
 ATF_TESTS_PYTEST +=	test_examples.py
 ATF_TESTS_PYTEST +=	test_ktest_example.py
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
 
diff --git a/tests/sys/acl/Makefile b/tests/sys/acl/Makefile
--- a/tests/sys/acl/Makefile
+++ b/tests/sys/acl/Makefile
@@ -21,6 +21,8 @@
 TAP_TESTS_SH+=	03
 TAP_TESTS_SH+=	04
 
+TEST_METADATA+=		execenv="host"
+
 .for t in ${TAP_TESTS_SH}
 # Tests hard-code a ZFS pool name of "acltools" and so cannot run in parallel.
 TEST_METADATA.$t+=	required_user="root" \
diff --git a/tests/sys/aio/Makefile b/tests/sys/aio/Makefile
--- a/tests/sys/aio/Makefile
+++ b/tests/sys/aio/Makefile
@@ -8,6 +8,8 @@
 # Some lio_test testcases involve system resource limitations, so cannot run concurrently
 TEST_METADATA.lio_test+= is_exclusive=true
 
+TEST_METADATA.aio_test+= execenv="host"
+
 PLAIN_TESTS_C+=	aio_kqueue_test
 PLAIN_TESTS_C+=	lio_kqueue_test
 
diff --git a/tests/sys/audit/Makefile b/tests/sys/audit/Makefile
--- a/tests/sys/audit/Makefile
+++ b/tests/sys/audit/Makefile
@@ -45,6 +45,7 @@
 SRCS.miscellaneous+=		miscellaneous.c
 SRCS.miscellaneous+=		utils.c
 
+TEST_METADATA+= execenv="host"
 TEST_METADATA+= timeout="30"
 TEST_METADATA+= required_user="root"
 # Only one process can be auditing, if we attempt to run these tests in parallel
diff --git a/tests/sys/capsicum/Makefile b/tests/sys/capsicum/Makefile
--- a/tests/sys/capsicum/Makefile
+++ b/tests/sys/capsicum/Makefile
@@ -36,7 +36,10 @@
 	rename.cc
 
 LIBADD.capsicum-test+=	gtest pthread procstat
-TEST_METADATA.capsicum-test=	required_user="unprivileged"
+
+TEST_METADATA.bindat_connectat+=	execenv_jail="ip4=inherit ip6=inherit"
+TEST_METADATA.functional+=		required_user="unprivileged",execenv="host"
+TEST_METADATA.ioctls_test+=		required_user="unprivileged",execenv="host"
 
 .for p in mini-me mini-me.noexec mini-me.setuid
 PROGS+=		$p
diff --git a/tests/sys/file/Makefile b/tests/sys/file/Makefile
--- a/tests/sys/file/Makefile
+++ b/tests/sys/file/Makefile
@@ -12,6 +12,9 @@
 PLAIN_TESTS_C+=	newfileops_on_fork_test
 ATF_TESTS_C+=	fspacectl_test
 
+TEST_METADATA.newfileops_on_fork_test+=	execenv="host"
+TEST_METADATA.path_test+=		execenv="host"
+
 PROGS+=		flock_helper
 
 LIBADD.closefrom_test=	util
diff --git a/tests/sys/fs/fusefs/Makefile b/tests/sys/fs/fusefs/Makefile
--- a/tests/sys/fs/fusefs/Makefile
+++ b/tests/sys/fs/fusefs/Makefile
@@ -61,7 +61,7 @@
 SRCS.$p+=	utils.cc
 .endfor
 
-TEST_METADATA.default_permissions+=	required_user="unprivileged"
+TEST_METADATA.default_permissions+=	required_user="unprivileged",execenv="host"
 TEST_METADATA.default_permissions_privileged+=	required_user="root"
 TEST_METADATA.mknod+=	required_user="root"
 TEST_METADATA.nfs+=	required_user="root"
diff --git a/tests/sys/fs/tarfs/Makefile b/tests/sys/fs/tarfs/Makefile
--- a/tests/sys/fs/tarfs/Makefile
+++ b/tests/sys/fs/tarfs/Makefile
@@ -7,4 +7,6 @@
 
 ATF_TESTS_SH+=	tarfs_test
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/tests/sys/fs/tmpfs/Makefile b/tests/sys/fs/tmpfs/Makefile
--- a/tests/sys/fs/tmpfs/Makefile
+++ b/tests/sys/fs/tmpfs/Makefile
@@ -34,6 +34,14 @@
 NETBSD_ATF_TESTS_SH+=	vnd_test
 NETBSD_ATF_TESTS_SH+=	vnode_leak_test
 
+TEST_METADATA+=			execenv_jail="allow.mount allow.mount.tmpfs enforce_statfs=1"
+TEST_METADATA.sockets_test+=	execenv_jail="allow.mount allow.mount.tmpfs enforce_statfs=1 vnet"
+
+TEST_METADATA.mknod_test+=	execenv="host"
+TEST_METADATA.readdir_test+=	execenv="host"
+TEST_METADATA.vnd_test+=	execenv="host"
+TEST_METADATA.vnode_leak_test+=	execenv="host"
+
 ${PACKAGE}FILES+=	h_funcs.subr
 ${PACKAGE}FILESDIR=	${TESTSDIR}
 
diff --git a/tests/sys/geom/class/concat/Makefile b/tests/sys/geom/class/concat/Makefile
--- a/tests/sys/geom/class/concat/Makefile
+++ b/tests/sys/geom/class/concat/Makefile
@@ -11,7 +11,7 @@
 ${PACKAGE}FILES+=		conf.sh
 
 .for t in ${TAP_TESTS_SH}
-TEST_METADATA.$t+=	required_user="root"
+TEST_METADATA.$t+=	execenv="host",required_user="root"
 .endfor
 
 .include <bsd.test.mk>
diff --git a/tests/sys/geom/class/eli/Makefile b/tests/sys/geom/class/eli/Makefile
--- a/tests/sys/geom/class/eli/Makefile
+++ b/tests/sys/geom/class/eli/Makefile
@@ -22,6 +22,8 @@
 ATF_TESTS_SH+=	resize_test
 ATF_TESTS_SH+=	setkey_test
 
+TEST_METADATA+=	execenv="host"
+
 ${PACKAGE}FILES+=		conf.sh
 
 CFLAGS.pbkdf2_test=	-I${SRCTOP}/sys
diff --git a/tests/sys/geom/class/gate/Makefile b/tests/sys/geom/class/gate/Makefile
--- a/tests/sys/geom/class/gate/Makefile
+++ b/tests/sys/geom/class/gate/Makefile
@@ -6,6 +6,6 @@
 ATF_TESTS_SH+=	ggate_test
 
 # Tests listen on the same port.
-TEST_METADATA.ggate_test+= is_exclusive=true
+TEST_METADATA.ggate_test+= execenv="host",is_exclusive=true
 
 .include <bsd.test.mk>
diff --git a/tests/sys/geom/class/mirror/Makefile b/tests/sys/geom/class/mirror/Makefile
--- a/tests/sys/geom/class/mirror/Makefile
+++ b/tests/sys/geom/class/mirror/Makefile
@@ -21,7 +21,7 @@
 ATF_TESTS_SH+=	sync_error
 
 # Tests use a global gmirror fail point.
-TEST_METADATA+=	is_exclusive=true
+TEST_METADATA+=	execenv="host",is_exclusive=true
 
 ${PACKAGE}FILES+=		conf.sh
 
diff --git a/tests/sys/geom/class/multipath/Makefile b/tests/sys/geom/class/multipath/Makefile
--- a/tests/sys/geom/class/multipath/Makefile
+++ b/tests/sys/geom/class/multipath/Makefile
@@ -5,6 +5,7 @@
 
 ATF_TESTS_SH+=	failloop
 ATF_TESTS_SH+=	misc
+TEST_METADATA+= execenv="host"
 TEST_METADATA.failloop+= is_exclusive=true
 
 ${PACKAGE}FILES+=		conf.sh
diff --git a/tests/sys/geom/class/nop/Makefile b/tests/sys/geom/class/nop/Makefile
--- a/tests/sys/geom/class/nop/Makefile
+++ b/tests/sys/geom/class/nop/Makefile
@@ -4,5 +4,6 @@
 TESTSDIR=	${TESTSBASE}/sys/geom/class/${.CURDIR:T}
 
 ATF_TESTS_SH+=	nop_test
+TEST_METADATA+=	execenv="host"
 
 .include <bsd.test.mk>
diff --git a/tests/sys/geom/class/part/Makefile b/tests/sys/geom/class/part/Makefile
--- a/tests/sys/geom/class/part/Makefile
+++ b/tests/sys/geom/class/part/Makefile
@@ -5,5 +5,6 @@
 
 # TODO: port the perl tests in tools/regression/geom_gpt
 ATF_TESTS_SH+=	misc
+TEST_METADATA+=	execenv="host"
 
 .include <bsd.test.mk>
diff --git a/tests/sys/geom/class/raid3/Makefile b/tests/sys/geom/class/raid3/Makefile
--- a/tests/sys/geom/class/raid3/Makefile
+++ b/tests/sys/geom/class/raid3/Makefile
@@ -19,7 +19,7 @@
 ${PACKAGE}FILES+=		conf.sh
 
 .for t in ${TAP_TESTS_SH}
-TEST_METADATA.$t+=	required_user="root"
+TEST_METADATA.$t+=	execenv="host",required_user="root"
 .endfor
 
 .include <bsd.test.mk>
diff --git a/tests/sys/geom/class/shsec/Makefile b/tests/sys/geom/class/shsec/Makefile
--- a/tests/sys/geom/class/shsec/Makefile
+++ b/tests/sys/geom/class/shsec/Makefile
@@ -9,7 +9,7 @@
 ${PACKAGE}FILES+=		conf.sh
 
 .for t in ${TAP_TESTS_SH}
-TEST_METADATA.$t+=	required_user="root"
+TEST_METADATA.$t+=	execenv="host",required_user="root"
 .endfor
 
 .include <bsd.test.mk>
diff --git a/tests/sys/geom/class/stripe/Makefile b/tests/sys/geom/class/stripe/Makefile
--- a/tests/sys/geom/class/stripe/Makefile
+++ b/tests/sys/geom/class/stripe/Makefile
@@ -9,7 +9,7 @@
 ${PACKAGE}FILES+=		conf.sh
 
 .for t in ${TAP_TESTS_SH}
-TEST_METADATA.$t+=	required_user="root"
+TEST_METADATA.$t+=	execenv="host",required_user="root"
 .endfor
 
 .include <bsd.test.mk>
diff --git a/tests/sys/geom/class/uzip/Makefile b/tests/sys/geom/class/uzip/Makefile
--- a/tests/sys/geom/class/uzip/Makefile
+++ b/tests/sys/geom/class/uzip/Makefile
@@ -35,7 +35,7 @@
 TAP_TESTS_SH+=	1_test
 
 .for t in ${TAP_TESTS_SH}
-TEST_METADATA.$t+=	required_user="root"
+TEST_METADATA.$t+=	execenv="host",required_user="root"
 .endfor
 
 .include <bsd.test.mk>
diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile
--- a/tests/sys/kern/Makefile
+++ b/tests/sys/kern/Makefile
@@ -20,18 +20,22 @@
 ATF_TESTS_C+=	kill_zombie
 .if ${MK_OPENSSL} != "no"
 ATF_TESTS_C+=	ktls_test
+TEST_METADATA.ktls_test+=	execenv="host"
 .endif
 ATF_TESTS_C+=	module_test
 ATF_TESTS_C+=	ptrace_test
-TEST_METADATA.ptrace_test+=		timeout="15"
+TEST_METADATA.ptrace_test+=		timeout="15",execenv="host"
 ATF_TESTS_C+=	reaper
 ATF_TESTS_C+=	sched_affinity
 ATF_TESTS_C+=	sigaltstack
 ATF_TESTS_C+=	sigwait
+TEST_METADATA.sigwait+=	is_exclusive="true",execenv="host"
 ATF_TESTS_C+=	socket_accf
+TEST_METADATA.socket_accf+=		execenv="host"
 ATF_TESTS_C+=	socket_msg_trunc
+TEST_METADATA.socket_msg_trunc+=	execenv_jail="ip4=inherit ip6=inherit"
 ATF_TESTS_C+=	socket_msg_waitall
-TEST_METADATA.sigwait+=	is_exclusive="true"
+TEST_METADATA.socket_msg_waitall+=	execenv_jail="ip4=inherit ip6=inherit"
 .if ${MACHINE_ARCH} != "i386" && ${MACHINE_ARCH:Mpowerpc*} == ""
 ATF_TESTS_C+=	subr_physmem_test
 .endif
@@ -56,6 +60,7 @@
 TEST_METADATA.sonewconn_overflow+=	required_programs="python"
 TEST_METADATA.sonewconn_overflow+=	required_user="root"
 ATF_TESTS_SH+=	sendfile_test
+TEST_METADATA.sendfile_test+=		execenv="host"
 
 ${PACKAGE}FILES+=	sonewconn_overflow.py
 ${PACKAGE}FILESMODE_sonewconn_overflow.py=0555
@@ -82,6 +87,7 @@
 NETBSD_ATF_TESTS_C+=	lockf_test
 NETBSD_ATF_TESTS_C+=	mqueue_test
 NETBSD_ATF_TESTS_C+=	sysv_test
+TEST_METADATA.sysv_test+=		execenv_jail="allow.sysvipc"
 
 CFLAGS.mqueue_test+=	-I${SRCTOP}/tests
 LIBADD.mqueue_test+=	rt
diff --git a/tests/sys/kern/pipe/Makefile b/tests/sys/kern/pipe/Makefile
--- a/tests/sys/kern/pipe/Makefile
+++ b/tests/sys/kern/pipe/Makefile
@@ -11,4 +11,6 @@
 PLAIN_TESTS_C+= pipe_reverse_test
 PLAIN_TESTS_C+= pipe_wraparound_test
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/tests/sys/mac/bsdextended/Makefile b/tests/sys/mac/bsdextended/Makefile
--- a/tests/sys/mac/bsdextended/Makefile
+++ b/tests/sys/mac/bsdextended/Makefile
@@ -11,4 +11,6 @@
 # be run simultaneously
 TEST_METADATA.matches_test+=	is_exclusive=true
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/tests/sys/mac/ipacl/Makefile b/tests/sys/mac/ipacl/Makefile
--- a/tests/sys/mac/ipacl/Makefile
+++ b/tests/sys/mac/ipacl/Makefile
@@ -5,6 +5,8 @@
 
 ATF_TESTS_SH+=	ipacl_test
 
+TEST_METADATA+=	execenv="host"
+
 ${PACKAGE}FILES+=	utils.subr
 
 .include <bsd.test.mk>
diff --git a/tests/sys/mac/portacl/Makefile b/tests/sys/mac/portacl/Makefile
--- a/tests/sys/mac/portacl/Makefile
+++ b/tests/sys/mac/portacl/Makefile
@@ -9,6 +9,7 @@
 TAP_TESTS_SH+=	root_test
 
 .for t in ${TAP_TESTS_SH}
+TEST_METADATA.$t+=	execenv="host"
 TEST_METADATA.$t+=	required_user="root"
 TEST_METADATA.$t+=	timeout="450"
 .endfor
diff --git a/tests/sys/net/Makefile b/tests/sys/net/Makefile
--- a/tests/sys/net/Makefile
+++ b/tests/sys/net/Makefile
@@ -5,16 +5,24 @@
 BINDIR=		${TESTSDIR}
 
 ATF_TESTS_C+=	if_epair
+TEST_METADATA.if_epair+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
 ATF_TESTS_SH+=	if_epair_test
+TEST_METADATA.if_epair_test+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
 ATF_TESTS_SH+=	if_bridge_test
-TEST_METADATA.if_bridge_test+=	required_programs="python"
+TEST_METADATA.if_bridge_test+=	required_programs="python",execenv_jail="vnet"
 ATF_TESTS_SH+=	if_clone_test
 ATF_TESTS_SH+=	if_gif
+TEST_METADATA.if_gif+=		execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
 ATF_TESTS_SH+=	if_lagg_test
+TEST_METADATA.if_lagg_test+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair if_lagg\""
 ATF_TESTS_SH+=	if_stf
+TEST_METADATA.if_stf+=		execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
 ATF_TESTS_SH+=	if_tun_test
+TEST_METADATA.if_tun_test+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
 ATF_TESTS_SH+=	if_vlan
+TEST_METADATA.if_vlan+=		execenv="host"
 ATF_TESTS_SH+=	if_wg
+TEST_METADATA.if_wg+=		execenv="host"
 
 TESTS_SUBDIRS+=	if_ovpn
 TESTS_SUBDIRS+=	routing
diff --git a/tests/sys/net/if_ovpn/Makefile b/tests/sys/net/if_ovpn/Makefile
--- a/tests/sys/net/if_ovpn/Makefile
+++ b/tests/sys/net/if_ovpn/Makefile
@@ -8,8 +8,10 @@
 ATF_TESTS_SH+=	if_ovpn
 # Tests reuse jail names and so cannot run in parallel.
 TEST_METADATA.if_ovpn+=	is_exclusive=true
+TEST_METADATA.if_ovpn+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
 .endif
 ATF_TESTS_C+=	if_ovpn_c
+TEST_METADATA.if_ovpn_c+=	execenv="host"
 
 LIBADD+=	nv
 
diff --git a/tests/sys/net/routing/Makefile b/tests/sys/net/routing/Makefile
--- a/tests/sys/net/routing/Makefile
+++ b/tests/sys/net/routing/Makefile
@@ -17,6 +17,8 @@
 # so running them in parallel will lead to weird results.
 TEST_METADATA+=	is_exclusive=true
 
+TEST_METADATA+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+
 CFLAGS+=	-I${.CURDIR:H:H:H}
 
 .include <bsd.test.mk>
diff --git a/tests/sys/netgraph/Makefile b/tests/sys/netgraph/Makefile
--- a/tests/sys/netgraph/Makefile
+++ b/tests/sys/netgraph/Makefile
@@ -16,6 +16,8 @@
 		hub		\
 		vlan_rotate	\
 
+TEST_METADATA+=	execenv="host"
+
 SRCS.basic=	basic.c util.c
 SRCS.bridge=	bridge.c util.c
 SRCS.hub=	hub.c util.c
diff --git a/tests/sys/netinet/Makefile b/tests/sys/netinet/Makefile
--- a/tests/sys/netinet/Makefile
+++ b/tests/sys/netinet/Makefile
@@ -31,6 +31,14 @@
 TEST_METADATA.redirect+= required_programs="python"
 TEST_METADATA.tcp6_v4mapped_bind_test+=	is_exclusive="true"
 
+TEST_METADATA+=				execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+TEST_METADATA.ip6_v4mapped_test+=	execenv="host"
+TEST_METADATA.ip_reass_test+=		execenv="host"
+TEST_METADATA.so_reuseport_lb_test+=	execenv="host"
+TEST_METADATA.socket_afinet+=		execenv="host"
+TEST_METADATA.tcp_connect_port_test+=	execenv="host"
+TEST_METADATA.tcp_md5_getsockopt+=	execenv="host"
+
 PROGS=	udp_dontroute tcp_user_cookie
 
 ${PACKAGE}FILES+=		redirect.py
diff --git a/tests/sys/netinet6/Makefile b/tests/sys/netinet6/Makefile
--- a/tests/sys/netinet6/Makefile
+++ b/tests/sys/netinet6/Makefile
@@ -19,6 +19,9 @@
 				proxy_ndp
 TEST_METADATA.output6+=	required_programs="python"
 
+TEST_METADATA+=			execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+TEST_METADATA.redirect+=	execenv="host"
+
 ${PACKAGE}FILES+=		exthdr.py
 ${PACKAGE}FILES+=		mld.py
 ${PACKAGE}FILES+=		scapyi386.py
diff --git a/tests/sys/netinet6/frag6/Makefile b/tests/sys/netinet6/frag6/Makefile
--- a/tests/sys/netinet6/frag6/Makefile
+++ b/tests/sys/netinet6/frag6/Makefile
@@ -29,6 +29,8 @@
 				frag6_19 \
 				frag6_20
 
+TEST_METADATA+=	is_exclusive=true,execenv="host"
+
 ${PACKAGE}FILES+=		frag6.subr
 ${PACKAGE}FILES+=		sniffer.py
 ${PACKAGE}FILES+=		frag6_01.py
diff --git a/tests/sys/netipsec/tunnel/Makefile b/tests/sys/netipsec/tunnel/Makefile
--- a/tests/sys/netipsec/tunnel/Makefile
+++ b/tests/sys/netipsec/tunnel/Makefile
@@ -17,6 +17,8 @@
 # Each test uses the same names for its jails, so they must be run serially.
 TEST_METADATA+=	is_exclusive=true
 
+TEST_METADATA+=	execenv="host"
+
 ${PACKAGE}FILES+=	utils.subr
 
 .include <bsd.test.mk>
diff --git a/tests/sys/netlink/Makefile b/tests/sys/netlink/Makefile
--- a/tests/sys/netlink/Makefile
+++ b/tests/sys/netlink/Makefile
@@ -12,6 +12,14 @@
 ATF_TESTS_PYTEST +=	test_rtnl_route.py
 ATF_TESTS_PYTEST +=	test_netlink_message_writer.py
 
+TEST_METADATA.test_netlink_message_writer.py+=	execenv="host"
+
+TEST_METADATA.test_nl_core.py+=		execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+TEST_METADATA.test_rtnl_iface.py+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+TEST_METADATA.test_rtnl_ifaddr.py+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+TEST_METADATA.test_rtnl_neigh.py+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+TEST_METADATA.test_rtnl_route.py+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+
 CFLAGS+=	-I${.CURDIR:H:H:H}
 
 .include <bsd.test.mk>
diff --git a/tests/sys/netpfil/common/Makefile b/tests/sys/netpfil/common/Makefile
--- a/tests/sys/netpfil/common/Makefile
+++ b/tests/sys/netpfil/common/Makefile
@@ -16,6 +16,8 @@
 # Tests reuse jail names and so cannot run in parallel.
 TEST_METADATA+=	is_exclusive=true
 
+TEST_METADATA+=	execenv="host"
+
 ${PACKAGE}FILES+=	\
 		utils.subr \
 		runner.subr \
diff --git a/tests/sys/netpfil/pf/Makefile b/tests/sys/netpfil/pf/Makefile
--- a/tests/sys/netpfil/pf/Makefile
+++ b/tests/sys/netpfil/pf/Makefile
@@ -48,6 +48,12 @@
 # Tests reuse jail names and so cannot run in parallel.
 TEST_METADATA+=	is_exclusive=true
 
+TEST_METADATA+=	execenv_jail="vnet \"exec.prepare=kldload -n if_epair\""
+
+TEST_METADATA.pfsync+=		execenv="host"
+TEST_METADATA.route_to+=	execenv="host"
+TEST_METADATA.syncookie+=	execenv="host"
+
 PROGS=	divapp
 
 ${PACKAGE}FILES+=	CVE-2019-5597.py \
diff --git a/tests/sys/posixshm/Makefile b/tests/sys/posixshm/Makefile
--- a/tests/sys/posixshm/Makefile
+++ b/tests/sys/posixshm/Makefile
@@ -6,4 +6,6 @@
 ATF_TESTS_C+=	memfd_test
 ATF_TESTS_C+=	posixshm_test
 
+TEST_METADATA.posixshm_test+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/tests/sys/vm/Makefile b/tests/sys/vm/Makefile
--- a/tests/sys/vm/Makefile
+++ b/tests/sys/vm/Makefile
@@ -8,6 +8,9 @@
 		page_fault_signal \
 		shared_shadow_inval_test
 
+TEST_METADATA.mlock_test+=			execenv_jail="allow.mlock"
+TEST_METADATA.shared_shadow_inval_test+=	execenv_jail="allow.mlock"
+
 BINDIR=		${TESTSDIR}
 ATF_TESTS_SH+=	mmap_map_32bit_test
 PROGS+=		mmap_map_32bit_helper
diff --git a/tests/sys/vmm/Makefile b/tests/sys/vmm/Makefile
--- a/tests/sys/vmm/Makefile
+++ b/tests/sys/vmm/Makefile
@@ -6,6 +6,8 @@
 
 ATF_TESTS_SH+=	vmm_cred_jail
 
+TEST_METADATA+=	execenv="host"
+
 ${PACKAGE}FILES+=	utils.subr
 
 .include <bsd.test.mk>
diff --git a/usr.bin/diff/tests/Makefile b/usr.bin/diff/tests/Makefile
--- a/usr.bin/diff/tests/Makefile
+++ b/usr.bin/diff/tests/Makefile
@@ -3,6 +3,8 @@
 
 ATF_TESTS_SH=	diff_test
 
+TEST_METADATA.diff_test+=	execenv="host"
+
 ${PACKAGE}FILES+=	\
 	Bflag_C.out \
 	Bflag_D.out \
diff --git a/usr.bin/tftp/tests/Makefile b/usr.bin/tftp/tests/Makefile
--- a/usr.bin/tftp/tests/Makefile
+++ b/usr.bin/tftp/tests/Makefile
@@ -4,6 +4,6 @@
 ATF_TESTS_SH=	tftp_test
 BINDIR=		${TESTSDIR}
 
-TEST_METADATA.tftp_test+= is_exclusive="true"
+TEST_METADATA.tftp_test+= is_exclusive="true",execenv="host"
 
 .include <bsd.test.mk>
diff --git a/usr.bin/truncate/tests/Makefile b/usr.bin/truncate/tests/Makefile
--- a/usr.bin/truncate/tests/Makefile
+++ b/usr.bin/truncate/tests/Makefile
@@ -1,4 +1,6 @@
 
 ATF_TESTS_SH=	truncate_test
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/usr.bin/xinstall/tests/Makefile b/usr.bin/xinstall/tests/Makefile
--- a/usr.bin/xinstall/tests/Makefile
+++ b/usr.bin/xinstall/tests/Makefile
@@ -1,4 +1,6 @@
 
 ATF_TESTS_SH+=	install_test
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/usr.bin/yacc/tests/Makefile b/usr.bin/yacc/tests/Makefile
--- a/usr.bin/yacc/tests/Makefile
+++ b/usr.bin/yacc/tests/Makefile
@@ -9,7 +9,7 @@
 # NOTE: due to caveats with how permissions are handled on FreeBSD
 # with root, this must be run as a non-privileged user; otherwise
 # the testcases will fail unexpectedly.
-TEST_METADATA.yacc_tests+=	required_user="unprivileged"
+TEST_METADATA.yacc_tests+=	required_user="unprivileged",execenv="host"
 
 SCRIPTS=	run_test
 SCRIPTSDIR=	${TESTSDIR}
diff --git a/usr.sbin/chown/tests/Makefile b/usr.sbin/chown/tests/Makefile
--- a/usr.sbin/chown/tests/Makefile
+++ b/usr.sbin/chown/tests/Makefile
@@ -1,4 +1,6 @@
 
 ATF_TESTS_SH+=		chown_test
 
+TEST_METADATA+=		execenv="host"
+
 .include <bsd.test.mk>
diff --git a/usr.sbin/extattr/tests/Makefile b/usr.sbin/extattr/tests/Makefile
--- a/usr.sbin/extattr/tests/Makefile
+++ b/usr.sbin/extattr/tests/Makefile
@@ -1,4 +1,6 @@
 
 ATF_TESTS_SH=	extattr_test
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/usr.sbin/jail/tests/Makefile b/usr.sbin/jail/tests/Makefile
--- a/usr.sbin/jail/tests/Makefile
+++ b/usr.sbin/jail/tests/Makefile
@@ -7,4 +7,6 @@
 # The different test cases create jails with the same name.
 TEST_METADATA+= is_exclusive="true"
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>
diff --git a/usr.sbin/makefs/tests/Makefile b/usr.sbin/makefs/tests/Makefile
--- a/usr.sbin/makefs/tests/Makefile
+++ b/usr.sbin/makefs/tests/Makefile
@@ -19,7 +19,7 @@
 SCRIPTSNAME_makefs_tests_common.sh=	makefs_tests_common.sh
 
 .for t in ${ATF_TESTS_SH}
-TEST_METADATA.$t+=	required_user="root"
+TEST_METADATA.$t+=	required_user="root",execenv="host"
 .endfor
 
 .include <bsd.test.mk>
diff --git a/usr.sbin/syslogd/tests/Makefile b/usr.sbin/syslogd/tests/Makefile
--- a/usr.sbin/syslogd/tests/Makefile
+++ b/usr.sbin/syslogd/tests/Makefile
@@ -2,4 +2,6 @@
 # Several syslogd listening on the same port prevent parallel operation
 TEST_METADATA+=	is_exclusive="true"
 
+TEST_METADATA+=	execenv="host"
+
 .include <bsd.test.mk>