programs: fontconfig: sandbox
This commit is contained in:
parent
7eaffc9fa0
commit
0dec8b6d5b
|
@ -28,6 +28,17 @@ let
|
|||
wantedNerdfonts;
|
||||
in
|
||||
{
|
||||
sane.programs.fontconfig = {
|
||||
sandbox.method = "bwrap"; # TODO:sandbox: untested
|
||||
sandbox.wrapperType = "wrappedDerivation";
|
||||
sandbox.autodetectCliPaths = "existingFileOrParent"; #< this might be overkill; or, how many programs reference fontconfig internally?
|
||||
|
||||
persist.byStore.plaintext = [
|
||||
# < 10 MiB
|
||||
".cache/fontconfig"
|
||||
];
|
||||
};
|
||||
|
||||
fonts = lib.mkIf config.sane.programs.fontconfig.enabled {
|
||||
fontconfig.enable = true;
|
||||
fontconfig.defaultFonts = {
|
||||
|
|
|
@ -122,9 +122,8 @@
|
|||
|
||||
# these are persisted simply to save on RAM.
|
||||
# ~/.cache/nix can become several GB.
|
||||
# fontconfig and mesa_shader_cache are < 10 MB.
|
||||
# mesa_shader_cache is < 10 MB.
|
||||
# TODO: integrate with sane.programs.sandbox?
|
||||
".cache/fontconfig"
|
||||
".cache/mesa_shader_cache"
|
||||
".cache/nix"
|
||||
|
||||
|
|
Loading…
Reference in New Issue
Block a user