Fontconfig cannot load its configuration inside the Linux renderer/compositor sandbox

Summary

When running Ladybird on NixOS, I repeatedly get:

Fontconfig error: Cannot load default config file: Unable to open /nix/store/qdbcjg7j3rxr1bvh1qhldk5aqjz7vlx6-fontconfig-2.18.2/etc/fonts/fonts.conf

The referenced file exists and is readable outside Ladybird’s sandbox.

The suspected cause is Fontconfig loading its configuration after filesystem sandboxing, without access to the configuration’s Nix-store location.

This patch seemed to fix it:

Load Fontconfig before the renderer/compositor filesystem sandboxes are
installed, and share that configuration with Skia instead of having it
load a new configuration from disk inside the sandbox.

--- a/Services/Compositor/SandboxLinux.cpp
+++ b/Services/Compositor/SandboxLinux.cpp
@@ -8,6 +8,7 @@
 #include <LibCore/Directory.h>
 #include <LibCore/Environment.h>
 #include <LibCore/StandardPaths.h>
+#include <LibGfx/Font/GlobalFontConfig.h>
 #include <LibSandbox/Sandbox.h>
 #include <LibSandbox/Seccomp.h>
 #include <LibWebView/Utilities.h>
@@ -18,6 +19,9 @@
 {
     TRY(Sandbox::install_no_new_privileges());
     TRY(Sandbox::configure_runtime());
+
+    // Fontconfig configuration files must be read before restricting filesystem access.
+    Gfx::GlobalFontConfig::the();
 
     Vector<Sandbox::LandlockPath> paths;
     TRY(Sandbox::add_landlock_path_if_exists(paths, TRY(String::formatted("{}/fonts", WebView::s_ladybird_resource_root)), Sandbox::LandlockPath::Access::ReadOnly));
--- a/Services/RendererSandboxLinux.cpp
+++ b/Services/RendererSandboxLinux.cpp
@@ -8,6 +8,7 @@
 #include <LibCore/Directory.h>
 #include <LibCore/StandardPaths.h>
 #include <LibCore/System.h>
+#include <LibGfx/Font/GlobalFontConfig.h>
 #include <LibSandbox/Sandbox.h>
 #include <LibSandbox/Seccomp.h>
 #include <LibWebView/Utilities.h>
@@ -19,6 +20,9 @@
 {
     TRY(Sandbox::install_no_new_privileges());
     TRY(Sandbox::configure_runtime());
+
+    // Fontconfig configuration files must be read before restricting filesystem access.
+    Gfx::GlobalFontConfig::the();
 
     auto executable_path = TRY(Core::System::current_executable_path());
     auto build_root = LexicalPath::dirname(LexicalPath::dirname(executable_path));
--- a/Libraries/LibGfx/Font/TypefaceSkia.cpp
+++ b/Libraries/LibGfx/Font/TypefaceSkia.cpp
@@ -100,7 +100,7 @@
             font_manager = SkFontMgr_New_DirectWrite();
 #else
         if (!font_manager) {
-            font_manager = SkFontMgr_New_FontConfig(nullptr, SkFontScanner_Make_FreeType());
+            font_manager = SkFontMgr_New_FontConfig(FcConfigReference(FcConfigGetCurrent()), SkFontScanner_Make_FreeType());
         }
 #endif
     }

I have seen this in some other issues so it might not be just on NixOS.

Operating system

Linux

Steps to reproduce

1. Have a Nix system
2. Try to build this PR

Expected behavior

Fontconfig should be able to load the system configuration when sandboxing is enabled.

Actual behavior

Gives the following error:

Fontconfig error: Cannot load default config file: Unable to open /nix/store/qdbcjg7j3rxr1bvh1qhldk5aqjz7vlx6-fontconfig-2.18.2/etc/fonts/fonts.conf

URL for a reduced test case

N/A

HTML/SVG/etc. source for a reduced test case

N/A

Log output and (if possible) backtrace

❯ ./result/bin/Ladybird
Fontconfig error: Cannot load default config file: Unable to open /nix/store/qdbcjg7j3rxr1bvh1qhldk5aqjz7vlx6-fontconfig-2.18.2/etc/fonts/fonts.conf
3286.220 Compositor(142674): Failed to allocate shared GPU backing store (no supported DRM format modifiers for shared image), falling back to shareable bitmaps
qt.qpa.services: Failed to register with host portal QDBusError("org.freedesktop.portal.Error.Failed", "Could not register app ID: App info not found for 'org.ladybird.Ladybird'")
Fontconfig error: Cannot load default config file: Unable to open /nix/store/qdbcjg7j3rxr1bvh1qhldk5aqjz7vlx6-fontconfig-2.18.2/etc/fonts/fonts.conf
Fontconfig error: Cannot load default config file: Unable to open /nix/store/qdbcjg7j3rxr1bvh1qhldk5aqjz7vlx6-fontconfig-2.18.2/etc/fonts/fonts.conf

Screenshots or screen recordings

No response

Build flags or config settings

No response