https://github.com/cynicsketch/nix-mineral/blob/e93e88feb772966e4dfd7b272ecb205f5ee95e42/filesystems/normal.nix#L161-L168
It is possible to mount /var/lib with the exec mount option independent of the top level /var in order to preserve the function of any software that keeps executables in /var/lib, whilst still reducing attack surface in the rest of /var.
https://github.com/cynicsketch/nix-mineral/blob/e93e88feb772966e4dfd7b272ecb205f5ee95e42/filesystems/normal.nix#L161-L168
It is possible to mount
/var/libwith theexecmount option independent of the top level/varin order to preserve the function of any software that keeps executables in/var/lib,whilst still reducing attack surface in the rest of/var.