diff options
author | 2021-01-09 21:43:57 -0300 | |
---|---|---|
committer | 2021-01-27 18:18:39 -0300 | |
commit | 3849e1201d4e076af4039a1400e05be2006630e5 (patch) | |
tree | 98610edaea479f29b383e87448761d9641c927c4 /etc/inc/disable-common.inc | |
parent | etc: add allow-ssh.inc (diff) | |
download | firejail-3849e1201d4e076af4039a1400e05be2006630e5.tar.gz firejail-3849e1201d4e076af4039a1400e05be2006630e5.tar.zst firejail-3849e1201d4e076af4039a1400e05be2006630e5.zip |
allow-ssh.inc: allow /etc/ssh/ssh_config
This is the system-wide equivalent of ~/.ssh/config.
$ pacman -Q openssh
openssh 8.4p1-2
Reasons for blacklisting both /etc/ssh and /etc/ssh/* on
disable-common.inc:
Leave /etc/ssh that way so that profiles without allow-ssh.inc remain
unable to see inside of /etc/ssh. And blacklist /etc/ssh/* so that
profiles with allow-ssh.inc are able to access only nonblacklisted files
inside of /etc/ssh.
Diffstat (limited to 'etc/inc/disable-common.inc')
-rw-r--r-- | etc/inc/disable-common.inc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index eeafe3ec4..e1c930b43 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -396,6 +396,7 @@ blacklist /etc/shadow | |||
396 | blacklist /etc/shadow+ | 396 | blacklist /etc/shadow+ |
397 | blacklist /etc/shadow- | 397 | blacklist /etc/shadow- |
398 | blacklist /etc/ssh | 398 | blacklist /etc/ssh |
399 | blacklist /etc/ssh/* | ||
399 | blacklist /home/.ecryptfs | 400 | blacklist /home/.ecryptfs |
400 | blacklist /home/.fscrypt | 401 | blacklist /home/.fscrypt |
401 | blacklist /var/backup | 402 | blacklist /var/backup |