etc: add allow-ssh.inc

And move the scattered `noblacklist ${HOME}/.ssh` entries into it.

Command used to find the relevant files:

    $ grep -Fnr 'noblacklist ${HOME}/.ssh' etc

Also, add it to profile.template, as reminded by @rusty-snake at
https://github.com/netblue30/firejail/pull/3885#pullrequestreview-567527031

7 files changed, 21 insertions, 7 deletions

diff --git a/etc/profile-m-z/meld.profile b/etc/profile-m-z/meld.profile
index 6ceeb867f..a5c74047a 100644
--- a/etc/profile-m-z/meld.profile
+++ b/etc/profile-m-z/meld.profile
@@ -18,7 +18,6 @@ noblacklist ${HOME}/.config/git
 noblacklist ${HOME}/.gitconfig
 noblacklist ${HOME}/.git-credentials
 noblacklist ${HOME}/.local/share/meld
-noblacklist ${HOME}/.ssh
 noblacklist ${HOME}/.subversion
 
 # Allow python (blacklisted by disable-interpreters.inc)
@@ -27,6 +26,9 @@ include allow-python3.inc
 # Python 2 is EOL (see #3164). Uncomment the next line (or put it into your meld.local) if you understand the risks but want python 2 support for older meld versions.
 #include allow-python2.inc
 
+# Allow ssh (blacklisted by disable-common.inc)
+include allow-ssh.inc
+
 # Uncomment the next line (or put it into your meld.local) if you don't need to compare files in disable-common.inc.
 #include disable-common.inc
 include disable-devel.inc
diff --git a/etc/profile-m-z/remmina.profile b/etc/profile-m-z/remmina.profile
index 6311c91df..d4c7bdf31 100644
--- a/etc/profile-m-z/remmina.profile
+++ b/etc/profile-m-z/remmina.profile
@@ -9,7 +9,9 @@ include globals.local
 noblacklist ${HOME}/.remmina
 noblacklist ${HOME}/.config/remmina
 noblacklist ${HOME}/.local/share/remmina
-noblacklist ${HOME}/.ssh
+
+# Allow ssh (blacklisted by disable-common.inc)
+include allow-ssh.inc
 
 include disable-common.inc
 include disable-devel.inc
diff --git a/etc/profile-m-z/seahorse.profile b/etc/profile-m-z/seahorse.profile
index 8bb1f53a7..0f91c79ec 100644
--- a/etc/profile-m-z/seahorse.profile
+++ b/etc/profile-m-z/seahorse.profile
@@ -9,9 +9,11 @@ include globals.local
 blacklist /tmp/.X11-unix
 
 noblacklist ${HOME}/.gnupg
-noblacklist ${HOME}/.ssh
 noblacklist /tmp/ssh-*
 
+# Allow ssh (blacklisted by disable-common.inc)
+include allow-ssh.inc
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
diff --git a/etc/profile-m-z/ssh-agent.profile b/etc/profile-m-z/ssh-agent.profile
index 01b63d3ce..d2e2b3408 100644
--- a/etc/profile-m-z/ssh-agent.profile
+++ b/etc/profile-m-z/ssh-agent.profile
@@ -8,7 +8,9 @@ include globals.local
 
 noblacklist /etc/ssh
 noblacklist /tmp/ssh-*
-noblacklist ${HOME}/.ssh
+
+# Allow ssh (blacklisted by disable-common.inc)
+include allow-ssh.inc
 
 blacklist /tmp/.X11-unix
 blacklist ${RUNUSER}/wayland-*
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile
index e3e2b4541..efdf63976 100644
--- a/etc/profile-m-z/ssh.profile
+++ b/etc/profile-m-z/ssh.profile
@@ -9,11 +9,13 @@ include globals.local
 
 noblacklist /etc/ssh
 noblacklist /tmp/ssh-*
-noblacklist ${HOME}/.ssh
 # nc can be used as ProxyCommand, e.g. when using tor
 noblacklist ${PATH}/nc
 noblacklist ${PATH}/ncat
 
+# Allow ssh (blacklisted by disable-common.inc)
+include allow-ssh.inc
+
 include disable-common.inc
 include disable-exec.inc
 include disable-passwdmgr.inc
diff --git a/etc/profile-m-z/webstorm.profile b/etc/profile-m-z/webstorm.profile
index fc4e8e571..a4adf2896 100644
--- a/etc/profile-m-z/webstorm.profile
+++ b/etc/profile-m-z/webstorm.profile
@@ -8,12 +8,14 @@ include globals.local
 noblacklist ${HOME}/.WebStorm*
 noblacklist ${HOME}/.android
 noblacklist ${HOME}/.local/share/JetBrains
-noblacklist ${HOME}/.ssh
 noblacklist ${HOME}/.tooling
 
 # Allows files commonly used by IDEs
 include allow-common-devel.inc
 
+# Allow ssh (blacklisted by disable-common.inc)
+include allow-ssh.inc
+
 noblacklist ${PATH}/node
 noblacklist ${HOME}/.nvm
 
diff --git a/etc/profile-m-z/x2goclient.profile b/etc/profile-m-z/x2goclient.profile
index bc9603835..6146016b2 100644
--- a/etc/profile-m-z/x2goclient.profile
+++ b/etc/profile-m-z/x2goclient.profile
@@ -6,10 +6,12 @@ include x2goclient.local
 # Persistent global definitions
 include globals.local
 
-noblacklist ${HOME}/.ssh
 noblacklist ${HOME}/.x2go
 noblacklist ${HOME}/.x2goclient
 
+# Allow ssh (blacklisted by disable-common.inc)
+include allow-ssh.inc
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc