4 files changed, 12 insertions, 3 deletions

diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 3344c3a1f..91c554f2e 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -194,6 +194,9 @@ read-only ${HOME}/.zshenv
 read-only ${HOME}/.zshrc
 read-only ${HOME}/.zshrc.local
 
+# Remote access
+read-only ${HOME}/.ssh/authorized_keys
+
 # Initialization files that allow arbitrary command execution
 read-only ${HOME}/.caffrc
 read-only ${HOME}/.dotfiles
diff --git a/etc/kwin_x11.profile b/etc/kwin_x11.profile
index 8a578f3f3..3ce4fe80d 100644
--- a/etc/kwin_x11.profile
+++ b/etc/kwin_x11.profile
@@ -33,8 +33,11 @@ tracelog
 disable-mnt
 private-bin kwin_x11
 private-dev
-private-etc drirc,ld.so.cache,machine-id,xdg
+private-etc drirc,fonts,ld.so.cache,machine-id,xdg
 private-tmp
 
-# noexec ${HOME}
+# disable QML disk caching as it conflicts with the noexec constraints below
+env QML_DISABLE_DISK_CACHE=1
+
+noexec ${HOME}
 noexec /tmp
diff --git a/etc/okular.profile b/etc/okular.profile
index e71cd1880..59c93bdb0 100644
--- a/etc/okular.profile
+++ b/etc/okular.profile
@@ -45,6 +45,9 @@ private-dev
 private-etc alternatives,cups,fonts,ld.so.cache,machine-id
 # private-tmp - on KDE we need access to the real /tmp for data exchange with thunderbird
 
+# disable QML disk caching as it conflicts with the noexec constraints below
+env QML_DISABLE_DISK_CACHE=1
+
 # memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
diff --git a/etc/steam.profile b/etc/steam.profile
index 33c082533..a683bcc19 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -47,5 +47,5 @@ shell none
 # private-dev should be commented for controllers
 private-dev
 # private-etc breaks some games
-#private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,ld.so.conf,ld.so.conf.d,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl
+#private-etc asound.conf,ca-certificates,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,ld.so.conf,ld.so.conf.d,localtime,lsb-release,machine-id,mime.types,passwd,pulse,resolv.conf,ssl,services
 private-tmp