keepassxc: ssh-agent feature does not work

[agraven]

Using the standard profile for keepassxc in version 0.9.62 causes the ssh-agent functionality to stop working. I'm running Ubuntu 19.10.

[rusty-snake]

Works it if you allow access to .ssh?

nobalcklist ${HOME}/.ssh
# Other things to go.
# ignore machine-id
# ignore private-tmp
# noblacklist blacklist /tmp/ssh-*
# read-write ${HOME}/.ssh/authorized_keys

[agraven]

Thanks for the quick response! I presume you meant noblacklist ${HOME}/.ssh?

[agraven]

I tried adding all the suggested directives but nothing seemed to change.

As a side note, fetching favicons from websites also doesn't work because network access is disabled, I don't quite understand the networking settings well enough to figure out how to enable it

[rusty-snake]

Network: use host network namespace; allow AF_INET and AF_INET6 sockets; TLS + DNS files in /etc

ignore net none
protocol unix,inet,inet6,netlink
private-etc ca-certificates,ssl,pki,crypto-policies,nsswitch.conf,resolv.conf

[agraven]

Thanks! Would this be worth adding commented out to keepassxc.profile with a comment explaining what enabling them does? I'll gladly make a PR for that if so

[rusty-snake]

Some users probably want to fetch favicons inside keepassxc. Even if internet access relaxes the sandbox and keepassxc is only an blacklisting profile due to #2874.

I make it whitelisting like this, then you have to save the database in ~/Documents/KeePassXC

disable-programs.local:

blacklist ${HOME}/Documents/KeePassXC

keepassxc.local:

noblacklist ${HOME}/Documents/KeePassXC

mkdir ${HOME}/.config/keepassxc
mkdir ${HOME}/.keepassxc
mkdir ${HOME}/Documents/KeePassXC
whitelist ${HOME}/.config/keepassxc
whitelist ${HOME}/.keepassxc
whitelist ${HOME}/.mozilla
whitelist ${HOME}/Documents/KeePassXC
include whitelist-common.inc

[rusty-snake]

Back to the ssh-agent. Is anything in the journal?

[rusty-snake]

I'm closing here due to inactivity, please fell free to reopen if you still have this issue.

#3329 is still open.

[ShellCode33]

noblacklist ${HOME}/.ssh
ignore private-tmp
noblacklist /tmp/ssh-*

Seems to be enough, thanks 👍