profiles: allow-ssh: allow /etc/ssh/ssh_revoked_hosts

[tools200ms]

Fixes #6308.

[kmk3]

@tools200ms on Apr 12:

ssh in firejail fails to establish connection throwing the following message:

Error checking host key <key removed> in revoked keys file /etc/ssh/ssh_revoked_hosts: Permission denied
Host key verification failed.

I don't have this path on my system (openssh 9.7p1-1 on Artix) and I did not
find it on any ssh man pages, only RevokedHostKeys on ssh_config(5) and
RevokedKeys on sshd_config(5).

Where does this specific path come from?

It does not seem to be standardized; I found mentions of other similar paths:

• /etc/ssh/revoked_host_keys
• /etc/ssh/revoked_keys
• /etc/ssh/ssh_revoked_hosts
• /etc/ssh/sshd_revoked_keys

[tools200ms]

@kmk3
It's from Gentoo net-misc/openssh package (9.6_p1-r3)

[tools200ms]

I didn't found /etc/ssh/*revoked* elsewhere. Shouldn't be there the comment that /etc/ssh/ssh_revoked_hosts is a Gentoo specific file?

[kmk3]

It's from Gentoo net-misc/openssh package (9.6_p1-r3)

Can you amend the commit message to add that detail?

If not I can add it later.

I didn't found /etc/ssh/*revoked* elsewhere. Shouldn't be there the comment
that /etc/ssh/ssh_revoked_hosts is a Gentoo specific file?

Sure, something like this would work:

noblacklist /etc/ssh/ssh_revoked_hosts # RevokedHostKeys on Gentoo