# Common whitelist for applications supporting GSSAPI
# NB doesn't currently support the KEYRING: ccache type.

whitelist /etc/krb5*
whitelist /tmp/krb5cc_*
# Debian
whitelist /etc/ssl
# Fedora
whitelist /etc/pki
# KCM
whitelist /run/.heim_org.h5l.kcm-socket
# For sssd-krb5(?) <https://github.com/netblue30/firejail/issues/5492#issuecomment-1557502015>
whitelist /var/lib/sss/pubconf/krb5.include.d/
# debugging
#env KRB5_TRACE=/dev/stdout