Shortly after, I wrote its spiritual cousin, envblock, which uses eBPF to stop untrusted programs from receiving real values of GH_TOKEN, AWS keys, and similar environment variables (it poisons them instead).
I’ve been running both on my own machines for months. They are intentionally small and narrow (67 KB and 119 KB). Setup is usually under an hour once you know which directories and variables matter. Config is TOML, dry-run modes exist, and they fail open / poison rather than try to be a full MAC system.
I’ve just been allowed to open source them.
https://github.com/roku-oss/dirblock
https://github.com/roku-oss/envblock
Happy to answer questions.
pfrench42•43m ago
I ALWAYS have at least dirblock running whenever I do any package updates, I generally don't keep env secrets set in my shells, so nothing to exfil by supply attacks there, but there's been a lot of interest by the CI teams for this.
Again, they're small, user-mode programs with setcap applied to do their work, so they sit in my ~/.local/bin/ directory rather than being a big, blessed install.
Shell snippet:
pfrench@fw:~/proj/system/$$ GH_TOKEN=test_gh_tokenajsdflsadfas env | grep TOKEN
GH_TOKEN=ghp_A3XjNOKg7iDHepAEGBRbz
pfrench@fw:~/proj/system/$ less ~/.ssh/config
/home/pfrench/.ssh/config: Operation not permitted