Show HN: Dirblock+envblock – tiny whitelist guards for dirs and env secrets

Show HN: Dirblock+envblock – tiny whitelist guards for dirs and env secrets(github.com)

2 points by pfrench42 49 days ago | 1 comment

After I missed getting hit by the LiteLLM attack by 30 minutes, I decided to see what I could do about it and wrote dirblock. It uses fanotify to block access to ~/.ssh, ~/.gpg, etc. with whitelists of trusted programs — everything else is denied.

Shortly after, I wrote its spiritual cousin, envblock, which uses eBPF to stop untrusted programs from receiving real values of GH_TOKEN, AWS keys, and similar environment variables (it poisons them instead).

I’ve been running both on my own machines for months. They are intentionally small and narrow (67 KB and 119 KB). Setup is usually under an hour once you know which directories and variables matter. Config is TOML, dry-run modes exist, and they fail open / poison rather than try to be a full MAC system.

I’ve just been allowed to open source them.

https://github.com/roku-oss/dirblock

https://github.com/roku-oss/envblock

Happy to answer questions.

pfrench42 49 days ago |

In use, I've yet to be hit by a supply attack, but it's definitely discovered that all the AI harnesses freely read each others sessions, claude reads codex history and vice versa.

I ALWAYS have at least dirblock running whenever I do any package updates, I generally don't keep env secrets set in my shells, so nothing to exfil by supply attacks there, but there's been a lot of interest by the CI teams for this.

Again, they're small, user-mode programs with setcap applied to do their work, so they sit in my ~/.local/bin/ directory rather than being a big, blessed install.

Shell snippet:

pfrench@fw:~/proj/system/$$ GH_TOKEN=test_gh_tokenajsdflsadfas env | grep TOKEN

GH_TOKEN=ghp_A3XjNOKg7iDHepAEGBRbz

pfrench@fw:~/proj/system/$ less ~/.ssh/config

/home/pfrench/.ssh/config: Operation not permitted