Show HN: Dirblock+envblock – tiny whitelist guards for dirs and env secrets
https://github.com/roku-oss/dirblock
After I missed getting hit by the LiteLLM attack by 30 minutes, I decided to see what I could do about it and wrote dirblock. It uses fanotify to block access to ~/.ssh, ~/.gpg, etc. with whitelists of trusted programs — everything else is denied.Shortly after, I wrote its spiritual cousin, envblock, which uses eBPF to stop untrusted programs from receiving real values of GH_TOKEN, AWS keys,...