How to prevent git from writing files outside user home directory

Question

Problem:

Hello team,

I'm trying to secure my developer account, the Linux home directory is sitting on top a LUKS encrypted partition.

The idea is that if the machine is stolen then the thief will get a nice bricked system as the encrypted file-system password is asked every time the machine reboots.

Ideally would like to confine any new file creation commands (git clone, cp, tar, etc.) to work only on the home directory and nowhere else on the local file-system.

So what are my options?

Developers do not have directories where they can write files except the /tmp partition, but encrypting it too may be overkill.
Can this be enforced with an SE Linux policy?
GIT_DIR & GIT_WORK_TREE environment variables could be used but that will make things complicated AND does not prevent accidental tar, cp
I also looked into several implementations of 'encrypted git' like gcrypt but I don't know how mature are those projects. And again once repository is cloned out, you can cp, tar the files outside the encrypted area.

Is this feasible?

Maybe I'm looking at the problem with the wrong perspective, any tips will be really appreciated.

Thanks!

Can you make the rootfs read-only then mount /home read/write? — EncryptedWatermelon, Sep 13 '19 at 13:59
But how do to enforce the 'no-writting' rule in /tmp? Making /tmp read only will probably break a lot of stuff. — josevnz, Sep 13 '19 at 14:02
You can use ram for /tmp https://askubuntu.com/questions/173094/how-can-i-use-ram-storage-for-the-tmp-directory-and-how-to-set-a-maximum-amount — EncryptedWatermelon, Sep 13 '19 at 14:08
That looks better but then can make the OS to swap once /tmp gets filled with files (per your link) — josevnz, Sep 13 '19 at 14:31
How big to you anticipate swap getting? How much ram does the machine have? I would say 1GB (or less) would be plenty. My current /tmp is 14MB. — EncryptedWatermelon, Sep 13 '19 at 14:41
Yeah, /tmp is not supposed to be that big and I can always create files on the home directory. — josevnz, Sep 13 '19 at 15:11

score 1 · Accepted Answer · answered Sep 13 '19 at 15:15

1

I would recommend making the rootfs read-only and /home read-write.
/tmp should be mounted with a tempfs
https://askubuntu.com/questions/173094/how-can-i-use-ram-storage-for-the-tmp-directory-and-how-to-set-a-maximum-amount

answered Sep 13 '19 at 15:15

EncryptedWatermelon

4,788
1
12
28

How to prevent git from writing files outside user home directory

Problem:

So what are my options?

Is this feasible?

1 Answers1