SELinux in general isn't that hard imo, but it also wouldn't stop this attack in the default configuration. You may consider writing a custom SELinux policy su

SELinux in general isn't that hard imo, but it also wouldn't stop this attack in the default configuration. You may consider writing a custom SELinux policy such that only the git executable can access the .git directory. This would be a much more useful mitigation against this attack, but it would also move the difficulty barrier significantly.