restrict access to other files than tmp in repository