diff --git a/.github/travis_deploy.sh b/.github/travis_deploy.sh
index 1eb9c47a..b7d9f8dc 100644
--- a/.github/travis_deploy.sh
+++ b/.github/travis_deploy.sh
@@ -158,6 +158,7 @@ git ls-files -v
 
 umask 077
 [[ -d ~/.ssh ]] || mkdir ~/.ssh
+fix_home_ssh_perms
 repo=$(git config remote.origin.url)
 ssh_repo=${repo/https:\/\/github.com\//git@github.com:}
 eval $(ssh-agent -s)
@@ -166,7 +167,9 @@ openssl aes-256-cbc -d -a -K "$UPX_AUTOMATIC_BUILDS_SSL_KEY" -iv "$UPX_AUTOMATIC
 set -x
 chmod 600 .git/deploy.key
 ssh-add .git/deploy.key
+fix_home_ssh_perms
 ssh-keyscan -H github.com >> ~/.ssh/known_hosts
+fix_home_ssh_perms
 
 let i=0 || true
 while true; do
diff --git a/.github/travis_init.sh b/.github/travis_init.sh
index 3957e5e6..dd672f7d 100644
--- a/.github/travis_init.sh
+++ b/.github/travis_init.sh
@@ -244,4 +244,13 @@ print_settings() {
     ##env | LC_ALL=C sort
 }
 
+fix_home_ssh_perms() {
+    if [[ -d ~/.ssh ]]; then
+        if [[ -x /usr/sbin/restorecon ]]; then
+            /usr/sbin/restorecon -v -R ~/.ssh || true
+        fi
+        chmod -c -R go-rwx ~/.ssh || true
+    fi
+}
+
 true
diff --git a/.github/travis_testsuite_1.sh b/.github/travis_testsuite_1.sh
index 934628d0..3ded6261 100644
--- a/.github/travis_testsuite_1.sh
+++ b/.github/travis_testsuite_1.sh
@@ -44,7 +44,7 @@ testsuite_split_f() {
     fb=$(basename "$1")
     fsubdir=$(basename "$fd")
     # sanity checks
-    if [[ ! -f $f || -z $fsubdir || -z $fb ]]; then
+    if [[ ! -f "$1" || -z "$fsubdir" || -z "$fb" ]]; then
         fd= fb= fsubdir=
     fi
 }