santa
santa copied to clipboard
google
A binary authorization and monitoring system for macOS
Now that Santa no longer needs an in-kernel cache implementation, we should replace the current implementation with one that is more full featured and implements LRU semantics. One potential option...
Log the bundle version in our execution log output when a binary is part of a bundle.
Hello, We are having an issue implementing blocking / allowing via regex paths for some specific use cases. We have the following rules set up in Moroz: ``` client_mode =...
I certainly don't want to be asking for a million knobs, but would a 'just nag' mode be acceptable? While in a limited testing deployment I feel like I'd rather...
The current documentation [0] does not yet mention bundles [1] and how those influence allow/deny behavior. A quick mention of the new evaluation precedence that includes bundles would be nice....
It would be great if we can output fileinfo for the blocked binary which shows the SHA for cert and publisher ID Or to take this even further can we...
For apps downloaded from the web the publisher field shows the 10 char ID for the team while for app store apps it its says Apple signed publisher. I have...
Proto3 has a canonical JSON encoding for proto messages (though as far as I can tell this isn't supported by the Objective-C library at the moment). It would be nice...
Would it be useful to add a "sync" button in Santa's about window that syncs rules? https://github.com/google/santa/blob/main/Source/santa/SNTAboutWindowController.m One issue is getting user permissions since it seems like sync sometimes needs...
As explained in the design doc Santa makes no attempt to support blocking of shell scripts - which is understandable in general. But in the case of a user double...
