Santa

Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service for synchronizing the configuration with a remote server, and a command-line utility for managing the system.

It is named Santa because it keeps track of binaries that are naughty or nice.

The Santa docs are stored in the Docs (opens in a new tab) directory and are published at https://northpole.dev.

The docs include deployment options, details on how parts of Santa work and instructions for developing Santa itself.

If you have questions or otherwise need help getting started, the #santa channel on the macadmins slack (opens in a new tab) is a great place to start.

If you believe you have a bug, feel free to report an issue (opens in a new tab) and we'll respond as soon as we can.

If you believe you've found a vulnerability, please read the security policy (opens in a new tab) for disclosure reporting.

• Multiple modes: In the default MONITOR mode, all binaries except those marked

as blocked will be allowed to run, whilst being logged and recorded in the events database. In LOCKDOWN mode, only listed binaries are allowed to run.

• Event logging: When the system extension is loaded, all binary launches are

logged. When in either mode, all unknown or denied binaries are stored in the database to enable later aggregation.

• Code signing-based rules, with override levels: Instead of relying on a

binary's hash (or 'fingerprint'), executables can be allowed/blocked by their code signature (through CDHash, Certificate, TeamID or SigningID rules). You can therefore allow/block all binaries signed by a publisher or all versions of a signed binary. Rules are applied in most-specific order, which allows you to allow all binaries by a given publisher while blocking one specific signing ID or binary (or vice-versa).

• Path-based rules (via NSRegularExpression/ICU): This allows a similar feature