Santa

About

Santa is a binary and file access authorization system for macOS. It includes a system extension that monitors for executions and file access and makes decisions based on a local database, a GUI agent that notifies the user when a block decision is made, a background service that synchronizes configuration with a remote server, and a command-line utility for managing the system. Its name reflects its purpose of tracking binaries that are naughty or nice.

Santa offers two modes: MONITOR, the default, which allows all binaries except those marked as blocked while logging launches, and LOCKDOWN, which allows only listed binaries to run. Rules can be based on code signatures (CDHash, Certificate, TeamID, or SigningID) rather than only file hashes, and are applied in most-specific order. Path-based rules using regular expressions are also supported and have the lowest precedence. Santa includes failsafe certificate rules that prevent blocking the certificate used to sign launchd, and it cannot block itself. Its userland components verify each other's signing certificates before communicating over XPC, and allowed binaries are cached.

Santa is not presented as providing complete security; it is intended to help protect users from themselves and is part of a defense-in-depth strategy. Known limitations include that it only blocks execution, not dynamic libraries loaded with dlopen, replaced libraries on disk, or libraries loaded via DYLD_INSERT_LIBRARIES, and it currently ignores executions that aren't binaries, such as scripts.