4.7
Santa
A binary authorization and monitoring system for macOS
SHARE
Screenshots (1)
Screenshot 1 of 1
Overview
Santa is a battle-tested, enterprise-grade binary authorization and system monitoring framework for macOS originally engineered at Google. Powered by Apple's Endpoint Security framework, Santa enforces execution allow/deny policies across managed fleets using cryptographic SHA-256 binary hashes, Developer Team IDs, or signing certificates in either auditing Monitor or strict Lockdown mode.
How It Works
Santa operates through structured, deterministic execution stages:
Endpoint Security Execution Gate: Intercepts
execve system calls across macOS to validate binary integrity prior to process image mapping.Monitor & Strict Lockdown Modes: Operates either in permissive logging mode for telemetry auditing or Lockdown mode blocking unapproved executables.
Cryptographic SHA-256 & Certificate Rules: Authorizes or blocks executables reliably by cryptographic hash, Apple Team ID, or code-signing certificate chain.
Local SQLite Rule Cache & Fleet Sync: Stores offline allow/deny rules in local SQLite for instantaneous evaluations while syncing policies with sync servers.
Santa macOS binary authorization blocking an unapproved executable
Key Technical Features & Capabilities
Kernel-Free Endpoint Security Gate: Evaluates every binary execution on macOS asynchronously via Apple's Endpoint Security subsystem with sub-millisecond SQLite caches.
Monitor & Lockdown Enforcement Modes: Log unknown software cleanly across fleets in Monitor mode, or block any unapproved binary instantly in Lockdown mode.
Granular Cryptographic Rules: Allow or deny applications deterministically by SHA-256 digest, Apple Developer Team ID, signing ID, or certificate chain.
**Central Fleet Sync &
santactl CLI**: Synchronizes policies with central management servers (Moroz, Zentral, NorthPole) while providing instant santactl terminal control.Architecture & Technology Stack
Primary Languages: Objective-C++, Swift, Protocol Buffers
System Frameworks: Apple Endpoint Security Framework (
com.google.santa.daemon), FMDB / SQLiteBuild System: Bazel
Supported Platforms: macOS 12+ (Universal Apple Silicon & Intel)
System Requirements
| Specification | Minimum Requirement | Recommended Specification |
|---|---|---|
| Operating System | macOS 12.0+ (Universal Apple Silicon & Intel) | Latest stable release build |
| Processor Architecture | 4-Core x86_64 or Apple Silicon M1 | 8-Core Apple Silicon / Core i7+ |
| Memory (RAM) | 4 GB Unified Memory | 16 GB+ High-Speed RAM |
| Disk Space | 1 GB free SSD storage | 5 GB+ free SSD storage |
Installation & Setup Guide
macOS Installation
1
Download
santa-2024.9.dmg from CookApps or install via Homebrew: brew install --cask santa.2
Install the
.pkg inside the mounted DMG and approve the System Extension & Full Disk Access permissions under System Settings.Building from Source
bash
git clone https://github.com/google/santa.git cd santa bazel build //Source/santa/...
How to Use & Workflow
1
Verify Running Daemon: Confirm status with
santactl status in Terminal after enabling the System Extension.2
Check Binary Execution Decisions: Inspect executable signing certificates via
santactl fileinfo /Applications/Example.app.3
Create Local Test Rules: Add explicit allow or block rules during testing using
sudo santactl rule --allow|--block --path /path/to/binary.Troubleshooting & Common Issues
**Issue:
santactl status reports System Extension not active.***Cause*: macOS awaits interactive user confirmation under Privacy & Security for new Endpoint Security extensions.
*Resolution*: Open System Settings › Privacy & Security › Security and click Allow next to Santa, and enable Full Disk Access for
com.google.santa.daemon.How to Use & Getting Started
## Installation & Setup Guide
### macOS Installation
1. Download `santa-2024.9.dmg` from CookApps or install via Homebrew: `brew install --cask santa`.
2. Install the `.pkg` inside the mounted DMG and approve the System Extension & Full Disk Access permissions under **System Settings**.
### Building from Source
```bash
git clone https://github.com/google/santa.git
cd santa
bazel build //Source/santa/...
```
Ready to run Santa?
100% Free & Open-Source native desktop software. Star the repository to support development.
