google/santaArchived
Santa
Santa es un sistema de autorización de binarios para macOS diseñado para controlar y monitorear qué binarios pueden ejecutarse basándose en reglas de confianza definidas. Funciona como un software de lista blanca de aplicaciones que evita que programas no autorizados se ejecuten verificándolos contra hashes criptográficos y certificados de firma.
El sistema proporciona monitoreo de ejecución registrando cada evento de lanzamiento de binario para crear un rastro visible de ejecución de software. Permite el registro de auditoría centralizado para rastrear lanzamientos de aplicaciones exitosos y denegados en múltiples dispositivos, asegurando el cumplimiento de dispositivos empresariales mediante reglas y registros sincronizados.
El control se gestiona a través de un sistema de reglas que utiliza sumas de verificación criptográficas, verificación de firmas digitales y coincidencia de rutas mediante expresiones regulares. El framework incluye la interceptación de ejecución a nivel de kernel para verificar los binarios antes de que se ejecuten y mantiene una base de datos local para registrar la actividad y auditar.
Features
- Binary Authorization Systems - Controls which applications and binaries can run on macOS devices using allow-lists and block-lists.
- Binary Execution Tracking - Saves binary launch events and denied execution attempts into a database for security auditing and aggregation.
- Binary Execution Authorization - Restricts the execution of binaries by verifying them against defined allow-lists or block-lists.
- Hash-Based Binary Identification - Uses cryptographic checksums to uniquely identify files regardless of their name or location on the disk.
- Local Security Auditing - Records denied execution attempts and software launches on the local machine to identify security policy violations.
- Digital Signature Verifications - Validates the identity of software developers by checking digital signatures against a trusted root of authority.
- Software Trust Rule Management - Defines software trust by setting binary permissions using cryptographic hashes, signing certificates, or regular expression path matches.
- Kernel Execution Hooks - Implements kernel-level interception of system calls to verify binaries before they are allowed to execute.
- Audit Logs - Provides a centralized logging system to track successful and denied application launches across multiple devices.
- Execution Audit Trails - Tracks and logs every binary execution on the system to maintain a complete software execution audit trail.
- Application Whitelisting Software - Prevents unauthorized software from running by checking binaries against cryptographic hashes and signing certificates.
- Event Auditing Storage - Records binary execution attempts and system events in a local SQLite database for reliable auditing.
- Resource Path Matching - Filters binary execution permissions based on directory patterns and file path naming conventions using regular expressions.
- MacOS System Extensions - Functions as a system extension that monitors and controls binary execution based on trust rules.
- Remote Rule Synchronization - Provides synchronization of binary execution rules and event logs with a central remote server.
- Security Policy Synchronizations - Synchronizes allow-lists and block-lists from a central server to maintain consistent security policies across a fleet.
- Enterprise Compliance Protocols - Ensures managed macOS computers adhere to organizational software execution policies via rule and log synchronization.
- macOS System Monitors - Monitors binary launch events on macOS to create a visible software execution trail.
- Search Utilities - Binary whitelisting and blacklisting system for macOS.
- Endpoint Security - Manages binary allow-listing and deny-listing for macOS.
- Seguridad y privacidad - System-level binary whitelisting and blacklisting utility.
- System Monitoring and Auditing - Binary whitelisting and blacklisting system for macOS.
- System Security Hardening - Binary whitelisting and blacklisting system.
