google/santaArchived
Santa
Santa est un système d'autorisation binaire pour macOS conçu pour contrôler et surveiller quels binaires peuvent s'exécuter en fonction de règles de confiance définies. Il fonctionne comme un logiciel de liste blanche d'applications qui empêche l'exécution de programmes non autorisés en les vérifiant par rapport à des hashs cryptographiques et des certificats de signature.
Le système fournit une surveillance de l'exécution en enregistrant chaque événement de lancement de binaire pour créer une piste d'exécution logicielle visible. Il permet une journalisation d'audit centralisée pour suivre les lancements d'applications réussis et refusés sur plusieurs appareils, garantissant la conformité des appareils d'entreprise via des règles et des logs synchronisés.
Le contrôle est géré via un système de règles qui utilise des sommes de contrôle cryptographiques, la vérification de signature numérique et la correspondance de chemin par expression régulière. Le framework inclut une interception de l'exécution au niveau du noyau pour vérifier les binaires avant leur exécution et maintient une base de données locale pour enregistrer l'activité et l'audit.
Features
- Binary Authorization Systems - Controls which applications and binaries can run on macOS devices using allow-lists and block-lists.
- Binary Execution Tracking - Saves binary launch events and denied execution attempts into a database for security auditing and aggregation.
- Binary Execution Authorization - Restricts the execution of binaries by verifying them against defined allow-lists or block-lists.
- Hash-Based Binary Identification - Uses cryptographic checksums to uniquely identify files regardless of their name or location on the disk.
- Local Security Auditing - Records denied execution attempts and software launches on the local machine to identify security policy violations.
- Digital Signature Verifications - Validates the identity of software developers by checking digital signatures against a trusted root of authority.
- Software Trust Rule Management - Defines software trust by setting binary permissions using cryptographic hashes, signing certificates, or regular expression path matches.
- Kernel Execution Hooks - Implements kernel-level interception of system calls to verify binaries before they are allowed to execute.
- Audit Logs - Provides a centralized logging system to track successful and denied application launches across multiple devices.
- Execution Audit Trails - Tracks and logs every binary execution on the system to maintain a complete software execution audit trail.
- Application Whitelisting Software - Prevents unauthorized software from running by checking binaries against cryptographic hashes and signing certificates.
- Event Auditing Storage - Records binary execution attempts and system events in a local SQLite database for reliable auditing.
- Resource Path Matching - Filters binary execution permissions based on directory patterns and file path naming conventions using regular expressions.
- MacOS System Extensions - Functions as a system extension that monitors and controls binary execution based on trust rules.
- Remote Rule Synchronization - Provides synchronization of binary execution rules and event logs with a central remote server.
- Security Policy Synchronizations - Synchronizes allow-lists and block-lists from a central server to maintain consistent security policies across a fleet.
- Enterprise Compliance Protocols - Ensures managed macOS computers adhere to organizational software execution policies via rule and log synchronization.
- macOS System Monitors - Monitors binary launch events on macOS to create a visible software execution trail.
- Search Utilities - Binary whitelisting and blacklisting system for macOS.
- Endpoint Security - Manages binary allow-listing and deny-listing for macOS.
- Sécurité et confidentialité - System-level binary whitelisting and blacklisting utility.
- System Monitoring and Auditing - Binary whitelisting and blacklisting system for macOS.
- System Security Hardening - Binary whitelisting and blacklisting system.
