A binary and file access authorization system for macOS that monitors and controls application execution.
Santa is a binary and file access authorization system for macOS that monitors application executions and makes allow/block decisions based on a local rule database. It consists of a system extension, a daemon, a GUI agent, and a command-line utility, working together to prevent unauthorized software from running. The system helps protect against malware and provides visibility into what is executing on Mac computers.
System administrators and security teams managing fleets of macOS devices who need to enforce security policies and prevent unauthorized software execution. It is also suitable for individual security-conscious macOS users.
Developers and organizations choose Santa for its robust, certificate-based rule system that works across software updates, its ability to operate in both monitoring and lockdown modes, and its integration with open-source sync servers for centralized management. It provides a critical layer of execution control as part of a defense-in-depth security strategy.
A binary authorization and monitoring system for macOS
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Allows allowlisting or blocklisting by signing certificate, enabling policy enforcement across software updates without constant hash updates, as detailed in the certificate-based rules feature.
Offers MONITOR mode for logging all executions and LOCKDOWN mode for strict allowlisting, adapting to different security postures from auditing to enforcement.
Integrates with open-source sync servers like Moroz or Rudolph via `santactl`, enabling scalable rule deployment and event aggregation across many Macs, as highlighted in the sync servers section.
Userland components validate each other's signing certificates via XPC before communication, ensuring integrity against tampering, a security feature mentioned in the README.
Does not block dynamic library loading (e.g., via dlopen) or script executions, leaving gaps in runtime security, as admitted in the Known Issues section.
As of 2025, Google no longer maintains Santa, requiring users to migrate to forks like northpolesec/santa for updates and support, noted in the project disclaimer.
Primarily designed for enterprise fleets; local management without a sync server may involve manual CLI configuration, which can be less user-friendly for single devices.