northpolesec / santa

A binary authorization and monitoring system for macOS
https://northpole.dev
Apache License 2.0
30 stars 4 forks source link

Standalone Mode (beta) #5

Open pmarkowsky opened 6 days ago

pmarkowsky commented 6 days ago

This PR creates a new Santa operating mode -- standalone

This adds a new operating mode to Santa called standalone mode.

When running in standalone mode TouchID can be used to approved binaries. If a binary is properly signed a SigningID rule is generated otherwise a SHA256 rule is generated. Note this lacks a GUI for browsing rules in the local rule db.

Example video of behavior attached (has the wrong logo):

Standalone Santa Operation

This PR is marked draft until the following things are added

  1. Comments are cleaned up
  2. Documentation is updated
  3. Tests are updated
  4. We decide if this is the right place to put the auth

Aside I've been running with this mode for a month+.