Adding santa for testing (#26586)
Adding santa for testing: https://github.com/fleetdm/fleet/issues/24910
This commit is contained in:
Allen Houchins
+77
@@ -0,0 +1,77 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<dict>
|
||||
<key>com.northpolesec.santa</key>
|
||||
<dict>
|
||||
<key>Forced</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>mcx_preference_settings</key>
|
||||
<dict>
|
||||
<key>BannedBlockMessage</key>
|
||||
<string>This application has been banned</string>
|
||||
<key>ClientMode</key>
|
||||
<integer>1</integer>
|
||||
<key>EnablePageZeroProtection</key>
|
||||
<false/>
|
||||
<key>EnableSilentMode</key>
|
||||
<false/>
|
||||
<key>FileChangesRegex</key>
|
||||
<string>^/(?!(?:private/tmp|Library/(?:Caches|Managed Installs/Logs|(?:Managed )?Preferences))/)</string>
|
||||
<key>MachineIDKey</key>
|
||||
<string>MachineUUID</string>
|
||||
<key>MachineIDPlist</key>
|
||||
<string>/Library/Preferences/com.company.machine-mapping.plist</string>
|
||||
<key>MachineOwnerKey</key>
|
||||
<string>Owner</string>
|
||||
<key>MachineOwnerPlist</key>
|
||||
<string>/Library/Preferences/com.company.machine-mapping.plist</string>
|
||||
<key>ModeNotificationLockdown</key>
|
||||
<string>Entering Lockdown mode</string>
|
||||
<key>ModeNotificationMonitor</key>
|
||||
<string>Entering Monitor mode<br/>Please be careful!</string>
|
||||
<key>UnknownBlockMessage</key>
|
||||
<string>This application has been blocked from executing.</string>
|
||||
</dict>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</dict>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>0342c558-a101-4a08-a0b9-40cc00039ea5</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.ManagedClient.preferences</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>0342c558-a101-4a08-a0b9-40cc00039ea5</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>com.northpolesec.santa</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Santa - Configuration (no rules or sync server)</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.northpolesec.santa</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string></string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<true/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>9020fb2d-cab3-420f-9268-acca4868bdd0</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
+64
@@ -0,0 +1,64 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>NotificationSettings</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>AlertType</key>
|
||||
<integer>1</integer>
|
||||
<key>BadgesEnabled</key>
|
||||
<true/>
|
||||
<key>BundleIdentifier</key>
|
||||
<string>com.northpolesec.santa</string>
|
||||
<key>CriticalAlertEnabled</key>
|
||||
<true/>
|
||||
<key>NotificationsEnabled</key>
|
||||
<true/>
|
||||
<key>ShowInLockScreen</key>
|
||||
<true/>
|
||||
<key>ShowInNotificationCenter</key>
|
||||
<true/>
|
||||
<key>SoundsEnabled</key>
|
||||
<false/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Notifications Payload</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.northpolesec.santa.notificationsettings.F1817DA0-0044-43DD-9540-36EBC60FDA8F</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string></string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.notificationsettings</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>510236AE-D7F8-4131-A4CA-5CC930C51866</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures your Mac to automatically enable Notifications settings for Santa</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Santa - Notifications settings</string>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.northpolesec.santa.notificationsettings.069CA123-6129-46A5-8FD1-49322E5A5755</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string></string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<true/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>069CA123-6129-46A5-8FD1-49322E5A5755</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
+36
@@ -0,0 +1,36 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>servicemanagement.santa.example.mobileconfig</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>0d4e2ece-dfa7-4103-97ff-e91a9f842a1d</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.servicemanagement</string>
|
||||
<key>Rules</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>RuleType</key>
|
||||
<string>TeamIdentifier</string>
|
||||
<key>RuleValue</key>
|
||||
<string>ZMCG7MLDV9</string>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Santa - Service management</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.northpolesec.santa.servicemanagement.03cca12c-a610-44c2-96f9-fdabe3acd47d</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>03cca12c-a610-44c2-96f9-fdabe3acd47d</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
</dict>
|
||||
</plist>
|
||||
+65
@@ -0,0 +1,65 @@
|
||||
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1">
|
||||
<dict>
|
||||
<!-- See https://developer.apple.com/documentation/devicemanagement/systemextensions for payload descriptions -->
|
||||
<key>PayloadUUID</key>
|
||||
<string>40C19D5B-76D7-4C1C-BC9D-2F7EB29CFF4D</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string></string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.northpolesec.santa.system-extension-policy.40C19D5B-76D7-4C1C-BC9D-2F7EB29CFF4D</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Santa - System Extensions</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures your Mac to automatically enable Santa's EndpointSecurityExtension</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<true/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>98D01A7B-ADC1-43C8-AB8E-8BDC25FCA3C9</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.system-extension-policy</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string></string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.northpolesec.santa.system-extension-policy.98D01A7B-ADC1-43C8-AB8E-8BDC25FCA3C9</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Santa - System extensions</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>AllowUserOverrides</key>
|
||||
<true/>
|
||||
<key>AllowedSystemExtensions</key>
|
||||
<dict>
|
||||
<key>ZMCG7MLDV9</key>
|
||||
<array>
|
||||
<string>com.northpolesec.santa.daemon</string>
|
||||
</array>
|
||||
</dict>
|
||||
<key>AllowedSystemExtensionTypes</key>
|
||||
<dict>
|
||||
<key>ZMCG7MLDV9</key>
|
||||
<array>
|
||||
<string>EndpointSecurityExtension</string>
|
||||
</array>
|
||||
</dict>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</plist>
|
||||
+90
@@ -0,0 +1,90 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<!-- See https://developer.apple.com/documentation/devicemanagement/privacypreferencespolicycontrol for payload descriptions -->
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures Privacy Preferences Policy Control settings</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Santa - Privacy Preferences Policy Control</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.northpolesec.santa.TCC.configuration-profile-policy.2416BA4B-CBFC-4719-B02F-20251B881D6F</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string></string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.TCC.configuration-profile-policy</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>2416BA4B-CBFC-4719-B02F-20251B881D6F</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>Services</key>
|
||||
<dict>
|
||||
<key>SystemPolicyAllFiles</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>Allowed</key>
|
||||
<true/>
|
||||
<key>CodeRequirement</key>
|
||||
<string>identifier "com.northpolesec.santa.daemon" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9</string>
|
||||
<key>Comment</key>
|
||||
<string></string>
|
||||
<key>Identifier</key>
|
||||
<string>com.northpolesec.santa.daemon</string>
|
||||
<key>IdentifierType</key>
|
||||
<string>bundleID</string>
|
||||
<key>StaticCode</key>
|
||||
<false/>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>Allowed</key>
|
||||
<true/>
|
||||
<key>CodeRequirement</key>
|
||||
<string>identifier "com.northpolesec.santa.bundleservice" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9</string>
|
||||
<key>Comment</key>
|
||||
<string></string>
|
||||
<key>Identifier</key>
|
||||
<string>com.northpolesec.santa.bundleservice</string>
|
||||
<key>IdentifierType</key>
|
||||
<string>bundleID</string>
|
||||
<key>StaticCode</key>
|
||||
<false/>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>Allowed</key>
|
||||
<true/>
|
||||
<key>CodeRequirement</key>
|
||||
<string>identifier "com.northpolesec.santa" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9</string>
|
||||
<key>Comment</key>
|
||||
<string></string>
|
||||
<key>Identifier</key>
|
||||
<string>com.northpolesec.santa</string>
|
||||
<key>IdentifierType</key>
|
||||
<string>bundleID</string>
|
||||
<key>StaticCode</key>
|
||||
<false/>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>tcc.configuration-profile-policy.santa.example</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Santa - TCC configuration</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.northpolesec.santa.TCC.configuration-profile-policy.089CBCFB-F2AA-407C-9F2A-A12967FE20BC</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string></string>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>089CBCFB-F2AA-407C-9F2A-A12967FE20BC</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
@@ -0,0 +1,45 @@
|
||||
#!/bin/bash
|
||||
# Define variables
|
||||
# Array of SHA256 identifiers to blacklist
|
||||
IDENTIFIERS=(
|
||||
# Script2Pkg - just an example, love the app
|
||||
"1096ef7c46e862a8fae75c1a1147b94106b96f009acf8cfd92c9d09c17b1f1e3"
|
||||
# WebEx
|
||||
"8a63cad62a9b1dfcad86b280ec9ad205f08f8bc734311d954e1d451649cb2d93"
|
||||
)
|
||||
CUSTOM_MSG="This application has been blocked by our security policy."
|
||||
SANTACTL="/usr/local/bin/santactl"
|
||||
|
||||
# Check if running as root/sudo
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "Error: This script must be run as root or with sudo privileges."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if santactl exists at the specified path
|
||||
if [ ! -x "$SANTACTL" ]; then
|
||||
echo "Error: santactl not found at $SANTACTL or not executable."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Process each identifier in the array
|
||||
for IDENTIFIER in "${IDENTIFIERS[@]}"; do
|
||||
echo "Adding blocking rule for identifier: $IDENTIFIER"
|
||||
"$SANTACTL" rule --blacklist --sha256 "$IDENTIFIER" --message "$CUSTOM_MSG"
|
||||
|
||||
# Verify the rule was added
|
||||
echo "Verifying rule was added..."
|
||||
CHECK_OUTPUT=$("$SANTACTL" rule --check --sha256 "$IDENTIFIER")
|
||||
echo "Rule check output: $CHECK_OUTPUT"
|
||||
|
||||
# Check if the output contains any indication of a rule
|
||||
if [ -n "$CHECK_OUTPUT" ]; then
|
||||
echo "✅ Rule successfully applied for $IDENTIFIER"
|
||||
else
|
||||
echo "❌ Failed to apply rule for $IDENTIFIER"
|
||||
fi
|
||||
|
||||
echo "---------------------------------"
|
||||
done
|
||||
|
||||
echo "All rule operations completed."
|
||||
@@ -0,0 +1,4 @@
|
||||
url: https://github.com/northpolesec/santa/releases/download/2025.1/santa-2025.1.pkg
|
||||
self_service: true
|
||||
labels_include_any:
|
||||
- "Santa test device"
|
||||
@@ -90,6 +90,21 @@ controls:
|
||||
- path: ../lib/macos/configuration-profiles/automatically-update-1Password.mobileconfig
|
||||
labels_include_any:
|
||||
- "Macs with 1Password8 installed"
|
||||
- path: ../lib/macos/configuration-profiles/santa-configuration-no-rules-or-sync-server.mobileconfig
|
||||
labels_include_any:
|
||||
- "Santa test device"
|
||||
- path: ../lib/macos/configuration-profiles/santa-tcc-configuration-profile-policy.mobileconfig
|
||||
labels_include_any:
|
||||
- "Santa test device"
|
||||
- path: ../lib/macos/configuration-profiles/santa-system-extension-policy.mobileconfig
|
||||
labels_include_any:
|
||||
- "Santa test device"
|
||||
- path: ../lib/macos/configuration-profiles/santa-service-management.mobileconfig
|
||||
labels_include_any:
|
||||
- "Santa test device"
|
||||
- path: ../lib/macos/configuration-profiles/santa-notification-settings.mobileconfig
|
||||
labels_include_any:
|
||||
- "Santa test device"
|
||||
macos_setup:
|
||||
bootstrap_package: ""
|
||||
enable_end_user_authentication: false
|
||||
@@ -135,6 +150,7 @@ queries:
|
||||
software:
|
||||
packages:
|
||||
- path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal)
|
||||
- path: ../lib/macos/software/santa.yml # Santa for macOS
|
||||
- path: ../lib/linux/software/zoom-deb.yml # Zoom for Ubuntu
|
||||
- path: ../lib/linux/software/zoom-rpm.yml # Zoom for RedHat
|
||||
- path: ../lib/linux/software/slack-deb.yml # Slack for Ubuntu
|
||||
|
||||
Reference in New Issue
Block a user