diff --git a/it-and-security/lib/macos/configuration-profiles/santa-configuration-no-rules-or-sync-server.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-configuration-no-rules-or-sync-server.mobileconfig new file mode 100644 index 0000000000..9a056ac6a8 --- /dev/null +++ b/it-and-security/lib/macos/configuration-profiles/santa-configuration-no-rules-or-sync-server.mobileconfig @@ -0,0 +1,77 @@ + + + + + PayloadContent + + + PayloadContent + + com.northpolesec.santa + + Forced + + + mcx_preference_settings + + BannedBlockMessage + This application has been banned + ClientMode + 1 + EnablePageZeroProtection + + EnableSilentMode + + FileChangesRegex + ^/(?!(?:private/tmp|Library/(?:Caches|Managed Installs/Logs|(?:Managed )?Preferences))/) + MachineIDKey + MachineUUID + MachineIDPlist + /Library/Preferences/com.company.machine-mapping.plist + MachineOwnerKey + Owner + MachineOwnerPlist + /Library/Preferences/com.company.machine-mapping.plist + ModeNotificationLockdown + Entering Lockdown mode + ModeNotificationMonitor + Entering Monitor mode<br/>Please be careful! + UnknownBlockMessage + This application has been blocked from executing. + + + + + + PayloadEnabled + + PayloadIdentifier + 0342c558-a101-4a08-a0b9-40cc00039ea5 + PayloadType + com.apple.ManagedClient.preferences + PayloadUUID + 0342c558-a101-4a08-a0b9-40cc00039ea5 + PayloadVersion + 1 + + + PayloadDescription + com.northpolesec.santa + PayloadDisplayName + Santa - Configuration (no rules or sync server) + PayloadIdentifier + com.northpolesec.santa + PayloadOrganization + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + 9020fb2d-cab3-420f-9268-acca4868bdd0 + PayloadVersion + 1 + + diff --git a/it-and-security/lib/macos/configuration-profiles/santa-notification-settings.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-notification-settings.mobileconfig new file mode 100644 index 0000000000..928979a2b6 --- /dev/null +++ b/it-and-security/lib/macos/configuration-profiles/santa-notification-settings.mobileconfig @@ -0,0 +1,64 @@ + + + + + PayloadContent + + + NotificationSettings + + + AlertType + 1 + BadgesEnabled + + BundleIdentifier + com.northpolesec.santa + CriticalAlertEnabled + + NotificationsEnabled + + ShowInLockScreen + + ShowInNotificationCenter + + SoundsEnabled + + + + PayloadDisplayName + Notifications Payload + PayloadIdentifier + com.northpolesec.santa.notificationsettings.F1817DA0-0044-43DD-9540-36EBC60FDA8F + PayloadOrganization + + PayloadType + com.apple.notificationsettings + PayloadUUID + 510236AE-D7F8-4131-A4CA-5CC930C51866 + PayloadVersion + 1 + + + PayloadDescription + Configures your Mac to automatically enable Notifications settings for Santa + PayloadDisplayName + Santa - Notifications settings + PayloadEnabled + + PayloadIdentifier + com.northpolesec.santa.notificationsettings.069CA123-6129-46A5-8FD1-49322E5A5755 + PayloadOrganization + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + 069CA123-6129-46A5-8FD1-49322E5A5755 + PayloadVersion + 1 + + diff --git a/it-and-security/lib/macos/configuration-profiles/santa-service-management.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-service-management.mobileconfig new file mode 100644 index 0000000000..f6cb401a7f --- /dev/null +++ b/it-and-security/lib/macos/configuration-profiles/santa-service-management.mobileconfig @@ -0,0 +1,36 @@ + + + + + PayloadContent + + + PayloadIdentifier + servicemanagement.santa.example.mobileconfig + PayloadUUID + 0d4e2ece-dfa7-4103-97ff-e91a9f842a1d + PayloadType + com.apple.servicemanagement + Rules + + + RuleType + TeamIdentifier + RuleValue + ZMCG7MLDV9 + + + + + PayloadDisplayName + Santa - Service management + PayloadIdentifier + com.northpolesec.santa.servicemanagement.03cca12c-a610-44c2-96f9-fdabe3acd47d + PayloadUUID + 03cca12c-a610-44c2-96f9-fdabe3acd47d + PayloadType + Configuration + PayloadScope + System + + diff --git a/it-and-security/lib/macos/configuration-profiles/santa-system-extension-policy.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-system-extension-policy.mobileconfig new file mode 100644 index 0000000000..59f4abba3b --- /dev/null +++ b/it-and-security/lib/macos/configuration-profiles/santa-system-extension-policy.mobileconfig @@ -0,0 +1,65 @@ + + + + + + + PayloadUUID + 40C19D5B-76D7-4C1C-BC9D-2F7EB29CFF4D + PayloadType + Configuration + PayloadOrganization + + PayloadIdentifier + com.northpolesec.santa.system-extension-policy.40C19D5B-76D7-4C1C-BC9D-2F7EB29CFF4D + PayloadDisplayName + Santa - System Extensions + PayloadDescription + Configures your Mac to automatically enable Santa's EndpointSecurityExtension + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 98D01A7B-ADC1-43C8-AB8E-8BDC25FCA3C9 + PayloadType + com.apple.system-extension-policy + PayloadOrganization + + PayloadIdentifier + com.northpolesec.santa.system-extension-policy.98D01A7B-ADC1-43C8-AB8E-8BDC25FCA3C9 + PayloadDisplayName + Santa - System extensions + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + AllowUserOverrides + + AllowedSystemExtensions + + ZMCG7MLDV9 + + com.northpolesec.santa.daemon + + + AllowedSystemExtensionTypes + + ZMCG7MLDV9 + + EndpointSecurityExtension + + + + + + diff --git a/it-and-security/lib/macos/configuration-profiles/santa-tcc-configuration-profile-policy.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-tcc-configuration-profile-policy.mobileconfig new file mode 100644 index 0000000000..49db6abe22 --- /dev/null +++ b/it-and-security/lib/macos/configuration-profiles/santa-tcc-configuration-profile-policy.mobileconfig @@ -0,0 +1,90 @@ + + + + + + PayloadContent + + + PayloadDescription + Configures Privacy Preferences Policy Control settings + PayloadDisplayName + Santa - Privacy Preferences Policy Control + PayloadIdentifier + com.northpolesec.santa.TCC.configuration-profile-policy.2416BA4B-CBFC-4719-B02F-20251B881D6F + PayloadOrganization + + PayloadType + com.apple.TCC.configuration-profile-policy + PayloadUUID + 2416BA4B-CBFC-4719-B02F-20251B881D6F + PayloadVersion + 1 + Services + + SystemPolicyAllFiles + + + Allowed + + CodeRequirement + identifier "com.northpolesec.santa.daemon" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9 + Comment + + Identifier + com.northpolesec.santa.daemon + IdentifierType + bundleID + StaticCode + + + + Allowed + + CodeRequirement + identifier "com.northpolesec.santa.bundleservice" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9 + Comment + + Identifier + com.northpolesec.santa.bundleservice + IdentifierType + bundleID + StaticCode + + + + Allowed + + CodeRequirement + identifier "com.northpolesec.santa" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9 + Comment + + Identifier + com.northpolesec.santa + IdentifierType + bundleID + StaticCode + + + + + + + PayloadDescription + tcc.configuration-profile-policy.santa.example + PayloadDisplayName + Santa - TCC configuration + PayloadIdentifier + com.northpolesec.santa.TCC.configuration-profile-policy.089CBCFB-F2AA-407C-9F2A-A12967FE20BC + PayloadOrganization + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + 089CBCFB-F2AA-407C-9F2A-A12967FE20BC + PayloadVersion + 1 + + diff --git a/it-and-security/lib/macos/scripts/santa-block-script.sh b/it-and-security/lib/macos/scripts/santa-block-script.sh new file mode 100644 index 0000000000..dcd98d6889 --- /dev/null +++ b/it-and-security/lib/macos/scripts/santa-block-script.sh @@ -0,0 +1,45 @@ +#!/bin/bash +# Define variables +# Array of SHA256 identifiers to blacklist +IDENTIFIERS=( + # Script2Pkg - just an example, love the app + "1096ef7c46e862a8fae75c1a1147b94106b96f009acf8cfd92c9d09c17b1f1e3" + # WebEx + "8a63cad62a9b1dfcad86b280ec9ad205f08f8bc734311d954e1d451649cb2d93" +) +CUSTOM_MSG="This application has been blocked by our security policy." +SANTACTL="/usr/local/bin/santactl" + +# Check if running as root/sudo +if [ "$EUID" -ne 0 ]; then + echo "Error: This script must be run as root or with sudo privileges." + exit 1 +fi + +# Check if santactl exists at the specified path +if [ ! -x "$SANTACTL" ]; then + echo "Error: santactl not found at $SANTACTL or not executable." + exit 1 +fi + +# Process each identifier in the array +for IDENTIFIER in "${IDENTIFIERS[@]}"; do + echo "Adding blocking rule for identifier: $IDENTIFIER" + "$SANTACTL" rule --blacklist --sha256 "$IDENTIFIER" --message "$CUSTOM_MSG" + + # Verify the rule was added + echo "Verifying rule was added..." + CHECK_OUTPUT=$("$SANTACTL" rule --check --sha256 "$IDENTIFIER") + echo "Rule check output: $CHECK_OUTPUT" + + # Check if the output contains any indication of a rule + if [ -n "$CHECK_OUTPUT" ]; then + echo "✅ Rule successfully applied for $IDENTIFIER" + else + echo "❌ Failed to apply rule for $IDENTIFIER" + fi + + echo "---------------------------------" +done + +echo "All rule operations completed." diff --git a/it-and-security/lib/macos/software/santa.yml b/it-and-security/lib/macos/software/santa.yml new file mode 100644 index 0000000000..597f88fc67 --- /dev/null +++ b/it-and-security/lib/macos/software/santa.yml @@ -0,0 +1,4 @@ +url: https://github.com/northpolesec/santa/releases/download/2025.1/santa-2025.1.pkg +self_service: true +labels_include_any: + - "Santa test device" diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml index a19fe72f55..a09b4e5a47 100644 --- a/it-and-security/teams/workstations-canary.yml +++ b/it-and-security/teams/workstations-canary.yml @@ -90,6 +90,21 @@ controls: - path: ../lib/macos/configuration-profiles/automatically-update-1Password.mobileconfig labels_include_any: - "Macs with 1Password8 installed" + - path: ../lib/macos/configuration-profiles/santa-configuration-no-rules-or-sync-server.mobileconfig + labels_include_any: + - "Santa test device" + - path: ../lib/macos/configuration-profiles/santa-tcc-configuration-profile-policy.mobileconfig + labels_include_any: + - "Santa test device" + - path: ../lib/macos/configuration-profiles/santa-system-extension-policy.mobileconfig + labels_include_any: + - "Santa test device" + - path: ../lib/macos/configuration-profiles/santa-service-management.mobileconfig + labels_include_any: + - "Santa test device" + - path: ../lib/macos/configuration-profiles/santa-notification-settings.mobileconfig + labels_include_any: + - "Santa test device" macos_setup: bootstrap_package: "" enable_end_user_authentication: false @@ -135,6 +150,7 @@ queries: software: packages: - path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal) + - path: ../lib/macos/software/santa.yml # Santa for macOS - path: ../lib/linux/software/zoom-deb.yml # Zoom for Ubuntu - path: ../lib/linux/software/zoom-rpm.yml # Zoom for RedHat - path: ../lib/linux/software/slack-deb.yml # Slack for Ubuntu