Add Santa system extension policy and script (#43498)

Add detection and remediation for Santa's Endpoint Security system
extension: new policy
it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml
and remediation script
it-and-security/lib/macos/scripts/load-santa-system-extension.sh. Add a
dynamic label for Macs with Santa installed and update the macOS patch
policy to include a Fleet-maintained santa/darwin entry so Fleet can
install/patch Santa. Update workstations fleet config to reference the
new script, policy, and the santa/darwin software slug; remove the old
static santa.yml package file. The policy checks for Santa's bundle id
and the system_extensions record (identifier/team/state) and the script
invokes Santa's binary to request loading the system extension as the
console user.

it-and-security/fleets/workstations.yml

@@ -107,6 +107,8 @@ controls:
     - path: ../lib/windows/scripts/enable-ms-defender.ps1
     - path: ../lib/windows/scripts/create-admin-user.ps1
     - path: ../lib/linux/scripts/uninstall-fleetd-linux.sh
+    - path: ../lib/macos/scripts/nudge-postinstall.sh
+    - path: ../lib/macos/scripts/load-santa-system-extension.sh
     - path: ../lib/linux/scripts/install-fleet-desktop-required-extension.sh
 policies:
   # macOS policies
@@ -119,6 +121,7 @@ policies:
   # - path: ../lib/macos/policies/1password-installed.yml https://github.com/fleetdm/fleet/pull/44179
   # - path: ../lib/macos/policies/nudge-installed.yml
   - path: ../lib/macos/policies/install-nudge-assets.yml
+  - path: ../lib/macos/policies/santa-endpoint-security-extension-active.yml
   - path: ../lib/macos/policies/patch-fleet-maintained-apps.yml
   - path: ../lib/macos/policies/update-fleet-desktop.yml
   - path: ../lib/macos/policies/battery-health-check.yml
@@ -144,8 +147,9 @@ reports:
 software:
   packages:
     # macOS apps
-    - path: ../lib/macos/software/santa.yml # Santa for macOS
+    - path: ../lib/macos/software/1password.yml # 1Password for macOS
       self_service: true
+      setup_experience: true
       categories:
         - Security
     - path: ../lib/macos/software/fleet-keynote-theme.yml # Fleet Keynote theme for macOS
@@ -300,6 +304,11 @@ software:
       setup_experience: true
       categories:
         - Security
+    - slug: santa/darwin # Santa for macOS
+      self_service: true
+      setup_experience: true
+      categories:
+        - Security
     - slug: claude/darwin # Claude for macOS
       self_service: true
       setup_experience: true

it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml

@@ -98,6 +98,11 @@
   query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.spotify.client';
   label_membership_type: dynamic
   platform: darwin
+- name: Macs with Santa installed
+  description: macOS hosts with Santa installed
+  query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.northpolesec.santa';
+  label_membership_type: dynamic
+  platform: darwin
 - name: Macs with Rectangle installed
   description: macOS hosts with Rectangle installed
   query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.knollsoft.Rectangle';

it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml

@@ -72,6 +72,14 @@
   install_software: false
   labels_include_any:
     - Macs with Okta Verify installed
+- name: macOS - Santa up to date
+  description: The host may have an outdated version of Santa, potentially risking security vulnerabilities or compatibility issues.
+  resolution: "Santa is an app managed by IT and should be kept up to date automatically. If you are failing this policy, click Refetch. If you are still failing after Refetch completes, drop a note in #help-it."
+  type: patch
+  fleet_maintained_app_slug: santa/darwin
+  install_software: true
+  labels_include_any:
+    - Macs with Santa installed
 - name: macOS - Claude up to date
   description: The host may have an outdated version of Claude, potentially risking security vulnerabilities or compatibility issues.
   resolution: "Download the latest version from Self-service or check for updates using Claude's built-in update functionality. You can also delete Claude if you are no longer using it."

it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml

@@ -0,0 +1,14 @@
+- name: macOS - Santa Endpoint Security extension active
+  platform: darwin
+  description: Santa is installed but its Endpoint Security system extension is missing or not in the activated enabled state.
+  resolution: "Fleet can run the remediation script to request extension activation. If it still fails, please reach out to help-it in Slack."
+  query: >-
+    SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.northpolesec.santa')
+    OR EXISTS (
+      SELECT 1 FROM system_extensions
+      WHERE identifier = 'com.northpolesec.santa.daemon'
+        AND team = 'ZMCG7MLDV9'
+        AND lower(replace(state, ' ', '_')) = 'activated_enabled'
+    )
+  run_script:
+    path: ../scripts/load-santa-system-extension.sh

it-and-security/lib/macos/scripts/load-santa-system-extension.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+set -euo pipefail
+
+SANTA_BIN="/Applications/Santa.app/Contents/MacOS/Santa"
+if [[ ! -x "$SANTA_BIN" ]]; then
+  echo "Santa is not installed at /Applications/Santa.app"
+  exit 1
+fi
+
+current_user=$(stat -f '%Su' /dev/console 2>/dev/null || echo root)
+if [[ "$current_user" != "root" && "$current_user" != "loginwindow" ]]; then
+  sudo -u "$current_user" "$SANTA_BIN" --load-system-extension
+else
+  "$SANTA_BIN" --load-system-extension
+fi

it-and-security/lib/macos/software/santa.yml

@@ -1 +0,0 @@
-url: https://github.com/northpolesec/santa/releases/download/2025.11/santa-2025.11.pkg