Compiler rules not allowing specified compiler binary to run? about santa HOT 7 CLOSED

I wonder if the Santa client should reject rules where the Policy is "ALLOWLIST_COMPILER" and the Type is anything other than "BINARY"? Or better yet maybe it could allow use of other types to permit a compiler, for those of us willing to accept the additional risk?

Admittedly the feature was originally designed before signing ID rules existed. It may be a good time to revisit if we want to keep compiler rules to a BINARY rules. I know other folks in the community would probably be interested in marking the go toolchain as a compiler via signing ID rules so they don't have to update their rules for every release.

from santa.

It may be a good time to revisit if we want to keep compiler rules to a BINARY rules. I know other folks in the community would probably be interested in marking the go toolchain as a compiler via signing ID rules

Agreed. FWIW I don't see a good reason to not handle compiler signing ID rules. It wasn't done initially just keep the overall effort a little smaller and more focused. But expanding it shouldn't be too much of a hassle.

Not that it was asked for, but I don't think certificate or team ID rules would be good candidates for compiler rule types as they're too broad.

from santa.

We've now made Signing ID rules work with transitive allowlisting. I'm going to close this issue. Please feel free to reopen if there's more to address.

from santa.

Compiler rules currently only with with hashes.

The idea here is that you're approving a specific version of a compiler.

from santa.

OK great thanks, I had an inkling you might say that! I'll update the documentation later.

I wonder if the Santa client should reject rules where the Policy is "ALLOWLIST_COMPILER" and the Type is anything other than "BINARY"? Or better yet maybe it could allow use of other types to permit a compiler, for those of us willing to accept the additional risk?

from santa.

Documentation is fixed in #1172

from santa.

Not that it was asked for, but I don't think certificate or team ID rules would be good candidates for compiler rule types as they're too broad.

I agree. Team ID and Certificate rules are a bit too broad. Additionally if we implement #954. You'd sort of have a loose proxy for a given compiler version.

from santa.