santad Modification about santa HOT 4 CLOSED

Ah yes, that part of the README hasn't been updated since moving santad/santactl inside the kext due to SIP.

The simple option would be to just leave the existing binaries where they are and install your custom santad/santactl binaries elsewhere, adjusting the paths in SNTCommonEnums.h and the santad.plist as appropriate.

The best option would be to apply for your own kext-signing certificate. The advice in the README was more aimed at enterprises who wanted to make customizations to Santa for their environment, which is something Apple were unlikely to issue certs for. As you're making a new product based on Santa you should be able to get a cert.

from santa.

Is there any chance you can move the two binaries back out of the KEXT and into the /usr/local/bin directory? This directory is also in the system PATH, and is intended as a destination for command-line tools written by third-party developers. It is explicitly not protected by SIP for just this reason.

from santa.

Anything under /usr/local is troublesome because many users and tools like to take ownership of it (like homebrew, for example). I initially considered putting the binaries in a subfolder of /Library but keeping everything inside the kext keeps things quite simple.

from santa.

Oh, OK. I really didn’t want to go through the trouble of getting my own KEXT-signing certificate, but it looks like I’ll have to. Thanks for your help nonetheless.

from santa.