feature request - 'trusted' Apple base set of signatures (db) import about santa HOT 5 CLOSED

I didn't put enough thought into this, nor did I see #25 - and it occurs to me, if we trust SIP, we could use the config.plist-based regex path whitelisting + Apple's cert(again, if we trust that) to do the lion's share of the work. I see there's even db export commands in the other issue, so I'm sure import can be made generic enough. Hopefully the other thoughts on this topic make it worth your while to consider/pluck useful things from.

from santa.

When santad starts it whitelists the certs used to sign itself and that of pid 1 (launchd) and refuses to remove those particular certs for any reason. That means if an OS update happens and a new cert is used it is automatically whitelisted.

That covers the entire base OS and all of the components of Santa. The logic here is that if launchd is compromised you're pretty much done for anyway so we might as well prevent accidentally blocking OS components as that will drive users to try tampering with it.

Does that achieve the effect you're after?

from santa.

Yeah, I was just unaware - I'll follow up with more amorphous points on santa-dev. Just one other thing, though - besides a TLS endpoint shoving a bunch of sha256's for whitelisting to machines, would running an import (or doing the rule table inserts) of raw sql be more or less preferable than swapping out the /var/db/santa dir's contents for an updated version, since both require killing santad? Or just wrapping lots of santad calls?

from santa.

Yeah, I was just unaware

We really need to get around to writing some documentation.

Just one other thing, though - besides a TLS endpoint shoving a bunch of sha256's for whitelisting to machines

That would be a sync server. We're hoping to get ours open-sourced in the not-too-distant future, once it's more finished. There's also Zentral, which I have no experience of but is apparently good.

would running an import (or doing the rule table inserts) of raw sql be more or less preferable than swapping out the /var/db/santa dir's contents for an updated version, since both require killing santad? Or just wrapping lots of santad calls?

If you're not syncing with a server you could just use the santactl rule command (see santactl help rule for a tiny bit of help).

from santa.

Cool, thanks! (I'm eval'ing Zentral, it doing osquery as well is a big plus)

from santa.