Santa For Mac

Santa is an open source project created by the Google Macintosh Operations Team that aims to provide a whitelisting and blacklisting system that protects users from launching malware apps.

As a result, Santa can prevent attacks even if the users are misguided and provide the necessary credentials to bypass the macOS prevention tools put in place by default.

The Santa project comes with an installer tool that automatically deploys all the needed resources: just follow the on screen instructions. The package will install a kernel extension, a userland daemon, a GUI agent, and a command-line utility that runs in the background.

The Santa utility will be placed in your Applications folder, but if you try to run it, you will be greeted by a message that there are no user configuration options in place. In fact, Santa blocks or allows apps to run on your system based on an SQLite database that will be updated automatically.

The Mac OS X Gatekeeper can help you make sure that only apps that have been downloaded via the Mac App Store or are signed by identified developers can be run on your system, but that does not help if you want to run apps from other sources.

Santa is intended to offer a measure of security no matter where you have downloaded the app. The tool tracks all the app executions and decides to allow them or not based on the information delivered from a developer managed SQLite database (the lists are updated periodically).

As a result, if the app you are trying to run is blacklisted, Santa will launch a small panel that alerts you about the decision and displays details about the publisher, identifier, parent process and the user that tried to open the app.

Bottom line, Santa can help you protect your Mac against attacks even if you download software from other sources than the Mac App Store. The utility functions on a whitelist/blacklist system that is developer managed and does not sport any user configurations.

However, keep in mind that Santa is not an official Google product, and the project is still under development.