install.fairie/home/dot_config/santa/README.md

51 lines
2.1 KiB
Markdown
Raw Normal View History

2023-08-08 01:13:48 -07:00
# Santa
Santa is a macOS security tool that helps handle the process of authorizing binary executions.
The `.mobileconfig` files in this folder have to be manually clicked on to be loaded or used in conjunction with an managed device provider. For more information on what each `.mobileconfig` does, please see the [Santa Getting Started](https://santa.dev/deployment/getting-started.html) page.
2023-08-08 10:42:10 -07:00
- `local.santa.mobileconfig` - Does not configure Santa to use a centralized server and can be run locally
- `server.santa.mobileconfig` - Relies on a synchronization server (more details on the [Santa site](https://santa.dev))
2023-08-08 01:13:48 -07:00
The original code used to deploy Santa via Ansible can be seen below which shows how to use `santactl` locally to block apps from loading:
```yaml
---
- name: 'Ensure {{ app_name }} is installed'
become: false
community.general.homebrew_cask:
name: santa
state: "{{ app_state | default('present') }}"
accept_external_apps: '{{ allow_external_apps | default(true) }}'
sudo_password: '{{ ansible_password | default(omit) }}'
- name: Copy the MDM Profile to the target
become: false
copy:
src: santa.mobileconfig
dest: ~/santa.mobileconfig
mode: 0700
when: lockdown_mode
# The `profiles` command, starting in BigSur, does not allow installing Profiles. The command used below allows
# partial automation, in that a notification is shown to install the Profile using System Preferences.
# However, the step fails. Leaving it here to use if another way to completely automate this is possible
# - name: Install the profile # noqa 303
# shell: open /System/Library/PreferencePanes/Profiles.prefPane /Users/{{ ansible_user }}/santa.mobileconfig
# when: lockdown_mode
#
# - name: Remove the MDM Profile from the target
# become: false
# file:
# path: ~/santa.mobileconfig
# state: absent
# when: lockdown_mode
- name: Ensure Rules are created # noqa 301 305
shell: /usr/local/bin/santactl rule {{ '--allow' if lockdown_mode else '--block' }} --path {{ rule }}
loop: '{{ allowed_apps if lockdown_mode else blocked_apps }}'
loop_control:
label: '{{ rule }}'
loop_var: rule
```