Santa's Got a Brand New Bag

Santa is an open-source policy enforcement agent for macOS that Google uses across a large fleet. It mainly handles binary authorization and file access authorization, and it also collects process, file and mount telemetry. Administrators run it in lockdown or monitor mode and manage it through a sync protocol. That protocol runs in phases, with pre-flight status, event upload, rule download and postflight, so configuration changes are applied together and rolled back if they fail.

The speakers walk through the agent's components, including the main daemon, the bundle, metrics and sync services, and the command line tool. They describe how Google builds and staggers releases across rollout tracks, and how a social voting process lets colleagues approve unknown binaries before a fleet-wide allow rule is pushed. The talk then traces the move from an older kernel-extension design to Endpoint Security, the split into separate clients, and the structured protobuf logging that followed. New capabilities covered include USB mass storage control, file access rules that guard paths such as browser cookies, team and signing ID rules, and static rules that override user exceptions.

For defenders, the closing section shows how richer process data, such as pipe tracking, code signing flags and environment variables, supports detection, and how tripwire files can reveal which process touched a credential. The roadmap includes closing USB blocking gaps, logging entitlements, timestamp-based rules and process-tree conditions. The speakers finish by inviting documentation fixes, code contributions and new sync service implementations.