Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Docs: Remove references to kexts and santa-driver from parts of the docs #762

Merged
merged 1 commit into from
Mar 21, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,11 @@
<img src="./Source/santa/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
</p>

Santa is a binary authorization system for macOS. It consists of a system or
kernel extension (depending on the macOS version) that monitors for executions,
a daemon that makes execution decisions based on the contents of a local
database, a GUI agent that notifies the user in case of a block decision
and a command-line utility for managing the system and synchronizing the
database with a server.
Santa is a binary authorization system for macOS. It consists of a system
extension that monitors for executions, a daemon that makes execution decisions
based on the contents of a local database, a GUI agent that notifies the user in
case of a block decision and a command-line utility for managing the system and
synchronizing the database with a server.

It is named Santa because it keeps track of binaries that are naughty or nice.

Expand Down
4 changes: 0 additions & 4 deletions docs/details/ipc.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,6 @@ Most IPC within Santa is done by way of Apple's
to provide client multiplexing, signature validation of connecting clients and
forced connection establishment. This is called SNTXPCConnection.

Communication between santad and santa-driver (KEXT) is done with a
[IOUserClient](https://developer.apple.com/documentation/kernel/iouserclient?language=objc)
subclass and IOKit/IOKitLib.h functions.

##### Who starts who?

The santad and Santa (GUI) processes are both started and kept alive by launchd
Expand Down
6 changes: 0 additions & 6 deletions docs/details/logs.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,3 @@ flight, including messages related to the system extension:
```sh
/usr/bin/log show --info --debug --predicate 'senderImagePath CONTAINS[c] "santa"'
```

For those still using the kernel extension, you could use a more specific command:

```sh
/usr/bin/log show --info --debug --predicate 'senderImagePath == "/Library/Extensions/santa-driver.kext/Contents/MacOS/santa-driver"'
````
139 changes: 0 additions & 139 deletions docs/details/santa-driver.md

This file was deleted.

2 changes: 1 addition & 1 deletion docs/details/santabs.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ parent: Details

# santabs

The santabs process is an XPC service for the santa-driver.kext bundle, meaning
The santabs process is an XPC service for the santad bundle, meaning
only binaries within that bundle can launch santabs. It will be launched with
the same privileges as its calling process. Currently, santad is the only caller
of santabs, so santabs runs as root.
Expand Down
34 changes: 0 additions & 34 deletions docs/details/santactl.md
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,6 @@ To view all of the component versions `santactl version`

```sh
⇒ santactl version
santa-driver | 0.9.19
santad | 0.9.19
santactl | 0.9.19
SantaGUI | 0.9.19
Expand All @@ -91,7 +90,6 @@ Again, a JSON version is available `santactl version --json`
```sh
⇒ santactl version --json
{
"santa-driver" : "0.9.19",
"santad" : "0.9.19",
"SantaGUI" : "0.9.19",
"santactl" : "0.9.19"
Expand Down Expand Up @@ -408,35 +406,3 @@ BundleID: com.ridiculousfish.HexFiend

See the [santabs.md](santabs.md) document for more information on bundles and
bundle hashes.

##### checkcache

This is used to check if a particular file is apart of santa-driver's kernel
cache. Mainly for debugging purposes.

```sh
⇒ santactl checkcache /usr/bin/yes
File does not exist in cache
⇒ /usr/bin/yes
y
y
y
y
y
^C
⇒ santactl checkcache /usr/bin/yes
File exists in [allowlist] kernel cache
```

##### flushcache

This can be used to flush santa-driver's kernel cache, as shown here.

```sh
⇒ santactl checkcache /usr/bin/yes
File exists in [allowlist] kernel cache
⇒ sudo santactl flushcache
Cache flush requested
⇒ santactl checkcache /usr/bin/yes
File does not exist in cache
```
3 changes: 1 addition & 2 deletions docs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,7 @@ For those who want even more details on how Santa works under the hood, this sec

There are five main components that make up Santa whose core functionality is described in snippets below. For additional detail on each component, visit their respective pages. These quick descriptions do not encompass all the jobs performed by each component, but do provide a quick look at the basic functionality utilized to achieve the goal of binary authorization.

* [santa-driver](details/santa-driver.md): A macOS kernel extension that participates in `execve()` decisions.
* [santad](details/santad.md): A user-land root daemon that makes decisions on behalf of santa-driver requests.
* [santad](details/santad.md): A user-land root daemon that makes decisions.
* [santactl](details/santactl.md): A user-land anonymous daemon that communicates with a sync server for configurations and policies. santactl can also be used by a user to manually configure Santa when using the local configuration.
* [santa-gui](details/santa-gui.md): A user-land GUI daemon that displays notifications when an `execve()` is blocked.
* [santabs](details/santabs.md): A user-land root daemon that finds Mach-O binaries within a bundle and creates events for them.
Expand Down