#1142 Feature Request: Make osctrl act as a Santa Sync server Issue created by javuto Santa integration: osctrl as a Santa sync server Problem osctrl manages macOS hosts through osquery but has no way to manage binary authorization on them. Santa (now maintained by North Pole Security) is the standard macOS binary/file-access authorization agent, and it is managed centrally only through its HTTP sync protocol. Teams running osctrl today need a second control plane (Moroz, Rudolph, Zentral, Workshop) to manage Santa. Proposal Track Santa support in two phases: Phase 1: Visibility (low effort) • Posture check(s) for Santa presence and client mode (e.g. installed, running in

LOCKDOWN

). • Evaluate distributing a Santa osquery extension via the existing extension library (

pkg/extensions

) for rule/decision visibility from queries and the console. Need to verify a maintained extension exists. Phase 2: osctrl as a Santa sync server (opt-in feature) • New

pkg/santa

with feature-owned models (rules, machine sync state, blocked events), migrated only when enabled — same pattern as `pkg/vulns`/`pkg/posture`. •

osctrl-tls

endpoints:

POST /{env}/santa/{preflight|eventupload|ruledownload|postflight}/{machine_id}

. • JSON and protobuf (

SyncEnableProtoTransfer

), gzip/deflate request bodies. • Use generated Go types from

buf.build/gen/go/northpolesec/protos

(

santa.sync.v1

). • Incremental rule download with an opaque `cursor`; support clean syncs. • Node linking: Santa's default

machine_id

is the hardware UUID, which matches

OsqueryNode.UUID

on macOS; fall back to

HardwareSerial

. •

osctrl-api

+ frontend: • Rule CRUD (

BINARY

,

CERTIFICATE

,

TEAMID

,

SIGNINGID

, `CDHASH`;

ALLOWLIST

,

BLOCKLIST

,

SILENT_BLOCKLIST

,

REMOVE

,

CEL

, …) scoped to environment, tag, or node. • Per-environment client mode and preflight settings (batch size, removable media, etc.). • Blocked-events view with an "allow" action; last sync status per node. • Blocked events flow into existing alerting, log sinks, and audit log. • Optional MCP tools; any mutating ones behind the existing write opt-in. • Feature flag (e.g.

--santa-enabled

), off by default. Security considerations • Santa sends no

node_key

. Sync endpoints must be authenticated with client mTLS (supported by Santa) and/or an environment secret path; unauthenticated access would leak allowlists and allow forged events. • Enforce environment ownership of

machine_id

, body limits, and rate limits as for other TLS routes. • Rule changes are security-relevant: require environment permissions server-side and record them in the audit log. Out of scope (for now) • Optional sync stages:

commands

,

metrics

, `signalupload`; push notifications (FCM/NATS). • File-access-authorization (FAA) and network-extension rule management. References • Sync protocol: https://github.com/northpolesec/santa/blob/main/docs/docs/features/sync.md • Protos: https://github.com/northpolesec/protos (

sync/v1.proto

) jmpsec/osctrl