#1177 Santa: file access events and override action Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem Santa can restrict which processes read or write sensitive files (browser cookies, keychains, SSH keys). In v1 a sync server cannot deliver file access rules: they are configured locally through the

FileAccessPolicy

configuration profile. v1 does carry the violations (

EventUploadRequest.file_access_events

) and a fleet-wide

override_file_access_action

in preflight. Delivering file access rules from the server is v2-only and out of scope. Scope • Store

file_access_events

from eventupload (rule name and version, target path, process chain, decision) with env/node ownership checks and body limits. • Show them in the UI (Events tab filter or a dedicated tab) and expose them through the API. • Environment setting for

override_file_access_action

(none, audit only, disable). • Document how to deploy

FileAccessPolicy

through MDM in

pkg/santa/README.md

. Acceptance • A violation of an MDM-deployed file access rule shows up in osctrl. • The override action reaches clients at preflight; tests cover each value. • Depends on: #1184 Protocol Third-party sync servers must use the stable v1 protos (

buf.build/gen/go/northpolesec/protos/protocolbuffers/go/sync

).

syncv2

is internal to North Pole Security and is being removed from the published protos (northpolesec/santa#1270). jmpsec/osctrl