Santa Not Recognizing Statically Defined Rules

[ewrightmdy]

Hello,

I am currently trying to configure a MDM deployed instance of Santa, running off of static rules and not a sync server. I have it so both the application and configuration profiles are pushing to the target device through Jamf. Both the Santa application and the relevant three mobileconfig files (Config, TCC, and System Extension) are installing successfully this way.

However I’m experiencing a problem where the installed instance of Santa is not recognizing both the Config and System Extension profiles. It is recognizing the TCC profile. I’m not sure why it is recognizing one and not the others. I am using the provided templates for all three files. And for the Config file I’ve tried several different variations and modified versions to no success.

Attached below is a screengrab of the output of the following commands:

santactl status
santactl version
log stream --predicate 'sender == "com.google.santa.daemon"'
ps aux | grep santa

I also looked through /var/db/santa/santa.log, but didn’t see any errors or anything else that would shine light on this issue.

No matter what configuration settings I try, the counter for the rules never changes from 0. I have a feeling I’m overlooking something simple. Any help would be appreciated, and I’m more than happy to provide more logging or troubleshooting if need be.

Thank you!

[technerdist]

Any help would be greatly appreciate here.

[egobrane]

Unfortunately, I do not have any advice. But I would like to add that I have the same problem. I have even been able to update the config from Intune (our MDM) and confirmed that this updated config gets pushed to our clients, but it does not update the rules that Santa seems to recognize. I've done lots of searching through issues and discussions on this Github repo and came across several mentions of requests for this feature, as well as the subsequent implementation of said request via the addition of the StaticRules key - but it does not seem to update the actual Santa daemon locally.

[russellhancox]

You're welcome to wait for someone at Google to respond to this issue but the original Santa team has moved over to a new repository. If you'd like to re-open your issue at https://github.com/northpolesec/santa, we'd be happy to help you out there