1

I am trying to block the Safari web browser on our macOS devices. I am using Google Santa installed on user devices and pushing profile configurations via Intune in an attempt to block certain applications. I've had success blocking other applications, but not Safari.

I'm looking for help in determining how I can block Safari with Google Santa. I'm mostly confused regarding the exact path that Safari resides in and the proper way to format the path using the regex required for Santa.

Paths Used:

  • /Applications/Safari.App/
  • /System/Cryptexes/App/System/Applications/Safari.app
  • /System/Cryptexes/App/System/Applications/Safari.app/Contents/MacOS/Safari

Regex:

  • ^\/Applications\/Safari\.app\/.*$
  • ^\/System\/Cryptexes\/App\/System\/Applications\/Safari\.app\/.*

The profiles are successfully applied, but Safari remains unblocked. FYI I am not using a server with Google Santa, just simply applying profile configurations to end-use devices. Any help is much appreciated.

Improve this question
1
  • To update I've been able to block Safari not by using regex, but by defining the path directly: santactl rule --block --path /Applications/Safari.app I've also been able to block via sha256 certificate. santactl rule --block -identifier
    – Evan Brown
    Commented Nov 30, 2023 at 22:00

1 Answer 1

Reset to default
2

In recent versions of Santa you can make a SigningID rule for this:

sudo santactl rule --signingid --block --path /Applications/Safari.app

This will work across OS versions and regardless of the path Safari actually runs from. You can also skip the path and provide the identifier directly:

sudo santactl rule --signingid --block --identifier platform:com.apple.Safari
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .