feat(xnu): let a service's sandbox grant cover setting its properties

A service that names a process in NativeSandboxGrantProcess now also lets that process set its properties when the sandbox profile would refuse it, as the grant already does for opening its user client.

patches/xnu/zzwb-native-sandbox-grant-set-properties.patch

@@ -0,0 +1,22 @@
+--- a/iokit/Kernel/IOUserClient.cpp
++++ b/iokit/Kernel/IOUserClient.cpp
+@@ -4065,6 +4065,7 @@
+ }
+ 
+ 
++static bool native_sandbox_grant(IOService * service);
+ /* Routine io_registry_entry_set_properties */
+ kern_return_t
+ is_io_registry_entry_set_properties
+@@ -4100,7 +4101,10 @@
+ 			res = kIOReturnBadArgument;
+ 		}
+ #if CONFIG_MACF
+-		else if (0 != mac_iokit_check_set_properties(kauth_cred_get(),
++		/* A service's grant (native_sandbox_grant) stands in for the sandbox's verdict on setting its properties as well: backboardd's
++		 * profile refuses FadePeriod, which CoreBrightness sends with every brightness, on the panel backlight (int-276). */
++		else if (!(OSDynamicCast(IOService, entry) && native_sandbox_grant(OSDynamicCast(IOService, entry)))
++		    && 0 != mac_iokit_check_set_properties(kauth_cred_get(),
+ 		    registry_entry, obj)) {
+ 			res = kIOReturnNotPermitted;
+ 		}