From 11c818217b7ba90fb8d3e356d4f1ede88f952cf6 Mon Sep 17 00:00:00 2001
From: bluseliu50 <265648257+bluseliu50@users.noreply.github.com>
Date: Fri, 23 Oct 2026 02:36:11 +0800
Subject: [PATCH] feat(xnu): let a service's sandbox grant cover setting its
 properties

A service that names a process in NativeSandboxGrantProcess now also lets that process set its properties when the sandbox profile would refuse it, as the grant already does for opening its user client.
---
 ...-native-sandbox-grant-set-properties.patch | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 patches/xnu/zzwb-native-sandbox-grant-set-properties.patch

diff --git a/patches/xnu/zzwb-native-sandbox-grant-set-properties.patch b/patches/xnu/zzwb-native-sandbox-grant-set-properties.patch
new file mode 100644
index 0000000..d776355
--- /dev/null
+++ b/patches/xnu/zzwb-native-sandbox-grant-set-properties.patch
@@ -0,0 +1,22 @@
+--- a/iokit/Kernel/IOUserClient.cpp
++++ b/iokit/Kernel/IOUserClient.cpp
+@@ -4065,6 +4065,7 @@
+ }
+ 
+ 
++static bool native_sandbox_grant(IOService * service);
+ /* Routine io_registry_entry_set_properties */
+ kern_return_t
+ is_io_registry_entry_set_properties
+@@ -4100,7 +4101,10 @@
+ 			res = kIOReturnBadArgument;
+ 		}
+ #if CONFIG_MACF
+-		else if (0 != mac_iokit_check_set_properties(kauth_cred_get(),
++		/* A service's grant (native_sandbox_grant) stands in for the sandbox's verdict on setting its properties as well: backboardd's
++		 * profile refuses FadePeriod, which CoreBrightness sends with every brightness, on the panel backlight (int-276). */
++		else if (!(OSDynamicCast(IOService, entry) && native_sandbox_grant(OSDynamicCast(IOService, entry)))
++		    && 0 != mac_iokit_check_set_properties(kauth_cred_get(),
+ 		    registry_entry, obj)) {
+ 			res = kIOReturnNotPermitted;
+ 		}