LinusHenze

iOS 16 introduced launch constraints, which can be used to constraint the launch of an application.
There are three types of constraints:
    Self Constraints, which the launched application itself must meet
    Parent Constraints, which the parent process must meet
    Responsible Constraints, which the "responsible process" must meet (I assume that the responsible process is the process that asked launchd to launch a service)

Additionally, the TrustCache format was updated (see below) to support assigning each binary a "Constraint Category", which forces Self and Parent Constraints.
Note that Self, Parent and Responsible Constraints can also be set by the process performing the launch and they can be included in the code signature, in the new blob type 0xFADE8181. In both cases, the constraints are DER encoded (just like the DER entitlements).

Constraint Categories (from TrustCache, new in version 2):

b0gdanw

# https://macadmins.slack.com/archives/general/p1449604450017318
# https://gist.github.com/clburlison/db6aaf4a717eb8ef3545
# https://www.jamf.com/jamf-nation/feature-requests/5158/built-in-inventory-fields-for-os-x-macos-security-and-malware-protection-systems
# https://www.jamf.com/jamf-nation/discussions/19111/xprotect-status-extension-attribute

set MacOSVers to do shell script "defaults read /System/Library/CoreServices/SystemVersion.plist ProductVersion"
set MacOSBuild to do shell script "defaults read /System/Library/CoreServices/SystemVersion.plist ProductBuildVersion"

set XProtectVers to do shell script "defaults read /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.meta.plist Version"
set XProtectDate to do shell script "GetFileInfo -d /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.meta.plist"

pudquick

import objc
from Foundation import NSBundle

IOKit = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')

functions = [("IOServiceGetMatchingService", b"II@"),
             ("IOServiceMatching", b"@*"),
             ("IORegistryEntryCreateCFProperties", b"IIo^@@I"),
             ("IOPSCopyPowerSourcesByType", b"@I"),
             ("IOPSCopyPowerSourcesInfo", b"@"),