OTE-01-002 WP1: Possible DYLIB Injection on MacOS Client

[mx-psi]

macOS has a similar mechanism to LD_PRELOAD in Linux called DYLD_INSERT_LIBRARIES. Our current macOS binaries honor this environment variable, while the Linux ones do not. It is a good security practice to prevent usage of said environment variable to avoid preloading of arbitrary dynamic libraries.

To harden our binaries we can follow this StackOverflow answer advice.

---

Note

2024 OpenTelemetry security audit finding reference:
OTE-01-002 WP1: Possible DYLIB Injection on MacOS Client