On OS X, when an application requests access to a Keychain item, the user is prompted whether to grant or deny that access.
Supposedly, the system saves not only the binary path, but also its hash in the ACL entry that is created after the user confirms the request; according to Apple, this protects against modified binaries gaining access to user passwords and/or certificates.
Is this really sufficient to prevent an attacker with user (but not superuser) permissions from retrieving all stored passwords?
On Linux, for example, there is the environment variable
LD_PRELOAD which can be used to load additional dynamic libraries that overwrite some standard library functions with custom code; using that, it would seem to be possible to change the code that is executed within a given binary without modifying the base executable itself.
Is there a similar mechanism on OS X that would enable such an attack (maybe one of the methods mentioned here)?