The kext at https://github.com/sektioneins/SUIDGuard https://github.com/sektioneins/SUIDGuard does something like that. For privileged processes, it neuters DYL

The kext at https://github.com/sektioneins/SUIDGuard https://github.com/sektioneins/SUIDGuard does something like that. For privileged processes, it neuters DYLD_* variables completely.