We have a large C++ library for which we have created Java bindings using SWIG (so a JNI shared library). We build for and run tests on many build platforms across macOS, Linux, and Windows; debug and opt; and ASAN.
We’re having problems with ASAN + Java, specifically, on some macOS machines. For our regular C++ library and its tests, on all operating systems, we have no problems. We’ve sorted out all the compiler flags, linking flags, and runtime environment variables to make ASAN work properly.
But for the Java binding JNI library on macOS (only), things are different. When we load our ASAN-linked binding library and try to use it in Java on macOS, we get the following error and the Java process aborts:
==36055==ERROR: Interceptors are not working. This may be because AddressSanitizer is loaded too late (e.g. via dlopen). Please launch the executable with:
DYLD_INSERT_LIBRARIES=/path/to/libclang_rt.asan_osx_dynamic.dylib
"interceptors not installed" && 0
When we attempted the obvious—launching the Java process with DYLD_INSERT_LIBRARIES specified—it works on our local developer machines but not on our builders. Upon further investigation, we determined that our developer machines have SIP (System Integrity Protection) disabled while our builders have SIP enabled. Our Infra team informed us that disabling SIP is not an option, so we must make this work with SIP enabled.
What is the proper way to force Java to pre-load the ASAN library on SIP-enabled macOS systems to prevent this error?
2