October 2025 - tz - lists.iana.org

[PROPOSED] Improve TZ="/..." security and speed (NetBSD only)
by Paul Eggert Oct. 28, 2025

Oct. 28, 2025

* NEWS: Mention security. * localtime.c (O_REGULAR): Default to 0. (tzloadbody): Open TZif files with O_REGULAR. Suppress unnecessary call to 'stat' if O_REGULAR is present. --- NEWS | 3 +++ localtime.c | 7 +++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index 64d32bf3..1ed9b2eb 100644 --- a/NEWS +++ b/NEWS @@ -40,6 +40,9 @@ Unreleased, experimental changes and reject relative names containing ".." directory components; formerly, only privileged programs did those two things. These changes were inspired by similar behavior in FreeBSD. + On NetBSD, unprivileged programs now use O_REGULAR to check + whether a TZ setting starting with '/' names a regular file, + avoiding a minor security race still present elsewhere. TZ strings taken from tzalloc arguments are now treated with no less caution than TZ strings taken from the environment, as the old undocumented behavior would have been hard to explain. diff --git a/localtime.c b/localtime.c index 0d2d2a93..b85941f2 100644 --- a/localtime.c +++ b/localtime.c @@ -355,6 +355,9 @@ static int openat(int dd, char const *path, int oflag) { unreachable (); } #ifndef O_PATH # define O_PATH 0 #endif +#ifndef O_REGULAR +# define O_REGULAR 0 +#endif #ifndef O_RESOLVE_BENEATH # define O_RESOLVE_BENEATH 0 #endif @@ -900,7 +903,7 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, register int tzheadsize = sizeof(struct tzhead); int dd = AT_FDCWD; int oflags = (O_RDONLY | O_BINARY | O_CLOEXEC | O_CLOFORK - | O_IGNORE_CTTY | O_NOCTTY); + | O_IGNORE_CTTY | O_NOCTTY | O_REGULAR); int err; struct stat st; st.st_ctime = 0; @@ -927,7 +930,7 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, continue; else if (issetugid()) return ENOTCAPABLE; - else { + else if (!O_REGULAR) { /* Check for devices, as their mere opening could have unwanted side effects. Though racy, there is no portable way to fix the races. This check is needed -- 2.48.1

1 0

Iana build failures on Windows
by Manuela Friedrich Oct. 28, 2025

Oct. 28, 2025

Hello Paul, I have hit a compile error for zic.c on Windows. Git commit 9e0bf0b42d68b3d9ad0bc7ff70fc92d87f8b40d2 zic.c zic.c(152): error C2081: 'mode_t': name in formal parameter list illegal zic.c(2437): warning C4116: unnamed type definition in parentheses NMAKE : U1077: '"C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Tools\MSVC\14.12.25827\bin\HostX64\x64\cl.EXE"' : return code '0x2' Stop. Can you please advise? Please do not release a new version with this issue present. Thank you! Regards Manuela Friedrich

4 17

[PROPOSED] Be more like OpenBSD wrt ".."
by Paul Eggert Oct. 25, 2025

Oct. 25, 2025

* localtime.c (tzloadbody): Do not worry about settings like TZ=".." (i.e., trailing ".." component) as the later read will fail anyway. This simplifies the code slightly, and agrees with the security-conscious OpenBSD libc. --- localtime.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/localtime.c b/localtime.c index f1a82370..0d2d2a93 100644 --- a/localtime.c +++ b/localtime.c @@ -941,13 +941,13 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, if (relname[0] != '/') { if (!OPENAT_TZDIR || !O_RESOLVE_BENEATH) { - /* Fail if a relative name contains a ".." component, - as such a name could read a file outside TZDIR + /* Fail if a relative name contains a non-terminal ".." component, + as such a name could read a non-directory outside TZDIR when AT_FDCWD and O_RESOLVE_BENEATH are not available. */ char const *component; for (component = relname; component[0]; component++) if (component[0] == '.' && component[1] == '.' - && ((component[2] == '/') | !component[2]) + && component[2] == '/' && (component == relname || component[-1] == '/')) return ENOTCAPABLE; } -- 2.48.1

1 0

[PATCH 1/5] Clarify <sys/auxv.h> vs getauxval
by Paul Eggert Oct. 25, 2025

Oct. 25, 2025

FreeBSD has <sys/auxv.h> but not getauxval, so clarify ifdeffery to reflect this. This doesn’t fix any bugs (since FreeBSD also has issetugid) but makes things clearer. * Makefile, NEWS: Update to match new behavior and fix a few old typos. * localtime.c: Move the <sys/auv.h> code to be closer together. (HAVE_SYS_AUXV_H) [!HAVE_ISSETUGID]: New macro. * private.h (HAVE_GETAUXVAL): Remove. All uses replaced by HAVE_SYS_AUXV_H. --- Makefile | 12 ++++++------ NEWS | 9 +++++---- localtime.c | 25 +++++++++++++++++++------ private.h | 13 ------------- 4 files changed, 30 insertions(+), 29 deletions(-) diff --git a/Makefile b/Makefile index 3b259c80..0fe8a9f8 100644 --- a/Makefile +++ b/Makefile @@ -246,7 +246,6 @@ LDLIBS= # -DHAVE_DIRECT_H if mkdir needs <direct.h> (MS-Windows) # -DHAVE_FCHMOD=0 if your system lacks the fchmod function # -DHAVE__GENERIC=0 if _Generic does not work* -# -DHAVE_GETAUXVAL=1 if getauxval works, 0 otherwise (default is guessed) # -DHAVE_GETEUID=0 if gete?[ug]id do not work # -DHAVE_GETRANDOM if getrandom works (e.g., GNU/Linux), # -DHAVE_GETRANDOM=0 to avoid using getrandom @@ -258,7 +257,9 @@ LDLIBS= # ctime_r and asctime_r incompatibly with POSIX.1-2017 and earlier # (Solaris when _POSIX_PTHREAD_SEMANTICS is not defined). # -DHAVE_INTTYPES_H=0 if <inttypes.h> does not work*+ -# -DHAVE_ISSETUID=1 if issetugid works, 0 otherwise (default is guessed) +# -DHAVE_ISSETUGID=1 if issetugid works, 0 otherwise (default is guessed) +# If 0, you may also use -DHAVE_SYS_AUXV_H=1 if <sys/auxv.h> works, +# 0 otherwise (default is guessed). # -DHAVE_LINK=0 if your system lacks a link function # -DHAVE_LOCALTIME_R=0 if your system lacks a localtime_r function # -DHAVE_LOCALTIME_RZ=0 if you do not want zdump to use localtime_rz @@ -268,8 +269,8 @@ LDLIBS= # -DHAVE_POSIX_DECLS=0 if your system's include files do not declare # variables like 'tzname' required by POSIX # -DHAVE_PWD_H=0 if your system lacks pwd.h, grp.h and corresponding functions -# The following additional options may be needed: -# -Dgid_t=T, -Duid_t=T to define gid_t, uid_t to be type T +# If 0, you may also need -Dgid_t=G -Duid_t=U +# to define gid_t and uid_t to be types G and U. # -DHAVE_SETENV=0 if your system lacks the setenv function # -DHAVE_SETMODE=[01] if your system lacks or has the setmode and getmode # functions (default is guessed) @@ -285,8 +286,7 @@ LDLIBS= # -DHAVE_STRUCT_TIMESPEC=0 if your system lacks struct timespec+ # -DHAVE_SYMLINK=0 if your system lacks the symlink function # -DHAVE_SYS_STAT_H=0 if <sys/stat.h> does not work* -# The following additional option may be needed: -# -Dmode_t=T to define mode_t to be type T +# If 0, you may also need -Dmode_t=M to define mode_t to be type M. # -DHAVE_TZSET=0 if your system lacks a tzset function # -DHAVE_UNISTD_H=0 if <unistd.h> does not work* # -DHAVE_UTMPX_H=0 if <utmpx.h> does not work* diff --git a/NEWS b/NEWS index 37ac9fba..64d32bf3 100644 --- a/NEWS +++ b/NEWS @@ -44,12 +44,13 @@ Unreleased, experimental changes no less caution than TZ strings taken from the environment, as the old undocumented behavior would have been hard to explain. tzset etc. no longer use the 'access' system call to check access; - instead they now use the system calls issetuid, getauxval, + instead they now use the system calls issetugid, getauxval, getresuid/getresgid, and geteuid/getegid/getuid/getgid (whichever first works) to test whether a program is privileged. - Compile with -DHAVE_ISSETUID=[01], -DHAVE_GETAUXVAL=[01], - -DHAVE_GETRESUID=[01], and -DHAVE_GETEUID=[01] to enable or - disable these system calls' use. + Compile with -DHAVE_SYS_AUXV_H=[01] to enable or disable + <sys/auxv.h> which (if it defines AT_SECURE) enables getauxval, + and compile with -DHAVE_ISSETUGID=[01], -DHAVE_GETRESUID=[01], and + -DHAVE_GETEUID=[01] to enable or disable the other calls' use. The new CFLAGS option -DTZ_CHANGE_INTERVAL=N makes tzset etc. check for TZif file changes if the in-memory data are N seconds diff --git a/localtime.c b/localtime.c index a8c442dd..f2d35813 100644 --- a/localtime.c +++ b/localtime.c @@ -19,10 +19,6 @@ #include "tzfile.h" #include <fcntl.h> -#if HAVE_GETAUXVAL && !HAVE_ISSETUGID -# include <sys/auxv.h> -#endif - #if HAVE_SYS_STAT_H # include <sys/stat.h> # ifndef S_ISREG @@ -366,12 +362,29 @@ static int openat(int dd, char const *path, int oflag) { unreachable (); } # define O_SEARCH 0 #endif -/* Return 1 if the process is privileged, 0 otherwise. */ #if !HAVE_ISSETUGID + +# if !defined HAVE_SYS_AUXV_H && defined __has_include +# if __has_include(<sys/auxv.h>) +# define HAVE_SYS_AUXV_H 1 +# endif +# endif +# ifndef HAVE_SYS_AUXV_H +# if defined __GLIBC__ && 2 < __GLIBC__ + (19 <= __GLIBC_MINOR__) +# define HAVE_SYS_AUXV_H 1 +# else +# define HAVE_SYS_AUXV_H 0 +# endif +# endif +# if HAVE_SYS_AUXV_H +# include <sys/auxv.h> +# endif + +/* Return 1 if the process is privileged, 0 otherwise. */ static int issetugid(void) { -# if HAVE_GETAUXVAL && defined AT_SECURE +# if HAVE_SYS_AUXV_H && defined AT_SECURE unsigned long val; errno = 0; val = getauxval(AT_SECURE); diff --git a/private.h b/private.h index 8d3d6404..4daa4864 100644 --- a/private.h +++ b/private.h @@ -294,19 +294,6 @@ extern int optind; # endif #endif -#if !defined HAVE_GETAUXVAL && defined __has_include -# if __has_include(<sys/auxv.h>) -# define HAVE_GETAUXVAL 1 -# endif -#endif -#ifndef HAVE_GETAUXVAL -# if defined __GLIBC__ && 2 < __GLIBC__ + (19 <= __GLIBC_MINOR__) -# define HAVE_GETAUXVAL 1 -# else -# define HAVE_GETAUXVAL 0 -# endif -#endif - #ifndef HAVE_ISSETUGID # if (defined __FreeBSD__ || defined __NetBSD__ || defined __OpenBSD__ \ || (defined __linux__ && !defined __GLIBC__) /* Android, musl, etc. */ \ -- 2.51.0

1 4

[PROPOSED] Shorten GCC_INSTRUMENT à la GCC 14
by Paul Eggert Oct. 25, 2025

Oct. 25, 2025

* Makefile (GCC_INSTRUMENT): Switch from -fsanitize-undefined-trap-on-error to its shorter alias -fsanitize-trap=all, introduced in GCC 14. --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index f57042df..3b259c80 100644 --- a/Makefile +++ b/Makefile @@ -380,7 +380,7 @@ LDLIBS= # Select instrumentation via "make GCC_INSTRUMENT='whatever'". GCC_INSTRUMENT = \ -fsanitize=undefined -fsanitize-address-use-after-scope \ - -fsanitize-undefined-trap-on-error -fstack-protector + -fsanitize-trap=all -fstack-protector # Omit -fanalyzer from GCC_DEBUG_FLAGS, as it makes GCC too slow. GCC_DEBUG_FLAGS = -DGCC_LINT -g3 -O3 \ $(GCC_INSTRUMENT) \ -- 2.51.0

1 0

[PROPOSED 0/3] zic options -D, -m, and -u from FreeBSD
by Paul Eggert Oct. 24, 2025

Oct. 24, 2025

This thread contains proposed patches to add support for the zic options -D, -m, and -u, which have been in FreeBSD zic for many years. The implementation differs from that of FreeBSD, to fix some unlikely security races. I installed these patches in the development repository on GitHub. Paul Eggert (3): New zic option -D, inspired by FreeBSD New zic option -m, inspired by FreeBSD New zic option -u, inspired by FreeBSD Makefile | 8 ++ NEWS | 2 + zic.8 | 32 +++++++ zic.c | 259 +++++++++++++++++++++++++++++++++++++++++++++++++++++-- 4 files changed, 293 insertions(+), 8 deletions(-) -- 2.48.1

2 5

Possible timezone change in Argentina (starting in April?)
by Mariano Absatz - el Baby Oct. 24, 2025

Oct. 24, 2025

Hi, back here after 12+ years for a heads up... There is a Law proposal approved by the Cámara de Diputados (equivalent of the House) but yet to be approved in the Senate regarding Argentina's timezone. Argentina is currently in UTC-3 with no DST. The proposal establishes the Official Time for the whole country as UTC-4 (which is geographically more accurate), with a DST of UTC-3. The DST would start at 00:00 on the first April Sunday and would end at 00:00 on the first September Sunday. The Executive is authorized to modify these dates and to coordinate with other countries of MERCOSUR to apply changes on the same moment. This is just a heads up, since the Senate did not approve or modify the proposal. If this is approved and enacted before April 2026, we can assume the current status is DST and at 00:00 Sunday April 5th 2026 we would be moving the clock back to 23:00 Saturday April 4th. I'll keep you posted as this evolves, but don't hold your breath since on October 26th there are Legislative Elections (midterm), and half of the House and one third of the Senate will change. The new legislators will take office on December 10th. By the end of December the ordinary session of Congress ends; it may be extended by the Executive Branch, but there is no certainty about which bills can be discussed. References (all in Spanish): * Law proposal (official Cámara de Diputados site): https://www.hcdn.gob.ar/diputados/jcobos/proyecto.html?exp=1110-D-2024 (click on the "Ver documento original" button) * Status in the Senate: https://www.senado.gob.ar/parlamentario/comisiones/verExp/14.25/CD/PL (click on the "Texto Original" button for the signed proposal sent from the Cámara de Diputados; click on the "Trámite Legislativo" button for the process status in the Senate) * Brief article about the proposal on a reputed fact checking site: https://chequeado.com/el-explicador/cambio-de-huso-horario-en-la-argentina-… -- Mariano Absatz - el Baby www.clueless.ar

3 3

[PROPOSED 1/2] Refactor duplicate duplicate-option code
by Paul Eggert Oct. 24, 2025

Oct. 24, 2025

* zic.c (duplicate_options): New function. (main): Use it. --- zic.c | 73 +++++++++++++++++++---------------------------------------- 1 file changed, 23 insertions(+), 50 deletions(-) diff --git a/zic.c b/zic.c index 67bcaa43..34e7d91c 100644 --- a/zic.c +++ b/zic.c @@ -708,6 +708,13 @@ close_file(FILE *stream, char const *dir, char const *name, } } +ATTRIBUTE_NORETURN static void +duplicate_options(char const *opt) +{ + fprintf(stderr, _("%s: More than one %s option specified\n"), progname, opt); + exit(EXIT_FAILURE); +} + ATTRIBUTE_NORETURN static void usage(FILE *stream, int status) { @@ -1063,73 +1070,39 @@ main(int argc, char **argv) error(_("invalid option: -b '%s'"), optarg); break; case 'd': - if (directory == NULL) - directory = optarg; - else { - fprintf(stderr, - _("%s: More than one -d option" - " specified\n"), - progname); - return EXIT_FAILURE; - } + if (directory) + duplicate_options("-d"); + directory = optarg; break; case 'l': - if (lcltime == NULL) - lcltime = optarg; - else { - fprintf(stderr, - _("%s: More than one -l option" - " specified\n"), - progname); - return EXIT_FAILURE; - } + if (lcltime) + duplicate_options("-l"); + lcltime = optarg; break; case 'p': - if (psxrules == NULL) - psxrules = optarg; - else { - fprintf(stderr, - _("%s: More than one -p option" - " specified\n"), - progname); - return EXIT_FAILURE; - } + if (psxrules) + duplicate_options("-p"); + psxrules = optarg; break; case 't': - if (tzdefault != NULL) { - fprintf(stderr, - _("%s: More than one -t option" - " specified\n"), - progname); - return EXIT_FAILURE; - } + if (tzdefault) + duplicate_options("-t"); tzdefault = optarg; break; case 'y': warning(_("-y ignored")); break; case 'L': - if (leapsec == NULL) - leapsec = optarg; - else { - fprintf(stderr, - _("%s: More than one -L option" - " specified\n"), - progname); - return EXIT_FAILURE; - } + if (leapsec) + duplicate_options("-L"); + leapsec = optarg; break; case 'v': noise = true; break; case 'r': - if (timerange_given) { - fprintf(stderr, - _("%s: More than one -r option" - " specified\n"), - progname); - return EXIT_FAILURE; - } + if (timerange_given) + duplicate_options("-r"); if (! timerange_option(optarg)) { fprintf(stderr, _("%s: invalid time range: %s\n"), -- 2.48.1

1 0

South Africa Daylight Saving Time
by Saras Sing Oct. 21, 2025

Oct. 21, 2025

https://www.timeanddate.com/time/change/south-africa?year=1942 https://www.timeanddate.com/time/change/south-africa?year=1944 https://www.timeanddate.com/time/change/south-africa Hello South Africa has Daylight Saving Time every year from September to March South African Daylight Saving Time starts at every first Sunday of September from GMT/UTC+02:00 00:00 to 01:00 to GMT/UTC+03:00 South African Daylight Saving Time ends at every last Sunday of March from GMT/UTC+03:00 01:00 to 00:00 back to South Africa Standard Time GMT/UTC+02:00 Thank you

5 4

[PROPOSED 1/3] zic now uses is_digit
by Paul Eggert Oct. 18, 2025

Oct. 18, 2025

Refactor zic.c to use is_digit like others use. * zic.c (is_digit): New static function, copied from localtime.c and from zdump.c. It’s too bad we can’t avoid duplication by putting this into private.h, because gcc -Wunused-function would then complain about it. Perhaps ‘inline’ would pacify gcc but then we’d have to port ‘inline’ to ancient compilers and anyway ‘inline’ is supposed to be just a performance hint which is not needed here. --- zic.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/zic.c b/zic.c index 39e1e2bc..30426621 100644 --- a/zic.c +++ b/zic.c @@ -229,6 +229,13 @@ static bool rulesub(struct rule * rp, const char * dayp, const char * timep); static zic_t tadd(zic_t t1, zic_t t2); +/* Is C an ASCII digit? */ +static bool +is_digit(char c) +{ + return '0' <= c && c <= '9'; +} + /* Bound on length of what %z can expand to. */ enum { PERCENT_Z_LEN_BOUND = sizeof "+995959" - 1 }; @@ -1852,7 +1859,7 @@ gethms(char const *string, char const *errstring) &hh, &hhx, &mm, &mmx, &ss, &ssx, &tenths, &xr, &xs)) { default: ok = false; break; case 8: - ok = '0' <= xr && xr <= '9'; + ok = is_digit(xr); ATTRIBUTE_FALLTHROUGH; case 7: ok &= ssx == '.'; @@ -3952,7 +3959,7 @@ newabbr(const char *string) cp = string; mp = NULL; - while (is_alpha(*cp) || ('0' <= *cp && *cp <= '9') + while (is_alpha(*cp) || is_digit(*cp) || *cp == '-' || *cp == '+') ++cp; if (noise && cp - string < 3) -- 2.51.0

1 2