debcrafters-packages team mailing list archive

[Nick Rosbrook <2125405@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

[Impact]

The org.freedesktop.timedate1.ListTimezones DBus method may return a
list that contains timezones that are not installed on the system.

To build the list, systemd-timedated parses
/usr/share/zoneinfo/tzdata.zi from the tzdata package (or
/usr/share/zoneinfo/zone1970.tab as a fallback). However, not all
timezones listed in tzdata.zi are included in the main tzdata package,
but in the tzdata-legacy package.

But, systemd-timedated does not validate the timezones when building the
list, which makes the following possible:

$ timedatectl list-timezones | grep "US/Alaska"
US/Alaska
    
$ timedatectl set-timezone US/Alaska
Failed to set time zone: Invalid or not installed time zone 'US/Alaska'

[Test Plan]

Select a timezone from the tzdata-legacy package, e.g. US/Alaska.

Confirm that /usr/share/zoneinfo/US/Alaska does not exist, and that the
tzdata-legacy package is not installed:

$ stat /usr/share/zoneinfo/US/Alaska
$ apt policy tzdata-legacy

Check if US/Alaska is included the the list from systemd-timedated:

$ timedatectl list-timezones | grep "US/Alaska"

With the fix, US/Alaska should not be listed. But, after installing
tzdata-legacy, US/Alaska should be installed.

$ apt install tzdata-legacy
$ timedatectl list-timezones | grep "US/Alaska"

[Where problems could occur]

The patch uses an existing timezone_is_valid() function to validate
timezones before returning a list in get_timezones(). In addition to
systemd-timedated, get_timezones() is used in systemd-firstboot.

If external programs depend on the current buggy behavior, this fix
could cause a regression.

Note that the org.freedesktop.timedate1.SetTimezone method already uses
timezone_is_valid() to validate timezones (as demonstrated in the Impact
section).

** Affects: systemd (Ubuntu)
     Importance: Medium
     Assignee: Nick Rosbrook (enr0n)
         Status: New

** Affects: systemd (Ubuntu Noble)
     Importance: Medium
         Status: New

** Affects: systemd (Ubuntu Plucky)
     Importance: Medium
         Status: New


** Tags: dcr-incoming systemd-sru-next

** Also affects: systemd (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: systemd (Ubuntu Plucky)
   Importance: Undecided
       Status: New

** Changed in: systemd (Ubuntu)
   Importance: Undecided => Medium

** Changed in: systemd (Ubuntu Noble)
   Importance: Undecided => Medium

** Changed in: systemd (Ubuntu Plucky)
   Importance: Undecided => Medium

-- 
You received this bug notification because you are a member of
Debcrafters packages, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/2125405

Title:
  timedatectl list-timezones shows timezones that are not installed

Status in systemd package in Ubuntu:
  New
Status in systemd source package in Noble:
  New
Status in systemd source package in Plucky:
  New

Bug description:
  [Impact]

  The org.freedesktop.timedate1.ListTimezones DBus method may return a
  list that contains timezones that are not installed on the system.

  To build the list, systemd-timedated parses
  /usr/share/zoneinfo/tzdata.zi from the tzdata package (or
  /usr/share/zoneinfo/zone1970.tab as a fallback). However, not all
  timezones listed in tzdata.zi are included in the main tzdata package,
  but in the tzdata-legacy package.

  But, systemd-timedated does not validate the timezones when building
  the list, which makes the following possible:

  $ timedatectl list-timezones | grep "US/Alaska"
  US/Alaska
      
  $ timedatectl set-timezone US/Alaska
  Failed to set time zone: Invalid or not installed time zone 'US/Alaska'

  [Test Plan]

  Select a timezone from the tzdata-legacy package, e.g. US/Alaska.

  Confirm that /usr/share/zoneinfo/US/Alaska does not exist, and that
  the tzdata-legacy package is not installed:

  $ stat /usr/share/zoneinfo/US/Alaska
  $ apt policy tzdata-legacy

  Check if US/Alaska is included the the list from systemd-timedated:

  $ timedatectl list-timezones | grep "US/Alaska"

  With the fix, US/Alaska should not be listed. But, after installing
  tzdata-legacy, US/Alaska should be installed.

  $ apt install tzdata-legacy
  $ timedatectl list-timezones | grep "US/Alaska"

  [Where problems could occur]

  The patch uses an existing timezone_is_valid() function to validate
  timezones before returning a list in get_timezones(). In addition to
  systemd-timedated, get_timezones() is used in systemd-firstboot.

  If external programs depend on the current buggy behavior, this fix
  could cause a regression.

  Note that the org.freedesktop.timedate1.SetTimezone method already
  uses timezone_is_valid() to validate timezones (as demonstrated in the
  Impact section).

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2125405/+subscriptions