Re: [Security-Discuss] apparent bug in 2006.0 timezone update for Java code

> Date: Mon, 16 Oct 2006 09:29:40 -0600
> From: Vincent Danen <vdanen-4qZELD6FgxhWk0Htik3J/[email protected]>
>
> On Oct-16-06, at 7:09 AM, Robert M. Riches Jr. wrote:
>
> > I'm seeing an apparent bug in the 2006.0 timezone (and glibc)
> > update that only affects Java code.  The 'date' command shows
> > the correct time.  C code that uses gettimeofday() and
> > localtime() gets the correct time.  However, Java code that
> > uses Calendar.getInstance() is now returning the time in UTC,
> > while it has always returned the time in the local time zone.
> > I'm using j2sdk-1.4.2_09-1mdk and j2re-1.4.2_09-1mdk supplied
> > by Mandriva, in the club commercial area IIRC.
> >
> > Any suggestions before I file a bug report?
>
> I don't use java here, so I'm not sure.  But maybe Gwenole has an idea?

Acting on a tip from Aragorn in newsgroup
alt.os.linux.mandriva, I diffed the changelog entries of the
packages that in this batch of updates.  Nothing seemed to
indicate a change in behavior should be expected.

Then, I checked the .rpmnew files I had seen generated
during the update and found /etc/localtime.rpmnew.  The old
/etc/localtime file had a modification date of around
Feb. 17, 2006, which is when I installed Mandriva 2006, so
it did not appear to have changed in the updates.  Then, I
noticed the checksum of /etc/localtime differed from the
checksum of /usr/share/zoneinfo/America/Los_Angeles, which
is the time zone the system had been set to since
installation.

I ran Mandriva Control Center, and changed the timezone to
.../Lima and back to .../Los_Angeles and saved.  This
updated the timestampd of /etc/sysconfig/clock but did _NOT_
change its contents.  It apparently _did_ copy
/usr/share/zoneinfo/America/Los_Angeles to /etc/localtime
and restart ntpd.  Now, magically, apparently due to the
updating of /etc/localtime, the same Java code now returns
local time.

Now, the question is whether a bug report should be filed.
From a user perspective, ideally, updating the timezone
package should get everything (/etc/localtime) back in sync
so nothing in the system misbehaves.  It appears perhaps the
scripts run during an update of this package should look in
/etc/sysconfig/clock and copy the correct updated file from
/usr/share/zoneinfo/America/Los_Angeles to /etc/localtime.

Should I file a report or not?

Robert Riches
[email protected]
____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________