use default timezone from /etc/localtime if $TZ is unset/blank

the way this is implemented, it also allows explicit setting of
TZ=/etc/localtime even for suid programs. this is not a problem
because /etc/localtime is a trusted path, much like the trusted
zoneinfo search path.

diff --git a/src/time/__tz.c b/src/time/__tz.c
index 6d7173cf2a4d939bb74fd5f6d6d73c9a9f712a92..92c43a570a914641cb8ae8e6cb6733cacc1b1dd9 100644 (file)
--- a/src/time/__tz.c
+++ b/src/time/__tz.c
@@ -128,7 +128,7 @@ static void do_tzset()
                "/usr/share/zoneinfo/\0/share/zoneinfo/\0/etc/zoneinfo/\0";
 
        s = getenv("TZ");
-       if (!s || !*s) s = __gmt;
+       if (!s || !*s) s = "/etc/localtime";
 
        if (old_tz && !strcmp(s, old_tz)) return;
 
@@ -153,7 +153,8 @@ static void do_tzset()
        if (*s == ':' || ((p=strchr(s, '/')) && !memchr(s, ',', p-s))) {
                if (*s == ':') s++;
                if (*s == '/' || *s == '.') {
-                       if (!libc.secure) map = __map_file(s, &map_size);
+                       if (!libc.secure || !strcmp(s, "/etc/localtime"))
+                               map = __map_file(s, &map_size);
                } else {
                        size_t l = strlen(s);
                        if (l <= NAME_MAX && !strchr(s, '.')) {