CVS commit: src/lib/libc

["Christos Zoulas" <christos%netbsd.org@localhost>]

Module Name:    src
Committed By:   christos
Date:           Thu Dec 18 17:45:30 UTC 2025

Modified Files:
        src/lib/libc/compat/time: compat_localtime.c
        src/lib/libc/stdio: gettemp.c
        src/lib/libc/time: CONTRIBUTING Makefile NEWS README SECURITY calendars
            ctime.3 localtime.c private.h strftime.c theory.html tz-art.html
            tz-how-to.html tz-link.html tzfile.5 tzselect.ksh version zdump.c
            zic.8 zic.c

Log Message:
Release 2025c - 2025-12-10 14:42:37 -0800

  Briefly:
    Several code changes for compatibility with FreeBSD.

  Changes to code

    An unset TZ is no longer invalid when /etc/localtime is missing,
    and is abbreviated "UTC" not "-00".  This reverts to 2024b behavior.
    (Problem and patch reported by Dag-Erling Smørgrav.)

    New function offtime_r, short for fixed-offset localtime_rz.
    It is defined if STD_INSPIRED is defined.
    (Patch from Dag-Erling Smørgrav.)

    tzset etc. are now more cautious about questionable TZ settings.
    Privileged programs now reject TZ settings that start with '/',
    unless they are TZDEFAULT (default "/etc/localtime") or
    start with TZDIR then '/' (default "/usr/share/zoneinfo/").
    Unprivileged programs now require files to be regular files
    and reject relative names containing ".." directory components;
    formerly, only privileged programs did those two things.
    These changes were inspired by similar behavior in FreeBSD.
    On NetBSD, unprivileged programs now use O_REGULAR to check
    whether a TZ setting starting with '/' names a regular file,
    avoiding a minor security race still present elsewhere.
    TZ strings taken from tzalloc arguments are now treated with
    no less caution than TZ strings taken from the environment, as
    the old undocumented behavior would have been hard to explain.
    tzset etc. no longer use the 'access' system call to check access;
    instead they now use the system calls issetugid, getauxval,
    getresuid/getresgid, and geteuid/getegid/getuid/getgid (whichever
    first works) to test whether a program is privileged.
    Compile with -DHAVE_SYS_AUXV_H=[01] to enable or disable
    <sys/auxv.h> which (if it defines AT_SECURE) enables getauxval,
    and compile with -DHAVE_ISSETUGID=[01], -DHAVE_GETRESUID=[01], and
    -DHAVE_GETEUID=[01] to enable or disable the other calls' use.

    The new CFLAGS option -DTZ_CHANGE_INTERVAL=N makes tzset etc.
    check for TZif file changes if the in-memory data are N seconds
    old or more, and are derived from the TZ environment variable.
    This is intended for platforms that want tzset etc. to reflect
    changes to whatever file TZ selects (including changes to
    /etc/localtime if TZ is unset).  If N is negative (the default)
    these checks are omitted; this is the traditional behavior.

    The new CFLAGS options -DHAVE_STRUCT_STAT_ST_CTIM=0 and
    -DHAVE_STRUCT_TIMESPEC=0 port to non-POSIX.1-2008 platforms
    that lack st_ctim and struct timespec, respectively.

    tzset etc. now treat ' ' like '_' in time zone abbreviations,
    just as they treat other invalid bytes.  This continues the
    transition begun in release 96k, which removed spaces in tzdata
    because the spaces break time string parsers.

    The new CFLAGS option -DTHREAD_PREFER_SINGLE causes tzcode
    in single-threaded processes to avoid locks, as FreeBSD does.
    This can save time in single-threaded apps.  The threadedness
    testing costs CPU time and energy in multi-threaded apps.
    New options -DHAVE___ISTHREADED and -DHAVE_SYS_SINGLE_THREADED_H
    can help configure how to test for single-threadedness.

    The new CFLAGS option -DTHREAD_RWLOCK uses read-write locks, as
    macOS does, instead of mutexes.  This saves real time when TZ is
    rarely changing and many threads call tzcode simultaneously.
    It costs more CPU time and energy.

    The new CFLAGS option -TTHREAD_TM_MULTI causes localtime to return
    a pointer to thread-specific memory, as FreeBSD does, instead of
    to the same memory in all threads.  This supports unportable
    programs that incorrectly use localtime instead of localtime_r.
    This option affects gmtime and offtime similarly to localtime.
    Because the corresponding storage is freed on thread exit, this
    option is incompatible with POSIX.1-2024 and earlier.  It also
    costs CPU time and memory.

    tzfree now preserves errno, consistently with POSIX.1-2024 'free'.

    tzcode now uses mempcpy if available, guessing its availability.
    Compile with -DHAVE_MEMPCPY=1 or 0 to override the guess.

    tzcode now uses strnlen to improve asymptotic performance a bit.
    Compile with -DHAVE_STRNLEN=0 if your platform lacks it.

    tzcode now hand-declares unistd.h-provided symbols like getopt
    if HAVE_UNISTD_H=0, not if HAVE_POSIX_DECLS=0.

    tzset etc. now have an experimental OPENAT_TZDIR option;
    see Makefile and localtime.c for details.

    On platforms like GNU/Hurd that do not define PATH_MAX,
    exceedingly long TZ strings no longer fail merely because they
    exceed an arbitrary file name length limit imposed by tzcode.

    zic has new options inspired by FreeBSD.  '-D' skips creation of
    output ancestor directories, '-m MODE' sets output files' mode,
    and '-u OWNER[:GROUP]' sets output files' owner and group.

    zic now uses the fdopen function, which was standardized by
    POSIX.1-1988 and is now safe to use in portable code.
    This replaces its use of the older umask function, which
    complicated maintenance.


To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 src/lib/libc/compat/time/compat_localtime.c
cvs rdiff -u -r1.24 -r1.25 src/lib/libc/stdio/gettemp.c
cvs rdiff -u -r1.9 -r1.10 src/lib/libc/time/CONTRIBUTING
cvs rdiff -u -r1.59 -r1.60 src/lib/libc/time/Makefile
cvs rdiff -u -r1.47 -r1.48 src/lib/libc/time/NEWS
cvs rdiff -u -r1.17 -r1.18 src/lib/libc/time/README
cvs rdiff -u -r1.1 -r1.2 src/lib/libc/time/SECURITY
cvs rdiff -u -r1.2 -r1.3 src/lib/libc/time/calendars
cvs rdiff -u -r1.72 -r1.73 src/lib/libc/time/ctime.3
cvs rdiff -u -r1.147 -r1.148 src/lib/libc/time/localtime.c
cvs rdiff -u -r1.71 -r1.72 src/lib/libc/time/private.h
cvs rdiff -u -r1.57 -r1.58 src/lib/libc/time/strftime.c
cvs rdiff -u -r1.21 -r1.22 src/lib/libc/time/theory.html
cvs rdiff -u -r1.14 -r1.15 src/lib/libc/time/tz-art.html
cvs rdiff -u -r1.10 -r1.11 src/lib/libc/time/tz-how-to.html
cvs rdiff -u -r1.19 -r1.20 src/lib/libc/time/tz-link.html
cvs rdiff -u -r1.37 -r1.38 src/lib/libc/time/tzfile.5
cvs rdiff -u -r1.24 -r1.25 src/lib/libc/time/tzselect.ksh
cvs rdiff -u -r1.28 -r1.29 src/lib/libc/time/version
cvs rdiff -u -r1.65 -r1.66 src/lib/libc/time/zdump.c
cvs rdiff -u -r1.52 -r1.53 src/lib/libc/time/zic.8
cvs rdiff -u -r1.95 -r1.96 src/lib/libc/time/zic.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.