Re: Use local time in syslog() function

[Rich Felker <dalias@libc.org>]

On Mon, Jan 14, 2019 at 10:23:03AM +0100, Michael Kaufmann wrote:
> Hi,
> 
> I have found a bug in the implementation of syslog(). It should use
> the local time instead of UTC when sending the message to /dev/log.
> So in src/misc/syslog.c, the call to gmtime_r() should be replaced
> with localtime_r().

This is not a bug; rather, use of local time there in glibc and other
systems is a bug. Local time varies by the sending process and
produces inconsistent and uninterpretable log messages. Moreover the
syslog() function is not specified to depend on the environment and
thereby is not allowed to call any function whose behavior is
dependant on the environment.

If you want local times in logs, the only consistant and conforming
way to do it is to have syslogd interpret the timestamps and rewrite
them to your preferred timezone. But that still doesn't help with the
issue of ambiguous timestamps at daylight-time transition that give
attackers neat opportunities to misrepresent sequence of events
between different systems...

Rich