debcrafters-packages team mailing list archive

[Launchpad Bug Tracker <2125405@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package systemd - 257.9-0ubuntu2

---------------
systemd (257.9-0ubuntu2) questing; urgency=medium

  * basic: validate timezones in get_timezones() (LP: #2125405)
  * debian/libnss-systemd.nss: install after 'compat' too (LP: #2125403)
  * d/t/boot-and-services: use coreutils tunable in apparmor test (LP: #2125614)
  * d/t/upstream: use GNU cp in test setup (LP: #2122363)

 -- Nick Rosbrook <enr0n@xxxxxxxxxx>  Thu, 25 Sep 2025 12:45:39 -0400

** Changed in: systemd (Ubuntu)
       Status: New => Fix Released

-- 
You received this bug notification because you are a member of
Debcrafters packages, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/2125405

Title:
  timedatectl list-timezones shows timezones that are not installed

Status in systemd package in Ubuntu:
  Fix Released
Status in systemd source package in Noble:
  New
Status in systemd source package in Plucky:
  New

Bug description:
  [Impact]

  The org.freedesktop.timedate1.ListTimezones DBus method may return a
  list that contains timezones that are not installed on the system.

  To build the list, systemd-timedated parses
  /usr/share/zoneinfo/tzdata.zi from the tzdata package (or
  /usr/share/zoneinfo/zone1970.tab as a fallback). However, not all
  timezones listed in tzdata.zi are included in the main tzdata package,
  but in the tzdata-legacy package.

  But, systemd-timedated does not validate the timezones when building
  the list, which makes the following possible:

  $ timedatectl list-timezones | grep "US/Alaska"
  US/Alaska
      
  $ timedatectl set-timezone US/Alaska
  Failed to set time zone: Invalid or not installed time zone 'US/Alaska'

  [Test Plan]

  Select a timezone from the tzdata-legacy package, e.g. US/Alaska.

  Confirm that /usr/share/zoneinfo/US/Alaska does not exist, and that
  the tzdata-legacy package is not installed:

  $ stat /usr/share/zoneinfo/US/Alaska
  $ apt policy tzdata-legacy

  Check if US/Alaska is included the the list from systemd-timedated:

  $ timedatectl list-timezones | grep "US/Alaska"

  With the fix, US/Alaska should not be listed. But, after installing
  tzdata-legacy, US/Alaska should be installed.

  $ apt install tzdata-legacy
  $ timedatectl list-timezones | grep "US/Alaska"

  [Where problems could occur]

  The patch uses an existing timezone_is_valid() function to validate
  timezones before returning a list in get_timezones(). In addition to
  systemd-timedated, get_timezones() is used in systemd-firstboot.

  If external programs depend on the current buggy behavior, this fix
  could cause a regression.

  Note that the org.freedesktop.timedate1.SetTimezone method already
  uses timezone_is_valid() to validate timezones (as demonstrated in the
  Impact section).

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2125405/+subscriptions