[Feature Request] - need to delete /etc/localtime when user wants to change timezone on al2022.

[amazonlinux]

[Feature Request] - need to delete /etc/localtime when user wants to change timezone on al2022.

[elsaco]

@liesenml SELinux is preventing timedatectl to modify /etc/localtime

Sample journal entries when trying to change timezone to America/Los_Angeles:

systemd[1]: Starting Time & Date Service...
systemd-timedated[3450]: /etc/localtime should be a symbolic link to a time zone data file in /usr/share/zoneinfo/.
audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-timedated comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
systemd[1]: Started Time & Date Service.
audit[3450]: AVC avc:  denied  { unlink } for  pid=3450 comm="systemd-timedat" name="localtime" dev="xvda1" ino=8778361 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1
systemd-timedated[3450]: Changed time zone to 'America/Los_Angeles' (PDT).
audit[3447]: USER_END pid=3447 uid=1000 auid=1000 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_keyinit,pam_limits,pam_systemd,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
sudo[3447]: pam_unix(sudo:session): session closed for user root

If SELinux is temporarily disabled with setenforce 0 the timezone update will succeed w/out having to delete /etc/localtime first.

[edwardvdv]

I can confirm this behaviour. The workaround by elsaco works.

Hi, I confirmed current Amazon Linux 2022 SELinux feature is Permissive by default. Probably due to #180.
https://docs.aws.amazon.com/linux/al2022/ug/selinux-modes.html

By default, Security Enhanced Linux (SELinux) is enabled and set to permissive mode for Amazon Linux 2022. In permissive mode, permission denials are logged but not enforced. SELinux is a collection of kernel features and utilities to provide a strong, flexible, mandatory access control (MAC) architecture to the major subsystems of the kernel.

https://aws.amazon.com/linux/amazon-linux-2022/faqs/

Q: What is the default AL2022 SELinux configuration?

A: AL2022 will have SELinux in permissive mode by default. You can change SELinux settings to enforced mode via command line by executing ‘setenforce’ or by running this command on launch from cloud-init userdata. When the instance is rebooted, it will remember and use the SELinux setting that was specified the first time unless you change it. Please refer to the AL2022 documentation for more details.

I think don't need elsaco's workaround anymore.

$ getenforce 
Permissive
$ curl -w '\n' 169.254.169.254/latest/meta-data/ami-id       
ami-0481d65847c3dfb90
$ timedatectl 
               Local time: Sat 2022-11-19 02:55:31 UTC
           Universal time: Sat 2022-11-19 02:55:31 UTC
                 RTC time: Sat 2022-11-19 02:55:30
                Time zone: n/a (UTC, +0000)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no
$ sudo timedatectl set-timezone Asia/Tokyo
$ timedatectl 
               Local time: Sat 2022-11-19 11:55:43 JST
           Universal time: Sat 2022-11-19 02:55:43 UTC
                 RTC time: Sat 2022-11-19 02:55:43
                Time zone: Asia/Tokyo (JST, +0900)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no
$
$ journalctl -u systemd-timedated
...
...
Nov 19 11:55:31 ip-172-31-20-224.ap-northeast-1.compute.internal systemd[1]: Started systemd-timedated.service - Time & Date Service.
Nov 19 11:55:41 ip-172-31-20-224.ap-northeast-1.compute.internal systemd-timedated[2078]: Changed time zone to 'Asia/Tokyo' (JST).
Nov 19 11:56:13 ip-172-31-20-224.ap-northeast-1.compute.internal systemd[1]: systemd-timedated.service: Deactivated successfully.
$

[nmeyerhans]

I've confirmed that this issue is still present in the AL2023 GA AMIs. Since we're running in permissive mode by default, functionality is not impaired and changing timezones works as intended, but the avc: denied messages does indicate that this operation would fail if you were to switch to enforcing mode.

If you do need to use timedatectl to change the timezone after enabling enforcing mode, you should be able to remove /etc/localtime manually before invoking it.

Will see about getting this fixed in a future release.

[nmeyerhans]

This is resolved current AL2023 releases with selinux-policy-36.16-1.amzn2023.0.3