From b88d5de85e01507b0f695b32480e248e5b8c8295 Mon Sep 17 00:00:00 2001
From: Dylan Reid <dgreid@fb.com>
Date: Wed, 3 Jun 2026 09:36:11 -0700
Subject: [PATCH] main: logger: capture local timezone before seccomp

Local-time log fields called `jiff::Zoned::now()`, which resolves the
system timezone on every record by reading
`/etc/localtime`/`/etc/timezone` if it doesn't hit the cached version.
This cache miss could then cause a seccomp violation depending on the
thread it was run from.

Avoid this by capturing the value in `Logger`. This avoids opening the
seccomp filter for the whole process.

Signed-off-by: Dylan Reid <dgreid@fb.com>
---
 cloud-hypervisor/src/logger.rs | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/cloud-hypervisor/src/logger.rs b/cloud-hypervisor/src/logger.rs
index 7dcae4851..2f73d386e 100644
--- a/cloud-hypervisor/src/logger.rs
+++ b/cloud-hypervisor/src/logger.rs
@@ -8,6 +8,7 @@ use std::str::FromStr;
 use std::sync::Mutex;
 use std::time::Instant;
 
+use jiff::tz::TimeZone;
 use thiserror::Error;
 
 #[derive(Debug, Error)]
@@ -185,6 +186,9 @@ pub struct Logger {
     start: Instant,
     pid: u32,
     tokens: Vec<Token>,
+    // Saving the timezone when Logger is constructed avoids potential seccomp violations when the
+    // internal libc timezone cache expires as the affected thread is unpredictable.
+    local_tz: TimeZone,
 }
 
 impl Logger {
@@ -194,6 +198,7 @@ impl Logger {
             start: Instant::now(),
             pid: std::process::id(),
             tokens: parse_format(format)?,
+            local_tz: TimeZone::try_system().unwrap_or(TimeZone::UTC),
         })
     }
 }
@@ -232,7 +237,9 @@ impl log::Log for Logger {
                     write!(&mut *out, "{}", zoned.strftime("%m%d %H:%M:%S%.6f"))
                 }
                 Token::LocalGlog => {
-                    let zoned = zoned_local.get_or_insert_with(jiff::Zoned::now);
+                    let zoned = zoned_local.get_or_insert_with(|| {
+                        jiff::Timestamp::now().to_zoned(self.local_tz.clone())
+                    });
                     write!(&mut *out, "{}", zoned.strftime("%m%d %H:%M:%S%.6f"))
                 }
                 Token::Pid => write!(&mut *out, "{}", self.pid),
@@ -255,7 +262,9 @@ impl log::Log for Logger {
                         Zone::Utc => zoned_utc.get_or_insert_with(|| {
                             jiff::Timestamp::now().to_zoned(jiff::tz::TimeZone::UTC)
                         }),
-                        Zone::Local => zoned_local.get_or_insert_with(jiff::Zoned::now),
+                        Zone::Local => zoned_local.get_or_insert_with(|| {
+                            jiff::Timestamp::now().to_zoned(self.local_tz.clone())
+                        }),
                     };
                     write_time_field(&mut *out, *field, zoned)
                 }