No need to hack the kernel. That would be relatively easy with an interposition library assuming the ways Bob uses to know what the time is are bounded.
For example, many commands like date(1) are using clock_gettime(2) to get the current date and time. An interposing library would patch on the fly the date part and set it June 22.
This won't work statically linked binaries like busybox, but these binaries could be easily patched the same way.
Here is a sample code demonstrating the feasibility:
#define _GNU_SOURCE
#include <stdio.h>
#include <stdint.h>
#include <time.h>
#include <dlfcn.h>
#include <unistd.h>
#include <sys/types.h>
int clock_gettime(clockid_t clk_id, struct timespec *tp)
{
static int (*cgt)(clockid_t, struct timespec*) = NULL;
if (!cgt)
cgt = dlsym(RTLD_NEXT, "clock_gettime");
int rv = cgt(clk_id, tp);
if(getuid()==1000) // Assuming 1000 is bob's uid.
{
struct tm * tm=localtime(&tp->tv_sec);
tm->tm_mday=22;
tm->tm_mon=5;
time_t tt=mktime(tm);
tp->tv_sec=tt;
}
return rv;
}
And what it provides:
$ date
Wed Jun 2 23:44:51 CEST 2011
$ export LD_PRELOAD=$PWD/a.so
$ date
Wed Jun 22 23:44:51 CEST 2011
$ id -u
1000
Break the clock display for bob. Ubuntu is open source so pretty much everything is possible if you are willing to put in the time to find out how to do it. – soandos – 2011-05-31T19:20:54.910
1Not without hacking into the kernelspace. Of course, if you are just trying to fake date(1) then you can just add an if statement with the getuid() function. – bubu – 2011-05-31T19:28:40.393
Tell me more about this if statement – tel – 2011-05-31T19:37:29.803
1Bob has the same birthday as me. Neat. – Zoredache – 2011-05-31T20:57:36.970