sysctl(2): add kern.utc_offset: successor to the DST/TIMEZONE options(4)

The DST and TIMEZONE options(4) are incompatible with KARL, so we need
some other way to compensate for an RTC running with a known offset.

Enter kern.utc_offset, an offset in minutes East of UTC.  TIMEZONE has
always been minutes West, but this is inconsistent with how everyone
else talks about timezones, hence the flip.

TIMEZONE has the advantage of being compiled into the binary.  Our new
sysctl(2) has no such luck, so it needs to be set as early as possible
in boot, from sysctl.conf(5), so we can correct the kernel clock from
the RTC's local time to UTC before daemons like ntpd(8) and cron(8)
start.  To encourage this, kern.utc_offset is made immutable after the
securelevel(7) is raised to 1.

Prompted by yasuoka@.  Discussed with deraadt@, kettenis@, yasuoka@.
Additional testing by yasuoka@.

ok deraadt@, yasuoka@

1 files changed, 18 insertions, 1 deletions

diff --git a/lib/libc/sys/sysctl.2 b/lib/libc/sys/sysctl.2
index 28b96858f45..90e92b8500f 100644
--- a/lib/libc/sys/sysctl.2
+++ b/lib/libc/sys/sysctl.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: sysctl.2,v 1.30 2019/08/21 15:32:18 florian Exp $
+.\"	$OpenBSD: sysctl.2,v 1.31 2019/08/21 20:44:09 cheloha Exp $
 .\"
 .\" Copyright (c) 1993
 .\"	The Regents of the University of California.  All rights reserved.
@@ -488,6 +488,7 @@ information.
 .It Dv KERN_TIMECOUNTER Ta "node" Ta "not applicable"
 .It Dv KERN_TTY Ta "node" Ta "not applicable"
 .It Dv KERN_TTYCOUNT Ta "integer" Ta "no"
+.It Dv KERN_UTC_OFFSET Ta "integer" Ta "yes"
 .It Dv KERN_VERSION Ta "string" Ta "no"
 .It Dv KERN_WATCHDOG Ta "node" Ta "not applicable"
 .It Dv KERN_WITNESS Ta "node" Ta "not applicable"
@@ -1079,6 +1080,22 @@ Returns the number of input characters in raw mode.
 Number of available
 .Xr tty 4
 devices.
+.It Dv KERN_UTC_OFFSET Pq Va kern.utc_offset
+The real-time clock's
+.Pq RTC
+offset from
+Coordinated Universal Time
+.Pq UTC
+expressed as minutes East of UTC+0.
+When set,
+time read from the RTC is adjusted to remove the offset
+and time written to the RTC is adjusted to reapply it.
+This may simplify multibooting with an operating system that
+does not run the RTC in UTC mode.
+When running with a
+.Xr securelevel 7
+greater than 0,
+this variable may not be changed.
 .It Dv KERN_VERSION Pq Va kern.version
 The system version string.
 .It Dv KERN_WATCHDOG Pq Va kern.watchdog