use default timezone from /etc/localtime if $TZ is unset/blank

the way this is implemented, it also allows explicit setting of
TZ=/etc/localtime even for suid programs. this is not a problem
because /etc/localtime is a trusted path, much like the trusted
zoneinfo search path.

src/time/__tz.c

@@ -128,7 +128,7 @@ static void do_tzset()
 		"/usr/share/zoneinfo/\0/share/zoneinfo/\0/etc/zoneinfo/\0";
 
 	s = getenv("TZ");
-	if (!s || !*s) s = __gmt;
+	if (!s || !*s) s = "/etc/localtime";
 
 	if (old_tz && !strcmp(s, old_tz)) return;
 
@@ -153,7 +153,8 @@ static void do_tzset()
 	if (*s == ':' || ((p=strchr(s, '/')) && !memchr(s, ',', p-s))) {
 		if (*s == ':') s++;
 		if (*s == '/' || *s == '.') {
-			if (!libc.secure) map = __map_file(s, &map_size);
+			if (!libc.secure || !strcmp(s, "/etc/localtime"))
+				map = __map_file(s, &map_size);
 		} else {
 			size_t l = strlen(s);
 			if (l <= NAME_MAX && !strchr(s, '.')) {