No need to hack the kernel. That would be relatively easy with an interposition library assuming the ways Bob uses to know what the time is are bounded.
For example, many commands like date(1) are using clock_gettime(2) to get the current date and time. An interposing library would patch on the fly the date part and set it June 22.
This won't work statically linked binaries like busybox, but these binaries could be easily patched the same way.
Here is a sample code demonstrating the feasibility:
#define _GNU_SOURCE
#include <stdio.h>
#include <stdint.h>
#include <time.h>
#include <dlfcn.h>
#include <unistd.h>
#include <sys/types.h>
int clock_gettime(clockid_t clk_id, struct timespec *tp)
{
static int (*cgt)(clockid_t, struct timespec*) = NULL;
if (!cgt)
cgt = dlsym(RTLD_NEXT, "clock_gettime");
int rv = cgt(clk_id, tp);
if(getuid()==1000) // Assuming 1000 is bob's uid.
{
struct tm * tm=localtime(&tp->tv_sec);
tm->tm_mday=22;
tm->tm_mon=5;
time_t tt=mktime(tm);
tp->tv_sec=tt;
}
return rv;
}
And what it provides:
$ date
Wed Jun 2 23:44:51 CEST 2011
$ export LD_PRELOAD=$PWD/a.so
$ date
Wed Jun 22 23:44:51 CEST 2011
$ id -u
1000