[catlifeonmars]

“--“ doesn’t work on all versions of getent.

A better fix is to call “getent passwd” with no user controlled arguments and then parse the resulting list. This gets rid of the input sanitization problem entirely.

[tryauuum]

that's stupid. getent passwd will fetch the user list from the network depending on setup. Have fun fetching 40000 records from the network every call

[cyberax]

Are there any actual systems that can run Tailscale and that have faulty getent?

[raggi]

Yes

[cyberax]

Which ones? Alpine supports it.

[raggi]

Most variants don't, Alpine in fact does not, nor does the uclibc shell script, nor the commonly copied in implementation in many busybox environments.

Reference: https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/m...