This is just a dirty fix. It adds weird restrictions and masks issues.
Refactoring external invocations to use safe argument handling is a better way to fix it. Along with tests that exercise weird names.
Refactoring external invocations to use safe argument handling is a better way to fix it. Along with tests that exercise weird names.
If so, this is kind of an understandably ugly problem, though there is still a better option than shelling out -- systemd-userdb.
The username policy fixes this issue for good, regardless of whatever you write in the future, or whatever new mechanism is introduced.
It’s a restriction for sure, but it’s not a nonsense restriction? Who would have a username starting with a hyphen? I didn’t even know it was possible until today.
The better fix would be to not have the username pass through a parser looking for cli flags in the first place.