yes  i found the issue when the passwd entry was legitimately missing  i was surprised to see both arc networkd processes running as root in  ps under normal circumstances the entry should not be missing  and the risk of something affecting  this  daemon is low  but security critical code often gets attacked in ways that because something that  shouldn t  fail to fail  e g maybe the bad guy cannot write arbitrary contents into  etc passwd  but  on a normal linux box  he might be able to trick a careless cron job into erasing clobbering it is contents through symlink attacks  and then subsequent calls to getpwnam fail since chrome os uses dm verity to protect the rootfs contents  somebody cannot get the os to return arbitrary data when reading a file  but maybe they can get the os to return an i o error if the file data is overwritten with bad content on disk exhaustion attacks can sometimes induce failures that are useful to a hacker  e g  what if somebody opens up file descriptors  then runs a setuid program that fails to open the th fd and reacts in a careless way linux veterans may remember this design flaw in the original posix capabilities scheme 