In Tiny Core 3.0, the /etc/passwd entry for "nobody" is:
nobody:x:65534:65534:nobody:/bin/false
The home directory field is missing, so the system is using "/bin/false" as the home directory instead of the shell. This has the effect of allowing the nobody user to login with a shell if a password was set for nobody, instead of using "/bin/false" as the shell which should immediately log the user out.
To fix this, the /etc/passwd entry could be set to something like this that specifies a home directory:
nobody:x:65534:65534:nobody:/nonexistent:/bin/false
Since this correction will change the behavior of nobody, I think there is a small chance it could cause regressions with extensions that use the nobody user.
Thanks,
Brian