definitions of uid and euid

[Jeffrey Walton]

On Tue, Feb 2, 2021 at 12:22 PM Peng Yu via Libc-help
<libc-help@sourceware.org> wrote:
>
> `man getuid` says the following without explaining what real user ID
> and effective user ID are.
>
> - getuid() returns the real user ID of the calling process.
> - geteuid() returns the effective user ID of the calling process.
>
> Could anybody explain the definitions of uid and euid, and provide a
> minimum working example demonstrating when they are different? Thanks.

Also see Chen, Wagner and Dean's
https://www.usenix.org/conference/11th-usenix-security-symposium/setuid-demystified:

   Access control in Unix systems is mainly based on
   user IDs, yet the system calls that modify user IDs
   (uid-setting system calls), such as setuid, are poorly
   designed, insufficiently documented, and widely
   misunderstood and misused. This has caused many
   security vulnerabilities in application programs.
   ...

Jeff