Module peercred 

The peercred provider: authenticates a local-socket peer by its kernel-reported uid.

Two acceptance paths, both explicit:

• The daemon’s OWN uid maps to the trusted shared operator while security.trust_daemon_uid is on (the default): the operator who runs the daemon owns its config file, and local-only lockout recovery depends on that authority.
• Any other uid must be bound by an explicit [users.<name>].uid roster entry, which resolves to that entry’s durable principal id.

Everything else — an unrostered uid, root, a roster entry removed since boot — is denied. There is no fallback from a failed uid match to shared-operator access.

The uid→principal binding is live state (UidRoster): the daemon refreshes it from config at the same moment it bumps the resolver’s authorization generation, so roster edits apply without restart. The resolver independently denies identities whose roster entry vanished, so a stale binding can only DENY sooner, never allow longer.

Structs

PeercredAuthProvider

UidRoster

Live uid → durable-principal-id binding compiled from [users].