Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I’ll start a new one that hopefully people can have an easier time with.

Basically, my overall interest is in understanding logname and getlogin() as it relates to audit trails. It breaks down like this:

1) My understanding is that logname and getlogin() both display the auid that would/will end up showing in the session’s audit logs. Is that correct? I know auid is an immutable process attribute, but I was interested in knowing whether the two are necessarily the same or just usually the same. This would help me with writing scripts/helper programs that can make access control decisions based on the user’s original identity, rather than just who they happen to be at the moment or a mutable environmental variable.

2) I still don’t understand how the exploit of CVE 2003-0388 being shown was supposed to work. If someone could explain that to me, it would be great.

My primary interest is with point #1, though.