By default, the Xauthority file is created with mode 644, enabling any user to hijack another user X screen. Attached patch seems to fix the problem for me. === modified file 'src/xauth.c' --- lightdm/src/xauth.c 2010-08-05 00:24:13 +0000 +++ lightdm/src/xauth.c 2010-12-04 15:13:54 +0000 @@ -12,6 +12,7 @@ #include <string.h> #include <unistd.h> #include <pwd.h> +#include <sys/stat.h> #include "xauth.h" @@ -109,6 +110,9 @@ g_object_unref (file); return FALSE; } + + if (chmod (path, S_IRUSR | S_IWUSR) != 0) + g_warning ("Failed to set permissions on authorization file"); /* NOTE: Would like to do: * g_file_set_attribute_string (file, G_FILE_ATTRIBUTE_OWNER_USER, username, G_FILE_QUERY_INFO_NONE, NULL, error))