--- gdm-2.29.6/daemon/gdm-slave.c-orig	2010-02-15 16:45:30.637523244 -0600
+++ gdm-2.29.6/daemon/gdm-slave.c	2010-02-15 16:49:29.298345572 -0600
@@ -448,6 +448,39 @@ gdm_slave_window_path (GdmSlave *slave)
         g_setenv ("WINDOWPATH", newwindowpath, TRUE);
 }
 
+static gboolean
+gdm_slave_set_xauth (GdmSlave *slave, gboolean xauth_state)
+{
+        XHostAddress host_entries[2] = {
+                { FamilyServerInterpreted },
+                { FamilyServerInterpreted }
+        };
+        XServerInterpretedAddress si_entries[2];
+
+        si_entries[0].type = "localuser";
+        si_entries[0].typelength = strlen ("localuser");
+        si_entries[1].type = "localuser";
+        si_entries[1].typelength = strlen ("localuser");
+
+        si_entries[0].value = "root";
+        si_entries[0].valuelength = strlen ("root");
+        si_entries[1].value = GDM_USERNAME;
+        si_entries[1].valuelength = strlen (GDM_USERNAME);
+
+        host_entries[0].address = (char *) &si_entries[0];
+        host_entries[0].length = sizeof (XServerInterpretedAddress);
+        host_entries[1].address = (char *) &si_entries[1];
+        host_entries[1].length = sizeof (XServerInterpretedAddress);
+
+        if (xauth_state) {
+                XAddHosts (slave->priv->server_display, host_entries,
+                           G_N_ELEMENTS (host_entries));
+        } else {
+                XRemoveHosts (slave->priv->server_display, host_entries,
+                              G_N_ELEMENTS (host_entries));
+        }
+}
+
 gboolean
 gdm_slave_connect_to_x11_display (GdmSlave *slave)
 {
@@ -484,35 +517,13 @@ gdm_slave_connect_to_x11_display (GdmSla
                 g_warning ("Unable to connect to display %s", slave->priv->display_name);
                 ret = FALSE;
         } else if (slave->priv->display_is_local) {
-                XHostAddress host_entries[2] = {
-                        { FamilyServerInterpreted },
-                        { FamilyServerInterpreted }
-                };
-                XServerInterpretedAddress si_entries[2];
-
                 g_debug ("GdmSlave: Connected to display %s", slave->priv->display_name);
                 ret = TRUE;
 
                 /* Give programs run by the slave and greeter access to the display
                  * independent of current hostname
                  */
-                si_entries[0].type = "localuser";
-                si_entries[0].typelength = strlen ("localuser");
-                si_entries[1].type = "localuser";
-                si_entries[1].typelength = strlen ("localuser");
-
-                si_entries[0].value = "root";
-                si_entries[0].valuelength = strlen ("root");
-                si_entries[1].value = GDM_USERNAME;
-                si_entries[1].valuelength = strlen (GDM_USERNAME);
-
-                host_entries[0].address = (char *) &si_entries[0];
-                host_entries[0].length = sizeof (XServerInterpretedAddress);
-                host_entries[1].address = (char *) &si_entries[1];
-                host_entries[1].length = sizeof (XServerInterpretedAddress);
-
-                XAddHosts (slave->priv->server_display, host_entries,
-                           G_N_ELEMENTS (host_entries));
+                gdm_slave_set_xauth (slave, TRUE);
         } else {
                 g_debug ("GdmSlave: Connected to display %s", slave->priv->display_name);
                 ret = TRUE;
@@ -913,6 +924,11 @@ gdm_slave_add_user_authorization (GdmSla
         }
         g_free (filename);
 
+        /* Remove access for the programs run by slave and greeter now that the
+         * user session is starting.
+         */
+        gdm_slave_set_xauth (slave, FALSE);
+
         return res;
 }
 
