--- gdm-2.29.92/daemon/gdm-slave.c-orig	2010-03-12 16:54:30.620931478 -0600
+++ gdm-2.29.92/daemon/gdm-slave.c	2010-03-12 17:04:44.061658576 -0600
@@ -369,6 +369,25 @@ gdm_slave_set_busy_cursor (GdmSlave *sla
         }
 }
 
+static gboolean
+gdm_slave_setup_xauth (XHostAddress *host_entries, XServerInterpretedAddress *si_entries)
+{
+        si_entries[0].type = "localuser";
+        si_entries[0].typelength = strlen ("localuser");
+        si_entries[1].type = "localuser";
+        si_entries[1].typelength = strlen ("localuser");
+
+        si_entries[0].value = "root";
+        si_entries[0].valuelength = strlen ("root");
+        si_entries[1].value = GDM_USERNAME;
+        si_entries[1].valuelength = strlen (GDM_USERNAME);
+
+        host_entries[0].address = (char *) &si_entries[0];
+        host_entries[0].length = sizeof (XServerInterpretedAddress);
+        host_entries[1].address = (char *) &si_entries[1];
+        host_entries[1].length = sizeof (XServerInterpretedAddress);
+}
+
 gboolean
 gdm_slave_connect_to_x11_display (GdmSlave *slave)
 {
@@ -417,23 +436,10 @@ gdm_slave_connect_to_x11_display (GdmSla
                 /* Give programs run by the slave and greeter access to the display
                  * independent of current hostname
                  */
-                si_entries[0].type = "localuser";
-                si_entries[0].typelength = strlen ("localuser");
-                si_entries[1].type = "localuser";
-                si_entries[1].typelength = strlen ("localuser");
-
-                si_entries[0].value = "root";
-                si_entries[0].valuelength = strlen ("root");
-                si_entries[1].value = GDM_USERNAME;
-                si_entries[1].valuelength = strlen (GDM_USERNAME);
-
-                host_entries[0].address = (char *) &si_entries[0];
-                host_entries[0].length = sizeof (XServerInterpretedAddress);
-                host_entries[1].address = (char *) &si_entries[1];
-                host_entries[1].length = sizeof (XServerInterpretedAddress);
-
+                gdm_slave_setup_xauth (host_entries, si_entries);
                 XAddHosts (slave->priv->server_display, host_entries,
                            G_N_ELEMENTS (host_entries));
+
         } else {
                 g_debug ("GdmSlave: Connected to display %s", slave->priv->display_name);
                 ret = TRUE;
@@ -793,6 +799,11 @@ gdm_slave_add_user_authorization (GdmSla
                                   const char *username,
                                   char      **filenamep)
 {
+        XHostAddress host_entries[2] = {
+                { FamilyServerInterpreted },
+                { FamilyServerInterpreted }
+        };
+        XServerInterpretedAddress si_entries[2];
         gboolean res;
         GError  *error;
         char    *filename;
@@ -830,6 +841,13 @@ gdm_slave_add_user_authorization (GdmSla
         }
         g_free (filename);
 
+        /* Remove access for the programs run by slave and greeter now that the
+         * user session is starting.
+         */
+        gdm_slave_setup_xauth (host_entries, si_entries);
+        XRemoveHosts (slave->priv->server_display, host_entries,
+                      G_N_ELEMENTS (host_entries));
+
         return res;
 }
 
