--- gdm-2.27.90/gui/simple-greeter/gdm-simple-greeter.schemas.in-orig	2009-08-31 14:24:08.587186000 -0500
+++ gdm-2.27.90/gui/simple-greeter/gdm-simple-greeter.schemas.in	2009-08-31 16:34:50.675703131 -0500
@@ -281,6 +281,41 @@
         <long></long>
       </locale>
     </schema>
+    <schema>
+      <key>/schemas/apps/gdm/simple-greeter/include_all</key>
+      <applyto>/apps/gdm/simple-greeter/include_all</applyto>
+      <owner>gdm-simple-greeter</owner>
+      <type>bool</type>
+      <default>TRUE</default>
+      <locale name="C">
+        <short>Include local users in Face Browser</short>
+        <long>Set to true to include system local users in Face Browser</long>
+      </locale>
+    </schema>
+    <schema>
+      <key>/schemas/apps/gdm/simple-greeter/include</key>
+      <applyto>/apps/gdm/simple-greeter/include</applyto>
+      <owner>gdm-simple-greeter</owner>
+      <type>list</type>
+      <list_type>string</list_type>
+      <default>[]</default>
+      <locale name="C">
+        <short>Users to include in the Face Browser</short>
+        <long>Set to a list of users to be shown by default in the Face Browser.</long>
+      </locale>
+    </schema>
+    <schema>
+      <key>/schemas/apps/gdm/simple-greeter/exclude</key>
+      <applyto>/apps/gdm/simple-greeter/exclude</applyto>
+      <owner>gdm-simple-greeter</owner>
+      <type>list</type>
+      <list_type>string</list_type>
+      <default>[bin,root,daemon,adm,lp,sync,shutdown,halt,mail,news,uucp,operator,nobody,nobody4,noaccess,postgres,pvm,rpm,nfsnobody,pcap]</default>
+      <locale name="C">
+        <short>Users to exclude in the Face Browser</short>
+        <long>Set to a list of users not to be shown in the Face Browser.</long>
+      </locale>
+    </schema>
 
   </schemalist>
 </gconfschemafile>
--- gdm-2.27.90/gui/simple-greeter/gdm-user-manager.c-orig	2009-08-31 19:36:34.005827775 -0500
+++ gdm-2.27.90/gui/simple-greeter/gdm-user-manager.c	2009-08-31 19:38:45.136149154 -0500
@@ -40,6 +40,8 @@
 #include <glib-object.h>
 #include <gio/gio.h>
 
+#include <gconf/gconf-client.h>
+
 #include <dbus/dbus.h>
 #include <dbus/dbus-glib.h>
 #include <dbus/dbus-glib-lowlevel.h>
@@ -76,34 +78,14 @@
 
 #define DEFAULT_GLOBAL_FACE_DIR DATADIR "/faces"
 #define DEFAULT_USER_ICON       "stock_person"
-#define DEFAULT_EXCLUDE         { "bin",        \
-                                  "root",       \
-                                  "daemon",     \
-                                  "adm",        \
-                                  "lp",         \
-                                  "sync",       \
-                                  "shutdown",   \
-                                  "halt",       \
-                                  "mail",       \
-                                  "news",       \
-                                  "uucp",       \
-                                  "operator",   \
-                                  "nobody",     \
-                                  "nobody4",    \
-                                  "noaccess",   \
-                                  GDM_USERNAME, \
-                                  "postgres",   \
-                                  "pvm",        \
-                                  "rpm",        \
-                                  "nfsnobody",  \
-                                  "pcap",       \
-                                  NULL }
+#define KEY_INCLUDE_ALL "/apps/gdm/simple-greeter/include_all"
+#define KEY_INCLUDE     "/apps/gdm/simple-greeter/include"
+#define KEY_EXCLUDE     "/apps/gdm/simple-greeter/exclude"
 
 struct GdmUserManagerPrivate
 {
         GHashTable            *users;
         GHashTable            *sessions;
-        GHashTable            *exclusions;
         GHashTable            *shells;
         DBusGConnection       *connection;
         DBusGProxy            *seat_proxy;
@@ -112,6 +94,10 @@ struct GdmUserManagerPrivate
         GFileMonitor          *passwd_monitor;
         GFileMonitor          *shells_monitor;
 
+        GSList                *exclude;
+        GSList                *include;
+        gboolean               include_all;
+
         guint                  reload_id;
         guint                  ck_history_id;
 
@@ -571,6 +557,39 @@ get_x11_display_for_session (DBusGConnec
         return x11_display;
 }
 
+static gint
+match_name_cmpfunc (gconstpointer a,
+                    gconstpointer b)
+{
+        if (a == NULL || b == NULL)
+                return -1;
+
+        return g_strcmp0 ((char *) a,
+                          (char *) b);
+}
+
+static gboolean
+check_excludes (GdmUserManager *manager, const char *user)
+{
+        GSList   *found;
+        gboolean  ret = FALSE;
+
+        g_debug ("checking exclude list");
+
+        /* always exclude the "gdm" user. */
+        if (user == NULL || (strcmp (user, GDM_USERNAME) == 0))
+                return TRUE;
+
+        if (manager->priv->exclude != NULL) {
+                found = g_slist_find_custom (manager->priv->exclude,
+                                             user,
+                                             match_name_cmpfunc);
+                if (found != NULL)
+                        ret = TRUE;
+        }
+        return ret;
+}
+
 static gboolean
 maybe_add_session_for_user (GdmUserManager *manager,
                             GdmUser        *user,
@@ -600,7 +619,7 @@ maybe_add_session_for_user (GdmUserManag
                 goto out;
         }
 
-        if (g_hash_table_lookup (manager->priv->exclusions, gdm_user_get_user_name (user))) {
+        if (check_excludes (manager, gdm_user_get_user_name (user))) {
                 g_debug ("GdmUserManager: excluding user '%s'", gdm_user_get_user_name (user));
                 goto out;
         }
@@ -866,7 +885,7 @@ seat_session_added (DBusGProxy     *seat
         }
 
         /* check exclusions up front */
-        if (g_hash_table_lookup (manager->priv->exclusions, pwent->pw_name)) {
+        if (check_excludes (manager, pwent->pw_name)) {
                 g_debug ("GdmUserManager: excluding user '%s'", pwent->pw_name);
                 return;
         }
@@ -1169,7 +1188,7 @@ process_ck_history_line (GdmUserManager 
                 return;
         }
 
-        if (g_hash_table_lookup (manager->priv->exclusions, username)) {
+        if (check_excludes (manager, username)) {
                 g_debug ("GdmUserManager: excluding user '%s'", username);
                 g_free (username);
                 return;
@@ -1298,6 +1317,20 @@ reload_ck_history (GdmUserManager *manag
 }
 
 static void
+add_included_user (char *username, GdmUserManager *manager)
+{
+        GdmUser     *user;
+
+        g_debug ("Adding included user %s", username);
+        user = gdm_user_manager_get_user (manager, username);
+        if (user == NULL) {
+                g_debug ("GdmUserManager: unable to lookup user '%s'", username);
+                g_free (username);
+                return;
+        }
+}
+
+static void
 reload_passwd (GdmUserManager *manager)
 {
         struct passwd *pwent;
@@ -1329,7 +1362,12 @@ reload_passwd (GdmUserManager *manager)
                 }
         }
 
-        for (pwent = fgetpwent (fp); pwent != NULL; pwent = fgetpwent (fp)) {
+        if (manager->priv->include_all == TRUE)
+                g_debug ("GdmUserManager: include_all is TRUE");
+        else
+                g_debug ("GdmUserManager: include_all is FALSE");
+
+        for (pwent = fgetpwent (fp); (pwent != NULL && manager->priv->include_all == TRUE); pwent = fgetpwent (fp)) {
                 GdmUser *user;
 
                 user = NULL;
@@ -1347,7 +1385,7 @@ reload_passwd (GdmUserManager *manager)
                 }
 
                 /* ...And explicitly excluded users */
-                if (g_hash_table_lookup (manager->priv->exclusions, pwent->pw_name)) {
+                if (check_excludes (manager, pwent->pw_name)) {
                         g_debug ("GdmUserManager: explicitly skipping user: %s", pwent->pw_name);
                         continue;
                 }
@@ -1397,6 +1435,13 @@ reload_passwd (GdmUserManager *manager)
                 }
         }
 
+        /* Add users who are specifically included */
+        if (manager->priv->include != NULL) {
+                g_slist_foreach (manager->priv->include,
+                                 (GFunc)add_included_user,
+                                 (gpointer)manager);
+        }
+
  out:
         /* Cleanup */
 
@@ -1557,71 +1602,91 @@ gdm_user_manager_init (GdmUserManager *m
         int            i;
         GFile         *file;
         GError        *error;
-        const char    *exclude_default[] = DEFAULT_EXCLUDE;
+        GConfClient   *client;
 
         manager->priv = GDM_USER_MANAGER_GET_PRIVATE (manager);
 
-        /* sessions */
-        manager->priv->sessions = g_hash_table_new_full (g_str_hash,
-                                                         g_str_equal,
-                                                         g_free,
-                                                         g_free);
+        /* exclude/include */
+        error = NULL;
+        client = gconf_client_get_default ();
+        manager->priv->exclude = gconf_client_get_list (client, KEY_EXCLUDE, GCONF_VALUE_STRING, &error);
+        if (error != NULL) {
+                g_debug ("GdmUserManager: unable to get exclude configuration: %s", error->message);
+                g_error_free (error);
+                manager->priv->exclude = NULL;
+        }
 
-        /* exclusions */
-        manager->priv->exclusions = g_hash_table_new_full (g_str_hash,
-                                                           g_str_equal,
-                                                           g_free,
-                                                           NULL);
-        for (i = 0; exclude_default[i] != NULL; i++) {
-                g_hash_table_insert (manager->priv->exclusions,
-                                     g_strdup (exclude_default [i]),
-                                     GUINT_TO_POINTER (TRUE));
+        error = NULL;
+        manager->priv->include = gconf_client_get_list (client, KEY_INCLUDE, GCONF_VALUE_STRING, &error);
+        if (error != NULL) {
+                g_debug ("GdmUserManager: unable to get include configuration: %s", error->message);
+                g_error_free (error);
+                manager->priv->include = NULL;
         }
 
-        /* /etc/shells */
-        manager->priv->shells = g_hash_table_new_full (g_str_hash,
-                                                       g_str_equal,
-                                                       g_free,
-                                                       NULL);
-        reload_shells (manager);
-        file = g_file_new_for_path (_PATH_SHELLS);
         error = NULL;
-        manager->priv->shells_monitor = g_file_monitor_file (file,
-                                                             G_FILE_MONITOR_NONE,
-                                                             NULL,
-                                                             &error);
-        if (manager->priv->shells_monitor != NULL) {
-                g_signal_connect (manager->priv->shells_monitor,
-                                  "changed",
-                                  G_CALLBACK (on_shells_monitor_changed),
-                                  manager);
-        } else {
-                g_warning ("Unable to monitor %s: %s", _PATH_SHELLS, error->message);
+        manager->priv->include_all = gconf_client_get_bool (client, KEY_INCLUDE_ALL, &error);
+
+        if (error != NULL) {
+                g_debug ("GdmUserManager: unable to get include_all configuration: %s", error->message);
                 g_error_free (error);
+                manager->priv->include_all = TRUE;
         }
-        g_object_unref (file);
+        g_object_unref (client);
+
+        /* sessions */
+        manager->priv->sessions = g_hash_table_new_full (g_str_hash,
+                                                         g_str_equal,
+                                                         g_free,
+                                                         g_free);
 
-        /* /etc/passwd */
+        /* users */
         manager->priv->users = g_hash_table_new_full (g_str_hash,
                                                       g_str_equal,
                                                       g_free,
                                                       (GDestroyNotify) g_object_run_dispose);
-        file = g_file_new_for_path (PATH_PASSWD);
-        manager->priv->passwd_monitor = g_file_monitor_file (file,
-                                                             G_FILE_MONITOR_NONE,
-                                                             NULL,
-                                                             &error);
-        if (manager->priv->passwd_monitor != NULL) {
-                g_signal_connect (manager->priv->passwd_monitor,
-                                  "changed",
-                                  G_CALLBACK (on_passwd_monitor_changed),
-                                  manager);
-        } else {
-                g_warning ("Unable to monitor %s: %s", PATH_PASSWD, error->message);
-                g_error_free (error);
-        }
-        g_object_unref (file);
 
+        if (manager->priv->include_all == TRUE) {
+                /* /etc/shells */
+                manager->priv->shells = g_hash_table_new_full (g_str_hash,
+                                                               g_str_equal,
+                                                               g_free,
+                                                               NULL);
+                reload_shells (manager);
+                file = g_file_new_for_path (_PATH_SHELLS);
+                error = NULL;
+                manager->priv->shells_monitor = g_file_monitor_file (file,
+                                                                     G_FILE_MONITOR_NONE,
+                                                                     NULL,
+                                                                     &error);
+                if (manager->priv->shells_monitor != NULL) {
+                        g_signal_connect (manager->priv->shells_monitor,
+                                          "changed",
+                                          G_CALLBACK (on_shells_monitor_changed),
+                                          manager);
+                } else {
+                        g_warning ("Unable to monitor %s: %s", _PATH_SHELLS, error->message);
+                        g_error_free (error);
+                }
+                g_object_unref (file);
+
+                /* /etc/passwd */
+                file = g_file_new_for_path (PATH_PASSWD);
+                manager->priv->passwd_monitor = g_file_monitor_file (file,
+                                                                     G_FILE_MONITOR_NONE,
+                                                                     NULL,
+                                                                     &error);
+                if (manager->priv->passwd_monitor != NULL) {
+                        g_signal_connect (manager->priv->passwd_monitor,
+                                          "changed",
+                                          G_CALLBACK (on_passwd_monitor_changed),
+                                          manager);
+                } else {
+                        g_warning ("Unable to monitor %s: %s", PATH_PASSWD, error->message);
+                        g_error_free (error);
+                }
+                g_object_unref (file);
+        }
 
         get_seat_proxy (manager);
 
@@ -1642,6 +1707,14 @@ gdm_user_manager_finalize (GObject *obje
 
         g_return_if_fail (manager->priv != NULL);
 
+        if (manager->priv->exclude != NULL) {
+                g_slist_free (manager->priv->exclude);
+        }
+
+        if (manager->priv->include != NULL) {
+                g_slist_free (manager->priv->include);
+        }
+
         if (manager->priv->seat_proxy != NULL) {
                 g_object_unref (manager->priv->seat_proxy);
         }
