Decide whether to turn off Wayland sessions in GDM (recommended - skip)

Description

With WaylandEnable=false in the [daemon] section of /etc/gdm3/daemon.conf, GDM runs the login screen and user sessions on the Xorg server instead of Wayland, and Xwayland is never started. This is the configuration the CIS benchmarks check for their Xwayland item.

Recommendation: skip this control (exclude it in the tailoring file, with the reason below) unless an audit against the CIS benchmark requires it. On a GNOME desktop, a Wayland session isolates native programs from each other and only X11 programs share Xwayland; turning Wayland off puts every program on Xorg, which removes that isolation for all of them. The control is kept, as a manual decision, so that the choice is recorded and the CIS item can be mapped.

exclude:
  - control: CB-DEB-DESK-010
    reason: Wayland isolation is kept on purpose; Xorg would expose every program.

Rationale

Xwayland gives X11 programs a shared X server: any of them can snoop the keyboard input and window contents of the others. CIS removes Xwayland by turning Wayland sessions off. Note that a full Xorg session has the same weakness for every program, not only X11 ones: this control trades Xwayland's attack surface for Xorg's, and only makes sense where the benchmark is a requirement.

Impact

Sessions run on Xorg: no Wayland isolation between programs, no Wayland-only features (fractional scaling, per-monitor refresh rate). The Xorg server (xserver-xorg-core and its drivers) must be installed, or GDM has no display server and no graphical login is possible. Xwayland cannot be removed on Debian: gnome-session and mutter depend on it.

Applies when

Detected: when: GNOME Display Manager is installed A scanner reports the control not applicable when one is false.

Setting

Audit

In /etc/gdm3/daemon.conf, the [daemon] section must contain WaylandEnable=false.

Remediation

Only if the decision is to follow the CIS item:

1. Install the Xorg server (apt install xserver-xorg) and check that an Xorg session works.
2. In /etc/gdm3/daemon.conf, section [daemon], set WaylandEnable=false.
3. Restart GDM at a convenient time (systemctl restart gdm closes every graphical session).

Rollback

Remove WaylandEnable=false from /etc/gdm3/daemon.conf and restart GDM.

References

• gdm3(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• GDM - configuration keys (gdm.schemas) The GNOME Project, vendor-doc, accessed 2026-10-18
• Debian Wiki - GDM Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle