{
  "id": "CB-UBU-DESK-010",
  "standard": "ubuntu",
  "version": "0.1.0",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-010",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-010.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-010.yml",
  "profiles_effective": [
    "server-hardened",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-DESK-010",
    "title": "Decide whether to turn off Wayland sessions in GDM (recommended - skip)",
    "finding": {
      "title": "GDM starts Wayland sessions, which run X11 programs through Xwayland",
      "description": "X11 programs running under Xwayland can read each other's input and windows, so one compromised X11 program can log the keys typed in the others."
    },
    "status": "active",
    "profiles": [
      "server-hardened",
      "desktop-hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "gdm",
      "wayland",
      "xwayland",
      "x11"
    ],
    "applicability": {
      "versions": [
        "20.04",
        "22.04",
        "24.04"
      ],
      "facts": [
        "gdm"
      ]
    },
    "description": "With `WaylandEnable=false` in the `[daemon]` section of `/etc/gdm3/custom.conf`, GDM runs the\nlogin screen and user sessions on the Xorg server instead of Wayland, and Xwayland is never\nstarted. This is the configuration the CIS benchmarks check for their Xwayland item.\n\nThe control does not apply to Ubuntu 26.04: since 25.10, GNOME Shell only runs on Wayland,\nGDM 50 no longer has a `WaylandEnable` key and the Xorg server is not installed. The Ubuntu\nfile is `custom.conf`, not `daemon.conf` as on Debian.\n",
    "rationale": "Xwayland gives X11 programs a shared X server: any of them can snoop the keyboard input and\nwindow contents of the others. CIS removes Xwayland by turning Wayland sessions off. Note\nthat a full Xorg session has the same weakness for every program, not only X11 ones: this\ncontrol trades Xwayland's attack surface for Xorg's, and only makes sense where the\nbenchmark is a requirement.\n",
    "impact": "Sessions run on Xorg: no Wayland isolation between programs, no Wayland-only features\n(fractional scaling, per-monitor refresh rate). The Xorg server (`xserver-xorg-core` and its\ndrivers) must be installed, or GDM has no display server and no graphical login is possible;\nUbuntu Desktop 20.04 to 24.04 installs it. Xwayland itself stays installed: `ubuntu-session`\ndepends on it.\n",
    "notes": "**Recommendation: skip this control** (exclude it in the tailoring file, with the reason below)\nunless an audit against the CIS benchmark requires it. On a GNOME desktop, a Wayland session\nisolates native programs from each other and only X11 programs share Xwayland; turning Wayland\noff puts every program on Xorg, which removes that isolation for all of them. The control is\nkept, as a manual decision, so that the choice is recorded and the CIS item can be mapped.\n\n```yaml\nexclude:\n  - control: CB-UBU-DESK-010\n    reason: Wayland isolation is kept on purpose; Xorg would expose every program.\n```\n",
    "setting": {
      "location": "/etc/gdm3/custom.conf, section [daemon]",
      "default_value": "WaylandEnable=true (unset)",
      "recommended_value": "WaylandEnable=false"
    },
    "audit": {
      "manual": "In `/etc/gdm3/custom.conf`, the `[daemon]` section must contain `WaylandEnable=false`.\n"
    },
    "remediation": {
      "manual": "Only if the decision is to follow the CIS item:\n1. Install the Xorg server (`apt install xserver-xorg`) and check that an Xorg session works.\n2. In `/etc/gdm3/custom.conf`, section `[daemon]`, set `WaylandEnable=false`.\n3. Restart GDM at a convenient time (`systemctl restart gdm` closes every graphical session).\n",
      "rollback": "Remove `WaylandEnable=false` from `/etc/gdm3/custom.conf` and restart GDM.\n"
    },
    "references": [
      {
        "title": "gdm3(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/gdm3.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Ubuntu 25.10 drops support for GNOME on Xorg",
        "url": "https://discourse.ubuntu.com/t/ubuntu-25-10-drops-support-for-gnome-on-xorg/62538",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "GDM - configuration keys (gdm.schemas)",
        "url": "https://gitlab.gnome.org/GNOME/gdm/-/blob/main/data/gdm.schemas.in",
        "publisher": "The GNOME Project",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1056.001"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}