Description
xserver-common holds the files shared by every X.Org server (Xorg, Xvfb, Xephyr, and Xwayland
on Ubuntu). When it is absent, no X server is installed. gdm3, the GNOME display manager of
Ubuntu Desktop, starts a graphical login screen as soon as it is installed.
The control is only in the hardened server profile; desktops need an X server or Xwayland.
Rationale
An X server is complex software, historically run with root privileges, with a long record of local privilege escalation flaws. A display manager adds a graphical login on the console and its own services (accessibility, network manager applets, remote login). A server administered over SSH needs neither.
Impact
Removes gdm3, xserver-common and every package that depends on them: X servers, and the
graphical desktop if one is installed (the ubuntu-desktop metapackages go with it). X client applications forwarded over SSH (ssh -X) still work,
since they use the X server of the administrator's workstation.
Audit
Run dpkg-query -W -f='${Status}\n' gdm3 xserver-common. It must not print
install ok installed.
Automated: every check must pass. Scanners report each check by its id.
gdm3
GNOME display manager.
name: gdm3
state: absent
xserver-common
X.Org server common files.
name: xserver-common
state: absent
Remediation
Run apt purge gdm3 xserver-common after checking the list of packages apt will remove.
| Restart | none |
| Disruption | low |
Rollback
Reinstall the needed X server, for example apt install xserver-xorg-core.
gdm3
Generated from check gdm3: the engine writes the fix for every output, it sets the expected value and the check runs again after.
xserver-common
Generated from check xserver-common: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- Xserver(1), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R58) ANSSI, guide, accessed 2026-10-19
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R58 | partial | R58 asks to install only the packages that are strictly needed; this control covers the X server. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1068 |
People and lifecycle
| Authors |
|
| Verified | 2026-10-19 by Sn0wAlice on 20.04, Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic. Stock image passes; with xvfb installed (xserver-common) the check fails, fix purges it, audit passes after reboot. gdm3 check passes on the stock image (GNOME not installed in this test). |
| Verified | 2026-10-19 by Sn0wAlice on 22.04, Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic. Stock image passes; with xvfb installed (xserver-common) the check fails, fix purges it, audit passes after reboot. gdm3 check passes on the stock image (GNOME not installed in this test). |
| Verified | 2026-10-19 by Sn0wAlice on 24.04, Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic. Stock image passes; with xvfb installed (xserver-common) the check fails, fix purges it, audit passes after reboot. gdm3 check passes on the stock image (GNOME not installed in this test). |
| Verified | 2026-10-19 by Sn0wAlice on 26.04, Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic. Stock image passes; with xvfb installed (xserver-common) the check fails, fix purges it, audit passes after reboot. gdm3 check passes on the stock image (GNOME not installed in this test). |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-19, 2026-10-19 |
| Translations | fr |
