@iska @teratology @amanda Yeah, I don't think it should be capability-based.

It's not really modeled with pipes, just filesystem permissions. So on boot, one of the things that happens is the process to drive the display starts up, and whoever started it has physical access to the machine, so that user's the owner. This makes a lot more sense than X having to be suid or the really truly horrifying Xwrapper bit going on right now, it makes a lot more sense than capabilities: the account that booted this machine owns this machine. (This is also why, on multiuser clusters, the fileserver is isolated.)