Detections
Analytics
1.8.7 Ensure Wayland is configured
Information
The GNOME Display Manager (GDM) uses the Wayland display server by default. The WaylandEnable setting in the [daemon] block of /etc/gdm/custom.conf (or /etc/gdm3/custom.conf ) controls this behavior; when it is set to false, GDM and user login sessions fall back to the legacy Xorg (X11) display server.Wayland isolates graphical clients from one another. Under the legacy X11 protocol any connected client can read another client's keystrokes, capture the contents of other windows, and inject input events, because X11 provides no isolation between clients sharing a display. Wayland enforces this isolation at the compositor, so a compromised or malicious application cannot observe or manipulate other graphical sessions. Leaving Wayland enabled (the default) rather than falling back to Xorg preserves this isolation and reduces the graphical attack surface.
Solution
If Wayland has been disabled, edit the GDM configuration file ( /etc/gdm/custom.conf or /etc/gdm3/custom.conf ) and remove or comment out the WaylandEnable=false line in the [daemon] block so that GDM uses the default Wayland display server. For example:# sed -ri '/^\s*\[daemon\]/,/^\s*\[/ s/^(\s*WaylandEnable\s*=\s*false)/# \1/I' /etc/gdm/custom.conf
Reboot the system, or restart GDM, for the change to take effect.
Impact:
Wayland is the default display server, so leaving it enabled has no impact on a default installation. A small number of legacy applications and tools (for example some screen-capture, remote-desktop, or assistive technologies) require an Xorg session; where those are a documented operational requirement, this recommendation may not be applicable. Legacy X11 applications otherwise continue to run under Wayland through Xwayland.
See Also
Item Details
Audit Name: CIS Oracle Linux 9 v3.0.0 L1 Workstation
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: bbefc1d90d156c5ebf6a046220530db638f79dd06e031627da5c599f337138c6