Yeah, user-mode X11 was being implemented around 2014 or so. I was there at Red Hat when it was happening. GDM itself doesn't need root anymore -- it can run a

Yeah, user-mode X11 was being implemented around 2014 or so. I was there at Red Hat when it was happening. GDM itself doesn't need root anymore -- it can run as its own user. The way it's architected, there's what's known as a "greeter session". This is what provides the user picker, it has to be a full desktop session to provide accessibility / screen reader / OSK / all the bells and whistles, and it runs as the gdm user. Once you pick a user to start the authentication flow, it forks off a special helper that's marked setuid root so it can interact with PAM (unfortunately, arbitrary PAM modules can assume things about root credentials). It also has the job of monitoring everyone's X servers and kicking you back to the greeter if the X server crashes for any reason. One tiny thing here -- the article implies that the root X11 server launches GDM, but it's actually the other way. The DM is the one in charge of launching X11 servers, and it always has been. You can see evidence of this in the old XDMCP spec which was the standard for how remote display manager connections should work.