The .Xauthority files must not have extended ACLs.

.Xauthority files ensure the user is authorized to access the specific X Windows host. Extended ACLs may permit unauthorized modification of these files, which could lead to Denial of Service to authorized access or allow unauthorized access to be obtained.

If X Display Manager (XDM) is not used on the system, this is not applicable.

Determine if XDM is running.

Procedure: # ps -ef | grep xdm

Check the file permissions for the .Xauthority files. # ls -lL .Xauthority

If the permissions include a "+", the file has an extended ACL and this is a finding.

Remove the extended ACL from the file.

# chmod A- .Xauthority