Sync from SUSE:SLFO:Main gdm revision fded13fd6f804c1afd58e23835368fc1

.gitattributes

@@ -0,0 +1,23 @@
+## Default LFS
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.bsp filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.gem filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.jar filter=lfs diff=lfs merge=lfs -text
+*.lz filter=lfs diff=lfs merge=lfs -text
+*.lzma filter=lfs diff=lfs merge=lfs -text
+*.obscpio filter=lfs diff=lfs merge=lfs -text
+*.oxt filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.rpm filter=lfs diff=lfs merge=lfs -text
+*.tbz filter=lfs diff=lfs merge=lfs -text
+*.tbz2 filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.ttf filter=lfs diff=lfs merge=lfs -text
+*.txz filter=lfs diff=lfs merge=lfs -text
+*.whl filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text

X11-displaymanager-gdm

@@ -0,0 +1,22 @@
+gdm_vars() {
+    case "${DISPLAYMANAGER##*/}" in
+        gdm|GDM|Gnome|GNOME)
+            RELOADSIGNAL="-USR1"
+            DISPLAYMANAGER=/usr/sbin/gdm
+            PIDFILE=/run/gdm/gdm.pid
+
+            # let gdm run the Xserver as root if access to /dev/fb*
+            # is required (bsc#1075805)
+            # The GDM_DISABLE_USER_DISPLAY_SERVER variable is added by patch
+            # gdm-add-runtime-option-to-disable-starting-X-server-as-u.patch
+            if [ ! -c /dev/dri/card0 -a \
+                 ! -c /dev/nvidiactl ]; then
+                export GDM_DISABLE_USER_DISPLAY_SERVER=1
+            fi
+
+            return 0 ;;
+       *) return 1 ;;
+    esac
+
+    return 1
+}

gdm-add-runtime-option-to-disable-starting-X-server-as-u.patch

@@ -0,0 +1,145 @@
+From a19b51ad9e446948ba60c359641f6c4c14fec1da Mon Sep 17 00:00:00 2001
+From: Michal Srb <msrb@suse.com>
+Date: Fri, 26 Jan 2018 10:49:18 +0100
+Subject: [PATCH] Add runtime option to disable starting X server as user
+
+If the environmental variable GDM_DISABLE_USER_DISPLAY_SERVER is defined, the
+X server will be started under root. The same way as if gdm was built with
+--disable-user-display-server option.
+
+This allows system to run X server under root if and only-if necessary.
+--- a/daemon/gdm-local-display-factory.c
++++ b/daemon/gdm-local-display-factory.c
+@@ -384,6 +384,7 @@ gdm_local_display_factory_create_transie
+         preferred_display_server = get_preferred_display_server (factory);
+ 
+ #ifdef ENABLE_USER_DISPLAY_SERVER
++        if (getenv ("GDM_DISABLE_USER_DISPLAY_SERVER") == NULL ) {
+         if (g_strcmp0 (preferred_display_server, "wayland") == 0 ||
+             g_strcmp0 (preferred_display_server, "xorg") == 0) {
+                 g_auto(GStrv) session_types = NULL;
+@@ -405,8 +406,9 @@ gdm_local_display_factory_create_transie
+                               NULL);
+                 is_initial = TRUE;
+         }
++        }
+ #endif
+-        if (g_strcmp0 (preferred_display_server, "legacy-xorg") == 0) {
++	//if (g_strcmp0 (preferred_display_server, "legacy-xorg") == 0) {
+                 if (display == NULL) {
+                         guint32 num;
+ 
+@@ -414,7 +416,7 @@ gdm_local_display_factory_create_transie
+ 
+                         display = gdm_legacy_display_new (num);
+                 }
+-        }
++	//}
+ 
+         if (display == NULL) {
+                 g_set_error_literal (error,
+@@ -905,6 +907,7 @@ ensure_display_for_seat (GdmLocalDisplay
+         g_debug ("GdmLocalDisplayFactory: Adding display on seat %s", seat_id);
+ 
+ #ifdef ENABLE_USER_DISPLAY_SERVER
++        if (getenv ("GDM_DISABLE_USER_DISPLAY_SERVER") == NULL ) {
+         if (g_strcmp0 (preferred_display_server, "wayland") == 0 ||
+             g_strcmp0 (preferred_display_server, "xorg") == 0) {
+                 if (is_seat0) {
+@@ -915,6 +918,7 @@ ensure_display_for_seat (GdmLocalDisplay
+                                       NULL);
+                 }
+         }
++        }
+ #endif
+ 
+         if (display == NULL) {
+@@ -1211,6 +1215,10 @@ on_vt_changed (GIOChannel    *source,
+         g_debug ("GdmLocalDisplayFactory: VT changed from %u to %u",
+                  previous_vt, factory->active_vt);
+ 
++        if (getenv ("GDM_DISABLE_USER_DISPLAY_SERVER") != NULL) {
++                return G_SOURCE_CONTINUE;
++        }
++
+         store = gdm_display_factory_get_display_store (GDM_DISPLAY_FACTORY (factory));
+ 
+         /* if the old VT was running a wayland login screen kill it
+@@ -1352,6 +1360,7 @@ gdm_local_display_factory_start_monitor
+ #endif
+ 
+ #if defined(ENABLE_USER_DISPLAY_SERVER)
++        if (getenv ("GDM_DISABLE_USER_DISPLAY_SERVER") == NULL ) {
+         io_channel = g_io_channel_new_file ("/sys/class/tty/tty0/active", "r", NULL);
+ 
+         if (io_channel != NULL) {
+@@ -1362,6 +1371,7 @@ gdm_local_display_factory_start_monitor
+                                         on_vt_changed,
+                                         factory);
+         }
++        }
+ #endif
+ }
+ 
+--- a/daemon/gdm-manager.c
++++ b/daemon/gdm-manager.c
+@@ -1355,6 +1355,8 @@ set_up_automatic_login_session (GdmManag
+                       "supported-session-types", supported_session_types,
+                       NULL);
+ 
++        if (getenv ("GDM_DISABLE_USER_DISPLAY_SERVER") != NULL)
++                manager->priv->did_automatic_login = TRUE;
+         g_debug ("GdmManager: Starting automatic login conversation");
+         gdm_session_start_conversation (session, "gdm-autologin");
+ }
+--- a/daemon/gdm-server.c
++++ b/daemon/gdm-server.c
+@@ -238,9 +238,9 @@ gdm_server_init_command (GdmServer *serv
+         /* For systemd, we don't have a log file but instead log to stdout,
+            so set it to the xserver's built-in default verbosity */
+         if (debug)
+-            verbosity = "7 -logfile /dev/null";
++            verbosity = "7";
+         else
+-            verbosity = "3 -logfile /dev/null";
++            verbosity = "3";
+ #endif
+ 
+         if (g_access (SYSTEMD_X_SERVER, X_OK) < 0) {
+@@ -755,7 +755,7 @@ gdm_server_start (GdmServer *server)
+         g_return_val_if_fail (GDM_IS_SERVER (server), FALSE);
+ 
+         /* Hardcode the VT for the initial X server, but nothing else */
+-        if (server->is_initial) {
++        if (server->is_initial && g_strcmp0 (server->display_name, ":0") == 0) {
+                 vtarg = "vt" G_STRINGIFY (GDM_INITIAL_VT);
+         }
+ 
+--- a/daemon/gdm-session.c
++++ b/daemon/gdm-session.c
+@@ -3371,6 +3371,7 @@ gdm_session_get_display_mode (GdmSession
+         }
+ 
+ #ifdef ENABLE_USER_DISPLAY_SERVER
++        if (getenv ("GDM_DISABLE_USER_DISPLAY_SERVER") == NULL ) {
+         /* All other cases (wayland login screen, X login screen,
+          * wayland user session, X user session) use the NEW_VT
+          * display mode.  That display mode means that GDM allocates
+@@ -3393,7 +3394,8 @@ gdm_session_get_display_mode (GdmSession
+          *   are paused when handed out.
+          */
+         return GDM_SESSION_DISPLAY_MODE_NEW_VT;
+-#else
++//#else
++        } else {
+ 
+ #ifdef ENABLE_WAYLAND_SUPPORT
+         /* Wayland sessions are for now assumed to run in a
+@@ -3404,6 +3406,7 @@ gdm_session_get_display_mode (GdmSession
+         }
+ #endif
+         return GDM_SESSION_DISPLAY_MODE_REUSE_VT;
++        }
+ #endif
+ }
+ 

gdm-autologin-sle.pamd

@@ -0,0 +1,11 @@
+#%PAM-1.0
+# GDM PAM configuration for autologin
+auth     requisite      pam_nologin.so
+auth     required       pam_permit.so
+auth     optional       pam_gdm.so
+auth     optional       pam_gnome_keyring.so
+account  include        common-account
+password include        common-password
+session  required       pam_loginuid.so
+session  optional       pam_keyinit.so force revoke
+session  include        common-session

gdm-autologin.pamd

@@ -0,0 +1,14 @@
+#%PAM-1.0
+# GDM PAM configuration for autologin
+auth     requisite      pam_nologin.so
+auth     required       pam_permit.so
+auth     optional       pam_gdm.so
+auth     optional       pam_gnome_keyring.so
+account  substack       common-account
+account  include        postlogin-account
+password substack       common-password
+password include        postlogin-password
+session  required       pam_loginuid.so
+session  optional       pam_keyinit.so force revoke
+session  substack       common-session
+session  include        postlogin-session

gdm-default-wm.patch

@@ -0,0 +1,26 @@
+--- a/daemon/gdm-session.c
++++ b/daemon/gdm-session.c
+@@ -43,6 +43,8 @@
+ #include <glib-object.h>
+ #include <gio/gio.h>
+ 
++#include "gdm-sysconfig.h"
++
+ #include "gdm-session.h"
+ #include "gdm-session-glue.h"
+ #include "gdm-dbus-util.h"
+@@ -589,6 +591,14 @@ get_fallback_session_name (GdmSession *s
+                 }
+         }
+ 
++        name = gdm_sysconfig_load_value ("/etc/sysconfig/windowmanager", "DEFAULT_WM");
++        if (name && get_session_command_for_name (self, name, NULL, NULL)) {
++                g_free (self->fallback_session_name);
++                self->fallback_session_name = name;
++                goto out;
++        }
++        g_free (name);
++
+         name = g_strdup ("gnome");
+         if (get_session_command_for_name (self, name, NULL, NULL)) {
+                 g_free (self->fallback_session_name);

gdm-disable-gnome-initial-setup.patch

@@ -0,0 +1,29 @@
+--- a/daemon/gdm-display.c
++++ b/daemon/gdm-display.c
+@@ -1653,6 +1653,9 @@ wants_initial_setup (GdmDisplay *self)
+         gboolean enabled = FALSE;
+         gboolean forced = FALSE;
+ 
++        g_autofree gchar *release_name = NULL;
++        release_name = g_get_os_info (G_OS_INFO_KEY_NAME);
++
+         priv = gdm_display_get_instance_private (self);
+ 
+         if (already_done_initial_setup_on_this_boot ()) {
+@@ -1689,6 +1692,16 @@ wants_initial_setup (GdmDisplay *self)
+                 return FALSE;
+         }
+ 
++	if (release_name == NULL) {
++		g_error ("GdmDisplay: Failed to parse os-release");
++                return enabled;
++        }
++
++        if (g_str_has_prefix (release_name, "SLE")) {
++                g_debug ("GdmDisplay: Disable gnome-initial-setup on SLE");
++		return FALSE;
++        }
++
+         return enabled;
+ }
+ 

gdm-disable-wayland-on-mgag200-chipsets.patch

@@ -0,0 +1,19 @@
+--- a/data/61-gdm.rules.in
++++ b/data/61-gdm.rules.in
+@@ -29,6 +29,16 @@ ATTR{vendor}=="0x1a03", ATTR{device}=="0
+ 
+ LABEL="gdm_pci_device_end"
+ 
++# disable Wayland on Matrox Electronics Systems Ltd. MGA G200 server engines
++ATTR{vendor}=="0x102b", ATTR{device}=="0x0522", GOTO="gdm_disable_wayland"
++ATTR{vendor}=="0x102b", ATTR{device}=="0x0524", GOTO="gdm_disable_wayland"
++ATTR{vendor}=="0x102b", ATTR{device}=="0x0530", GOTO="gdm_disable_wayland"
++ATTR{vendor}=="0x102b", ATTR{device}=="0x0532", GOTO="gdm_disable_wayland"
++ATTR{vendor}=="0x102b", ATTR{device}=="0x0533", GOTO="gdm_disable_wayland"
++ATTR{vendor}=="0x102b", ATTR{device}=="0x0534", GOTO="gdm_disable_wayland"
++ATTR{vendor}=="0x102b", ATTR{device}=="0x0536", GOTO="gdm_disable_wayland"
++ATTR{vendor}=="0x102b", ATTR{device}=="0x0538", GOTO="gdm_disable_wayland"
++
+ # disable Wayland if modesetting is disabled
+ KERNEL!="card[0-9]*", GOTO="gdm_nomodeset_end"
+ KERNEL=="card[0-9]-*", GOTO="gdm_nomodeset_end"

gdm-fingerprint-sle.pamd

@@ -0,0 +1,17 @@
+#%PAM-1.0
+
+auth       required                    pam_shells.so
+auth       requisite                   pam_nologin.so
+auth       requisite                   pam_faillock.so      preauth
+auth       required                    pam_fprintd.so
+auth       optional                    pam_permit.so
+auth       required                    pam_env.so
+auth       [success=ok default=1]      pam_gdm.so
+auth       optional                    pam_gnome_keyring.so
+
+account    include                     common-account
+
+password   required                    pam_deny.so
+
+session    include                     common-session
+session    optional                    pam_gnome_keyring.so auto_start

gdm-fingerprint.pamd

@@ -0,0 +1,19 @@
+#%PAM-1.0
+
+auth       required                    pam_shells.so
+auth       requisite                   pam_nologin.so
+auth       requisite                   pam_faillock.so      preauth
+auth       required                    pam_fprintd.so
+auth       optional                    pam_permit.so
+auth       required                    pam_env.so
+auth       [success=ok default=1]      pam_gdm.so
+auth       optional                    pam_gnome_keyring.so
+
+account    substack                    common-account
+account    include                     common-account
+
+password   required                    pam_deny.so
+
+session    substack                    common-session
+session    include                     postlogin-session
+session    optional                    pam_gnome_keyring.so auto_start

gdm-initial-setup-hardening.patch

@@ -0,0 +1,93 @@
+--- a/daemon/gdm-display.c
++++ b/daemon/gdm-display.c
+@@ -1554,12 +1554,12 @@ can_create_environment (const char *sess
+         return session_exists;
+ }
+ 
+-#define ALREADY_RAN_INITIAL_SETUP_ON_THIS_BOOT GDM_RUN_DIR "/gdm.ran-initial-setup"
++#define BLOCK_INITIAL_SETUP LOCALSTATEDIR "/lib/gdm/block-initial-setup"
+ 
+ static gboolean
+-already_done_initial_setup_on_this_boot (void)
++already_done_initial_setup (void)
+ {
+-        if (g_file_test (ALREADY_RAN_INITIAL_SETUP_ON_THIS_BOOT, G_FILE_TEST_EXISTS))
++        if (g_file_test (BLOCK_INITIAL_SETUP, G_FILE_TEST_EXISTS))
+                 return TRUE;
+ 
+         return FALSE;
+@@ -1658,7 +1658,7 @@ wants_initial_setup (GdmDisplay *self)
+ 
+         priv = gdm_display_get_instance_private (self);
+ 
+-        if (already_done_initial_setup_on_this_boot ()) {
++        if (already_done_initial_setup ()) {
+                 return FALSE;
+         }
+ 
+--- a/daemon/gdm-manager.c
++++ b/daemon/gdm-manager.c
+@@ -60,7 +60,7 @@
+ #define GDM_MANAGER_DISPLAYS_PATH GDM_DBUS_PATH "/Displays"
+ 
+ #define INITIAL_SETUP_USERNAME "gnome-initial-setup"
+-#define ALREADY_RAN_INITIAL_SETUP_ON_THIS_BOOT GDM_RUN_DIR "/gdm.ran-initial-setup"
++#define BLOCK_INITIAL_SETUP LOCALSTATEDIR "/lib/gdm/block-initial-setup"
+ 
+ typedef struct
+ {
+@@ -1793,6 +1793,7 @@ on_start_user_session (StartUserSessionO
+         gboolean doing_initial_setup = FALSE;
+         GdmDisplay *display;
+         const char *session_id;
++        int fd = -1;
+ 
+         g_debug ("GdmManager: start or jump to session");
+ 
+@@ -1819,6 +1820,15 @@ on_start_user_session (StartUserSessionO
+                       "doing-initial-setup", &doing_initial_setup,
+                       NULL);
+ 
++        fd = open(BLOCK_INITIAL_SETUP, O_RDONLY|O_CREAT|O_EXCL|O_NOFOLLOW|O_CLOEXEC, 0644);
++        if (fd == -1 && errno != EEXIST) {
++                g_warning ("GdmDisplay: Could not write initial-setup-done marker to %s: %s",
++                           BLOCK_INITIAL_SETUP,
++                           strerror(errno));
++        }
++        else {
++                close(fd);
++        }
+         if (doing_initial_setup)
+                 chown_initial_setup_home_dir ();
+ 
+@@ -1839,20 +1849,9 @@ on_start_user_session (StartUserSessionO
+ 
+                 g_object_ref (display);
+                 if (doing_initial_setup) {
+-                        g_autoptr(GError) error = NULL;
+ 
+                         g_debug ("GdmManager: closing down initial setup display in background");
+                         g_object_set (G_OBJECT (display), "status", GDM_DISPLAY_WAITING_TO_FINISH, NULL);
+-
+-                        if (!g_file_set_contents (ALREADY_RAN_INITIAL_SETUP_ON_THIS_BOOT,
+-                                                  "1",
+-                                                  1,
+-                                                  &error)) {
+-                                g_warning ("GdmDisplay: Could not write initial-setup-done marker to %s: %s",
+-                                           ALREADY_RAN_INITIAL_SETUP_ON_THIS_BOOT,
+-                                           error->message);
+-                                g_clear_error (&error);
+-                        }
+                 } else {
+                         g_debug ("GdmManager: session has its display server, reusing our server for another login screen");
+                 }
+--- a/daemon/meson.build
++++ b/daemon/meson.build
+@@ -210,6 +210,7 @@ endif
+ 
+ gdm_daemon = executable('gdm',
+   [ gdm_daemon_sources, gdm_daemon_gen_sources ],
++  c_args: '-DLOCALSTATEDIR="'+get_option('localstatedir')+'"',
+   dependencies: gdm_daemon_deps,
+   include_directories: config_h_dir,
+   install: true,

gdm-launch-environment.pamd

@@ -0,0 +1,7 @@
+#%PAM-1.0
+# GDM PAM configuration used only for the greeter session
+auth     required       pam_permit.so
+account  required       pam_permit.so
+password include        common-password
+session  optional       pam_keyinit.so force revoke
+session  include        common-session

gdm-restart-session-when-X-server-restart.patch

@@ -0,0 +1,26 @@
+--- a/daemon/gdm-local-display-factory.c
++++ b/daemon/gdm-local-display-factory.c
+@@ -552,8 +552,10 @@ on_display_status_changed (GdmDisplay
+                  * ensures we get a new login screen when the user logs out,
+                  * if there isn't one.
+                  */
++                g_debug ("GdmLocalDisplayFactory: session_class = %s active_vt = %u", session_class, factory->active_vt);
+                 if (is_local &&
+-                    (g_strcmp0 (session_class, "greeter") != 0 || factory->active_vt == GDM_INITIAL_VT)) {
++                    (g_strcmp0 (session_class, "greeter") != 0 || factory->active_vt == GDM_INITIAL_VT
++                      || factory->active_vt == 0)) {
+                         /* reset num failures */
+                         factory->num_failures = 0;
+ 
+--- a/daemon/gdm-manager.c
++++ b/daemon/gdm-manager.c
+@@ -1553,7 +1553,8 @@ on_display_status_changed (GdmDisplay *d
+                         }
+ #endif
+ 
+-                        g_object_set_data (G_OBJECT (display), "gdm-user-session", NULL);
++                        if (getenv ("GDM_DISABLE_USER_DISPLAY_SERVER") == NULL )
++                                g_object_set_data (G_OBJECT (display), "gdm-user-session", NULL);
+ 
+                         if (display == manager->automatic_login_display) {
+                                 g_clear_weak_pointer (&manager->automatic_login_display);

gdm-s390-not-require-g-s-d_wacom.patch

@@ -0,0 +1,10 @@
+--- a/data/meson.build
++++ b/data/meson.build
+@@ -77,7 +77,6 @@ gdm_gnome_session_required_components =
+   'org.gnome.SettingsDaemon.Sharing',
+   'org.gnome.SettingsDaemon.Smartcard',
+   'org.gnome.SettingsDaemon.Sound',
+-  'org.gnome.SettingsDaemon.Wacom',
+ ]
+ 
+ gdm_gnome_user_session_wanted_components = gdm_gnome_session_required_components

gdm-sle.pamd

@@ -0,0 +1,9 @@
+#%PAM-1.0
+# GDM PAM standard configuration (with passwords)
+auth     requisite      pam_nologin.so
+auth     include        common-auth
+account  include        common-account
+password include        common-password
+session  required       pam_loginuid.so
+session  optional       pam_keyinit.so force revoke
+session  include        common-session

gdm-smartcard-sle.pamd

@@ -0,0 +1,17 @@
+#%PAM-1.0
+
+auth       requisite                   pam_faillock.so      preauth
+auth       required                    pam_pkcs11.so        wait_for_card card_only
+auth       required                    pam_shells.so
+auth       requisite                   pam_nologin.so
+auth       optional                    pam_permit.so
+auth       required                    pam_env.so
+auth       [success=ok default=1]      pam_gdm.so
+auth       optional                    pam_gnome_keyring.so
+
+account    include                     common-account
+
+password   required                    pam_deny.so
+
+session    include                     common-session
+session    optional                    pam_gnome_keyring.so auto_start

gdm-smartcard.pamd

@@ -0,0 +1,19 @@
+#%PAM-1.0
+
+auth       requisite                   pam_faillock.so      preauth
+auth       required                    pam_pkcs11.so        wait_for_card card_only
+auth       required                    pam_shells.so
+auth       requisite                   pam_nologin.so
+auth       optional                    pam_permit.so
+auth       required                    pam_env.so
+auth       [success=ok default=1]      pam_gdm.so
+auth       optional                    pam_gnome_keyring.so
+
+account    substack                    common-account
+account    include                     postlogin-account
+
+password   required                    pam_deny.so
+
+session    substack                    common-session
+session    include                     postlogin-session
+session    optional                    pam_gnome_keyring.so auto_start

gdm-suse-xsession.patch

@@ -0,0 +1,61 @@
+diff --git a/data/Init.in b/data/Init.in
+index ec6fd395..4b8ed8ce 100644
+--- a/data/Init.in
++++ b/data/Init.in
+@@ -1,4 +1,11 @@
+ #!/bin/sh
++
++if test -x /etc/X11/xdm/Xsetup; then
++	exec /etc/X11/xdm/Xsetup
++elif test -x /usr/etc/X11/xdm/Xsetup; then
++       exec /usr/etc/X11/xdm/Xsetup
++fi
++
+ # Stolen from the debian kdm setup, aren't I sneaky
+ # Plus a lot of fun stuff added
+ #  -George
+diff --git a/data/PostSession.in b/data/PostSession.in
+index c52d3c26..4d94b3e7 100755
+--- a/data/PostSession.in
++++ b/data/PostSession.in
+@@ -1,3 +1,9 @@
+ #!/bin/sh
+ 
++if test -x /etc/X11/xdm/Xreset; then
++       exec /etc/X11/xdm/Xreset
++elif test -x /usr/etc/X11/xdm/Xreset; then
++       exec /usr/etc/X11/xdm/Xreset
++fi
++
+ exit 0
+diff --git a/data/PreSession.in b/data/PreSession.in
+index cfabee75..306a905e 100755
+--- a/data/PreSession.in
++++ b/data/PreSession.in
+@@ -6,4 +6,10 @@
+ #
+ # Note that output goes into the .xsession-errors file for easy debugging
+ #
++if test -x /etc/X11/xdm/Xstartup; then
++       exec /etc/X11/xdm/Xstartup
++elif test -x /usr/etc/X11/xdm/Xstartup; then
++       exec /usr/etc/X11/xdm/Xstartup
++fi
++
+ PATH="@X_PATH@:$PATH"
+diff --git a/data/Xsession.in b/data/Xsession.in
+index 9d79558c..bcefdd73 100755
+--- a/data/Xsession.in
++++ b/data/Xsession.in
+@@ -1,4 +1,11 @@
+ #!@XSESSION_SHELL@
++
++if test -x /etc/X11/xdm/Xsession; then
++       exec /etc/X11/xdm/Xsession $1 $GDM_LANG
++elif test -x /usr/etc/X11/xdm/Xsession; then
++       exec /usr/etc/X11/xdm/Xsession $1 $GDM_LANG
++fi
++
+ #
+ # This is SORT OF LIKE an X session, but not quite.  You get a command as the
+ # first argument (it could be multiple words, so run it with "eval").  As a

gdm-switch-to-tty1.patch

@@ -0,0 +1,66 @@
+--- a/daemon/main.c
++++ b/daemon/main.c
+@@ -61,6 +61,31 @@ static GdmSettings     *settings      =
+ static uid_t            gdm_uid       = -1;
+ static gid_t            gdm_gid       = -1;
+ 
++#define SHELLSCRIPT "\
++/bin/bash -c \
++\'PROCESS=\"X Xwayland plymouth\"\;\
++R=$(pidof $PROCESS)\;\
++while [ $? == 0 ]\;\
++do sleep 1\;\
++  R=$(pidof $PROCESS)\;\
++done\;\
++systemd-cat echo Switch to tty1 Successfully\;\
++/usr/bin/chvt 1\'\
++"
++
++static void
++jump_to_tty1 ()
++{
++        g_autoptr(GError) error = NULL;
++
++        g_debug ("Spawn jump to tty1 process");
++        g_spawn_command_line_async (SHELLSCRIPT,
++                                    &error);
++
++        if (error != NULL)
++                g_warning ("Error chvt to tty1: %s", error->message);
++}
++
+ static gboolean
+ timed_exit_cb (GMainLoop *loop)
+ {
+@@ -263,6 +288,12 @@ on_shutdown_signal_cb (gpointer user_dat
+         return FALSE;
+ }
+ 
++static void
++on_signal_term_cb ()
++{
++        g_debug ("Received SIGTERM again");
++}
++
+ static gboolean
+ on_sighup_cb (gpointer user_data)
+ {
+@@ -387,6 +418,7 @@ main (int    argc,
+         g_main_loop_run (main_loop);
+ 
+         g_debug ("GDM finished, cleaning up...");
++        signal (SIGTERM, on_signal_term_cb);
+ 
+         g_clear_object (&manager);
+         g_clear_object (&settings);
+@@ -394,6 +426,10 @@ main (int    argc,
+         gdm_settings_direct_shutdown ();
+         gdm_log_shutdown ();
+ 
++        jump_to_tty1 ();
++
++        g_debug ("GDM finished");
++
+         g_main_loop_unref (main_loop);
+ 
+         return EXIT_SUCCESS;

gdm-xauthlocalhostname.patch

@@ -0,0 +1,86 @@
+--- a/common/gdm-common.c
++++ b/common/gdm-common.c
+@@ -619,6 +619,8 @@ gdm_get_script_environment (const char *
+ 
+         if (display_hostname) {
+                 g_hash_table_insert (hash, g_strdup ("REMOTE_HOST"), g_strdup (display_hostname));
++        } else {
++                g_hash_table_insert (hash, g_strdup ("XAUTHLOCALHOSTNAME"), gdm_gethostname ());
+         }
+ 
+         /* Runs as root */
+@@ -1085,3 +1087,14 @@ gdm_load_env_d (GdmLoadEnvVarFunc load_e
+         gdm_load_env_dir (dir, load_env_func, expand_func, user_data);
+         g_object_unref (dir);
+ }
++
++char *
++gdm_gethostname (void)
++{
++        char localhost[HOST_NAME_MAX + 1] = "";
++        if (gethostname (localhost, HOST_NAME_MAX) == 0) {
++                return g_strdup (localhost);
++        } else {
++                return g_strdup ("localhost");
++        }
++}
+--- a/common/gdm-common.h
++++ b/common/gdm-common.h
+@@ -70,6 +70,7 @@ char          *gdm_generate_random_bytes
+ gboolean       gdm_get_login_window_session_id (const char  *seat_id,
+                                                 char       **session_id);
+ gboolean       gdm_goto_login_session    (GError **error);
++char          *gdm_gethostname           (void);
+ 
+ GPtrArray     *gdm_get_script_environment (const char *username,
+                                            const char *display_name,
+--- a/daemon/gdm-display-access-file.c
++++ b/daemon/gdm-display-access-file.c
+@@ -449,13 +449,10 @@ _get_auth_info_for_display (GdmDisplayAc
+                  *
+                  * https://bugs.freedesktop.org/show_bug.cgi?id=43425
+                  */
+-                char localhost[HOST_NAME_MAX + 1] = "";
+                 *family = FamilyLocal;
+-                if (gethostname (localhost, HOST_NAME_MAX) == 0) {
+-                        *address = g_strdup (localhost);
+-                } else {
+-                        *address = g_strdup ("localhost");
+-                }
++               /* using the new function we create in the patch, to detect
++		* changes here, in the original code */
++		*address = gdm_gethostname ();
+         } else {
+                 *family = FamilyWild;
+                 gdm_display_get_remote_hostname (display, address, NULL);
+--- a/daemon/gdm-launch-environment.c
++++ b/daemon/gdm-launch-environment.c
+@@ -225,6 +225,11 @@ build_launch_environment (GdmLaunchEnvir
+                 g_hash_table_insert (hash, g_strdup ("GDM_SEAT_ID"), g_strdup (seat_id));
+         }
+ 
++        if (launch_environment->x11_display_is_local) {
++                g_hash_table_remove (hash, "XAUTHLOCALHOSTNAME");
++                g_hash_table_insert (hash, g_strdup ("XAUTHLOCALHOSTNAME"), gdm_gethostname ());
++        }
++
+         g_hash_table_insert (hash, g_strdup ("RUNNING_UNDER_GDM"), g_strdup ("true"));
+ 
+         /* Now populate XDG_DATA_DIRS from env.d if we're running initial setup; this allows
+--- a/daemon/gdm-session.c
++++ b/daemon/gdm-session.c
+@@ -2751,6 +2751,14 @@ set_up_session_environment (GdmSession *
+                 }
+         }
+ 
++        if (self->display_is_local) {
++                char *hostname = gdm_gethostname ();
++                gdm_session_set_environment_variable (self,
++                                                      "XAUTHLOCALHOSTNAME",
++                                                      hostname);
++                g_free (hostname);
++        }
++
+         if (g_getenv ("WINDOWPATH") != NULL) {
+                 gdm_session_set_environment_variable (self,
+                                                       "WINDOWPATH",

gdm.pamd

@@ -0,0 +1,13 @@
+#%PAM-1.0
+# GDM PAM standard configuration (with passwords)
+auth     requisite      pam_nologin.so
+auth     substack       common-auth
+auth     include        postlogin-auth
+account  substack       common-account
+account  include        postlogin-account
+password substack       common-password
+password include        postlogin-password
+session  required       pam_loginuid.so
+session  optional       pam_keyinit.so force revoke
+session  substack       common-session
+session  include        postlogin-session

gdm.spec

@@ -0,0 +1,431 @@
+#
+# spec file for package gdm
+#
+# Copyright (c) 2023 SUSE LLC
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+
+%define enable_split_authentication 1
+
+# special hack for SLE15/Leap 15: it does not yet know /usr/etc, and files in /etc should be %%config
+%if 0%{?suse_version} >= 1550
+  %define _config_norepl %nil
+%else
+  %define _pam_vendordir %{_sysconfdir}/pam.d
+  %define _config_norepl %config(noreplace)
+%endif
+
+Name:           gdm
+Version:        44.1
+Release:        0
+Summary:        The GNOME Display Manager
+License:        GPL-2.0-or-later
+Group:          System/GUI/GNOME
+URL:            https://wiki.gnome.org/Projects/GDM
+
+Source0:        https://download.gnome.org/sources/gdm/44/%{name}-%{version}.tar.xz
+Source1:        gdm.pamd
+Source2:        gdm-autologin.pamd
+Source3:        gdm-launch-environment.pamd
+Source4:        gdm-fingerprint.pamd
+Source5:        gdm-smartcard.pamd
+# gdmflexiserver wrapper, to enable other display managers to abuse the gdmflexiserver namespace (like lightdm)
+Source6:        gdmflexiserver-wrapper
+# /etc/xinit.d/xdm integration script
+Source7:        X11-displaymanager-gdm
+# Use tmpfiles to create directories under /var to support transactional updates
+Source9:        gdm.tmpfiles
+# Use reserveVT.conf to make autologin user session not to select tty1
+Source10:       reserveVT.conf
+# Use sysusers to create gdm system user
+Source11:       gdm.sysusers
+# PAM configuration files for SLE15 and older
+Source12:       gdm-sle.pamd
+Source13:       gdm-autologin-sle.pamd
+Source14:       gdm-fingerprint-sle.pamd
+Source15:       gdm-smartcard-sle.pamd
+# WARNING: do not remove/significantly change patch0 without updating the relevant patch in accountsservice too
+# PATCH-FIX-OPENSUSE gdm-s390-not-require-g-s-d_wacom.patch bsc#1129412 yfjiang@suse.com -- Remove the runtime requirement of g-s-d Wacom plugin
+Patch0:         gdm-s390-not-require-g-s-d_wacom.patch
+# PATCH-FIX-OPENSUSE  gdm-sysconfig-settings.patch bnc432360 bsc#919723 hpj@novell.com -- Read autologin options from /etc/sysconfig/displaymanager; note that accountsservice has a similar patch (accountsservice-sysconfig.patch)
+Patch1:         gdm-sysconfig-settings.patch
+# PATCH-FIX-OPENSUSE gdm-suse-xsession.patch vuntz@novell.com -- Use the /etc/X11/xdm/* scripts
+Patch2:         gdm-suse-xsession.patch
+# PATCH-FIX-OPENSUSE gdm-default-wm.patch vuntz@novell.com -- Use sysconfig to know to which desktop to use by default
+Patch3:         gdm-default-wm.patch
+# PATCH-FIX-OPENSUSE gdm-xauthlocalhostname.patch bnc#538064 vuntz@novell.com -- Set XAUTHLOCALHOSTNAME to current hostname when we authenticate, for local logins, to avoid issues in the session in case the hostname changes later one. See comment 24 in the bug.
+Patch4:         gdm-xauthlocalhostname.patch
+# PATCH-FIX-OPENSUSE gdm-switch-to-tty1.patch bsc#1113700 xwang@suse.com -- switch to tty1 when stopping gdm service
+Patch5:         gdm-switch-to-tty1.patch
+# PATCH-FIX-OPENSUSE gdm-initial-setup-hardening.patch boo#1140851, glgo#GNOME/gnome-initial-setup#76 fezhang@suse.com -- Prevent gnome-initial-setup running if any regular user has perviously logged into the system
+Patch6:         gdm-initial-setup-hardening.patch
+# PATCH-FIX-UPSTREAM gdm-disable-wayland-on-mgag200-chipsets.patch bsc#1162888 glgo#GNOME/mutter#57 qkzhu@suse.com -- Disable Wayland on mgag200 chipsets
+Patch7:         gdm-disable-wayland-on-mgag200-chipsets.patch
+
+### NOTE: Keep please SLE-only patches at bottom (starting on 1000).
+# PATCH-FIX-SLE gdm-disable-gnome-initial-setup.patch bnc#1067976 qzhao@suse.com -- Disable gnome-initial-setup runs before gdm, g-i-s will only serve for CJK people to choose the input-method after login.
+Patch1000:      gdm-disable-gnome-initial-setup.patch
+## TODO: This patch might need to be rebased/changed after the changes from the 44rc release.
+# PATCH-FIX-SLE gdm-add-runtime-option-to-disable-starting-X-server-as-u.patch bnc#1188912 jsc#SLE-17880 xwang@suse.com -- Add runtime option to start X under root instead of regular user.
+Patch1001:      gdm-add-runtime-option-to-disable-starting-X-server-as-u.patch
+# PATCH-FIX-SLE gdm-restart-session-when-X-server-restart.patch bsc#1196974 xwang@suse.com -- Fix blank screen when X restarts with GDM_DISABLE_USER_DISPLAY_SERVER=1.
+Patch1002:      gdm-restart-session-when-X-server-restart.patch
+
+BuildRequires:  check-devel
+# dconf and gnome-session-core are needed for directory ownership
+BuildRequires:  dconf
+BuildRequires:  fdupes
+BuildRequires:  gnome-common
+BuildRequires:  gnome-session-core
+BuildRequires:  meson >= 0.57
+BuildRequires:  pam-devel
+BuildRequires:  pkgconfig
+BuildRequires:  sysuser-shadow
+BuildRequires:  sysuser-tools
+BuildRequires:  tcpd-devel
+BuildRequires:  update-desktop-files
+BuildRequires:  xorg-x11-server
+BuildRequires:  xorg-x11-server-extra
+BuildRequires:  pkgconfig(accountsservice) >= 0.6.35
+BuildRequires:  pkgconfig(audit)
+BuildRequires:  pkgconfig(check)
+BuildRequires:  pkgconfig(gio-2.0) >= 2.56.0
+BuildRequires:  pkgconfig(gio-unix-2.0) >= 2.56.0
+BuildRequires:  pkgconfig(glib-2.0) >= 2.56.0
+BuildRequires:  pkgconfig(gobject-2.0) >= 2.56.0
+BuildRequires:  pkgconfig(gobject-introspection-1.0) >= 0.9.12
+BuildRequires:  pkgconfig(gthread-2.0)
+BuildRequires:  pkgconfig(gtk+-3.0) >= 2.91.1
+BuildRequires:  pkgconfig(gudev-1.0) >= 232
+BuildRequires:  pkgconfig(iso-codes)
+BuildRequires:  pkgconfig(libcanberra-gtk3) >= 0.4
+BuildRequires:  pkgconfig(libkeyutils)
+BuildRequires:  pkgconfig(libsystemd)
+BuildRequires:  pkgconfig(ply-boot-client)
+BuildRequires:  pkgconfig(x11)
+BuildRequires:  pkgconfig(xau)
+BuildRequires:  pkgconfig(xcb)
+BuildRequires:  pkgconfig(xdmcp)
+BuildRequires:  pkgconfig(xi)
+BuildRequires:  pkgconfig(xinerama)
+BuildRequires:  pkgconfig(xrandr)
+Requires:       %{_bindir}/dbus-run-session
+Requires:       %{name}-branding = %{version}
+Requires:       gdmflexiserver
+Requires:       gnome-session-core
+Requires:       gnome-settings-daemon
+Requires:       gnome-shell
+# xdm package ships systemd display-manager service and other common scripts
+# between display managers (bsc#1084655)
+Requires:       xdm
+Requires(post): dconf
+Requires(pre):  group(video)
+Requires(post): update-alternatives
+Requires(postun):update-alternatives
+Recommends:     iso-codes
+# accessibility
+Recommends:     orca
+Provides:       gdm2 = %{version}
+Obsoletes:      gdm2 < %{version}
+Provides:       gnome-applets-gdm = %{version}
+Obsoletes:      gnome-applets-gdm < %{version}
+DocDir:         %{_defaultdocdir}
+%ifnarch s390 s390x
+BuildRequires:  pkgconfig(xorg-server)
+%endif
+%sysusers_requires
+
+%description
+The GNOME Display Manager is a system service that is responsible for
+providing graphical log-ins and managing local and remote displays.
+
+%package -n libgdm1
+Summary:        Client Library for Communicating with GDM Greeter Server
+Group:          System/Libraries
+Requires:       %{name}-schema
+Recommends:     gdm
+
+%description -n libgdm1
+The GNOME Display Manager is a system service that is responsible for
+providing graphical log-ins and managing local and remote displays.
+
+%package -n typelib-1_0-Gdm-1_0
+Summary:        Introspection bindings for gdm
+Group:          System/Libraries
+
+%description -n typelib-1_0-Gdm-1_0
+The GNOME Display Manager is a system service that is responsible for
+providing graphical log-ins and managing local and remote displays.
+
+This package provides the GObject Introspection bindings for
+communicating with the GDM greeter server.
+
+%package schema
+Summary:        Config schema for GDM
+Group:          System/Libraries
+BuildArch:      noarch
+
+%description schema
+The GNOME Display Manager is a system service that is responsible for
+providing graphical log-ins and managing local and remote displays.
+
+%package devel
+Summary:        Libraries for GDM -- Development Files
+Group:          Development/Libraries/GNOME
+Requires:       libgdm1 = %{version}
+Requires:       typelib-1_0-Gdm-1_0 = %{version}
+
+%description devel
+The GNOME Display Manager is a system service that is responsible for
+providing graphical log-ins and managing local and remote displays.
+
+%package branding-upstream
+Summary:        The GNOME Display Manager -- Upstream default configuration
+Group:          System/GUI/GNOME
+Requires:       %{name} = %{version}
+Supplements:    (%{name} and branding-upstream)
+Conflicts:      %{name}-branding
+Provides:       %{name}-branding = %{version}
+BuildArch:      noarch
+#BRAND: Provide one file:
+#BRAND: /etc/gdm/custom.conf
+#BRAND:   Default configuration of gdm
+
+%description branding-upstream
+The GNOME Display Manager is a system service that is responsible for
+providing graphical log-ins and managing local and remote displays.
+
+This package provides the upstream default configuration for gdm.
+
+%package systemd
+Summary:        Systemd gdm.service file
+Group:          System/GUI/GNOME
+Requires:       gdm
+BuildArch:      noarch
+
+%description systemd
+GDM's systemd service file.
+By default openSUSE uses xdm which enables the DM based on sysconfig.
+This package is only needed if the system administrator wishes to use
+'systemctl' instead of openSUSE's default 'update-alternatives' method.
+
+%package -n gdmflexiserver
+Summary:        Compatibility Wrapper for Display Managers
+Group:          System/GUI/GNOME
+Suggests:       gdm
+BuildArch:      noarch
+
+%description -n gdmflexiserver
+The GDMFlexiServer tool interacts with the display manager to
+enable fast user switching. This package contains a wrapper that
+selects the correct Gdmflexiserver implementation, based on the
+running display manager.
+
+%lang_package
+
+%prep
+# -N disables automatic patch application.
+%autosetup -N
+### NON-SLE patches start from 0 to 999
+## Use "autopatch -m 0 -M 999" when there's no need to skip patches.
+%autopatch -p1 -m 1 -M 999
+
+%ifarch s390 s390x
+%patch0 -p1
+%endif
+
+### SLE and Leap only patches start at 1000
+%if 0%{?sle_version}
+## Use this when there's no need to skip patches.
+%autopatch -p1 -m 1000
+%endif
+
+%build
+%meson \
+        --libexecdir=%{_libexecdir}/gdm \
+        -Dat-spi-registryd-dir=%{_libexecdir}/at-spi \
+        -Dgdm-xsession=true \
+        -Dgnome-settings-daemon-dir=%{_libexecdir}/gnome-settings-daemon-3.0 \
+        -Dinitial-vt=7 \
+        -Dipv6=true \
+        -Dpam-mod-dir=%{_pam_moduledir} \
+        -Ddbus-sys=%{_datadir}/dbus-1/system.d \
+        -Dplymouth=enabled \
+        -Drun-dir=/run/gdm \
+%if %{enable_split_authentication}
+        -Dsplit-authentication=true \
+%else
+        -Dsplit-authentication=false \
+%endif
+        -Dudev-dir=%{_udevrulesdir} \
+        -Dwayland-support=true \
+        %nil
+%meson_build
+%sysusers_generate_pre %{SOURCE11} gdm gdm.conf
+
+%install
+%meson_install
+## Install PAM files.
+mkdir -p %{buildroot}%{_pam_vendordir}
+# Pam config for the greeter session
+cp %{SOURCE3} %{buildroot}%{_pam_vendordir}/gdm-launch-environment
+%if 0%{?suse_version} >= 1550
+# Generic pam config
+cp %{SOURCE1} %{buildroot}%{_pam_vendordir}/gdm
+# Pam config for autologin
+cp %{SOURCE2} %{buildroot}%{_pam_vendordir}/gdm-autologin
+%if %{enable_split_authentication}
+# Pam config for fingerprint authentication
+cp %{SOURCE4} %{buildroot}%{_pam_vendordir}/gdm-fingerprint
+# Pam config for smartcard authentication
+cp %{SOURCE5} %{buildroot}%{_pam_vendordir}/gdm-smartcard
+%endif
+%else
+# Generic pam config
+cp %{SOURCE12} %{buildroot}%{_pam_vendordir}/gdm
+# Pam config for autologin
+cp %{SOURCE13} %{buildroot}%{_pam_vendordir}/gdm-autologin
+%if %{enable_split_authentication}
+# Pam config for fingerprint authentication
+cp %{SOURCE14} %{buildroot}%{_pam_vendordir}/gdm-fingerprint
+# Pam config for smartcard authentication
+cp %{SOURCE15} %{buildroot}%{_pam_vendordir}/gdm-smartcard
+%endif
+%endif
+# The default gdm pam configuration is the one to be used as pam-password too
+ln -s gdm %{buildroot}%{_pam_vendordir}/gdm-password
+## Install other files
+# Install PostLogin script.
+mv %{buildroot}%{_sysconfdir}/gdm/PostLogin/Default.sample %{buildroot}%{_sysconfdir}/gdm/PostLogin/Default
+# Move gdmflexiserver to libexecdir and replace it with the compatibility wrapper
+mv %{buildroot}%{_bindir}/gdmflexiserver %{buildroot}%{_libexecdir}/gdm/gdmflexiserver
+install -m 755 %{SOURCE6} %{buildroot}%{_bindir}/gdmflexiserver
+sed -e 's-@LIBEXECDIR@-%{_libexecdir}-g' -i %{buildroot}%{_bindir}/gdmflexiserver
+#Install /etc/xinit.d/xdm integration script
+install -D -m 644 %{SOURCE7} %{buildroot}%{_prefix}/lib/X11/displaymanagers/gdm
+mkdir -p %{buildroot}%{_sysconfdir}/alternatives
+touch %{buildroot}%{_sysconfdir}/alternatives/default-displaymanager
+ln -s %{_sysconfdir}/alternatives/default-displaymanager %{buildroot}%{_prefix}/lib/X11/displaymanagers/default-displaymanager
+# Install other files
+mkdir -p %{buildroot}/run/gdm
+mkdir -p %{buildroot}%{_bindir}
+ln -s ../sbin/gdm %{buildroot}%{_bindir}/gdm
+
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 644 %{SOURCE9} %{buildroot}%{_tmpfilesdir}/gdm.conf
+
+mkdir -p %{buildroot}%{_prefix}/lib/systemd/logind.conf.d
+install -m 644 %{SOURCE10} %{buildroot}%{_prefix}/lib/systemd/logind.conf.d/reserveVT.conf
+
+mkdir -p %{buildroot}%{_sysusersdir}
+install -m 644 %{SOURCE11} %{buildroot}%{_sysusersdir}/gdm.conf
+
+%find_lang %{name} %{?no_lang_C}
+%fdupes -s %{buildroot}%{_datadir}/help
+
+%check
+%meson_test
+
+# FIXME -- Document why we don't use %%service_add_*/%%service_del_* macros.
+
+%pre -f gdm.pre
+
+%post
+%tmpfiles_create gdm.conf
+%{_sbindir}/update-alternatives --install %{_prefix}/lib/X11/displaymanagers/default-displaymanager \
+  default-displaymanager %{_prefix}/lib/X11/displaymanagers/gdm 25
+
+%posttrans
+# Create dconf database for gdm, to lockdown the gdm session
+dconf update
+
+%postun
+[ -f %{_prefix}/lib/X11/displaymanagers/gdm ] || %{_sbindir}/update-alternatives \
+  --remove default-displaymanager %{_prefix}/lib/X11/displaymanagers/gdm
+
+%post -n libgdm1 -p /sbin/ldconfig
+%postun -n libgdm1 -p /sbin/ldconfig
+
+%files
+%license COPYING
+%doc AUTHORS NEWS README.md
+%doc %{_datadir}/help/C/%{name}/
+%dir %config %{_sysconfdir}/gdm
+%config %{_sysconfdir}/gdm/[IPXl]*
+%{_sbindir}/gdm
+%{_bindir}/gdm
+%{_bindir}/gdm-screenshot
+%dir %{_datadir}/dconf
+%dir %{_datadir}/dconf/profile
+%{_datadir}/dconf/profile/gdm
+%{_datadir}/gdm/
+%{_datadir}/gnome-session/sessions/gnome-login.session
+%{_pam_moduledir}/pam_gdm.so
+%dir %{_libexecdir}/gdm
+%{_libexecdir}/gdm/gdm-*
+%{_libexecdir}/gdm/gdmflexiserver
+%ghost %attr(750,gdm,gdm) %dir %{_localstatedir}/lib/gdm
+%ghost %attr(711,root,gdm) %dir %{_localstatedir}/log/gdm
+%ghost %dir %{_localstatedir}/cache/gdm
+%ghost %attr(711,root,gdm) %dir /run/gdm
+%_config_norepl %{_pam_vendordir}/gdm
+%_config_norepl %{_pam_vendordir}/gdm-autologin
+%if %{enable_split_authentication}
+%_config_norepl %{_pam_vendordir}/gdm-fingerprint
+%_config_norepl %{_pam_vendordir}/gdm-smartcard
+%endif
+%_config_norepl %{_pam_vendordir}/gdm-password
+%_config_norepl %{_pam_vendordir}/gdm-launch-environment
+%{_datadir}/dbus-1/system.d/gdm.conf
+# /etc/xinit.d/xdm integration
+%dir %{_prefix}/lib/X11/displaymanagers
+%{_prefix}/lib/X11/displaymanagers/default-displaymanager
+%{_prefix}/lib/X11/displaymanagers/gdm
+%ghost %{_sysconfdir}/alternatives/default-displaymanager
+%{_udevrulesdir}/61-gdm.rules
+%{_tmpfilesdir}/gdm.conf
+%{_sysusersdir}/gdm.conf
+%dir %{_prefix}/lib/systemd/logind.conf.d
+%{_prefix}/lib/systemd/logind.conf.d/reserveVT.conf
+%dir %{_userunitdir}/gnome-session@gnome-login.target.d
+%{_userunitdir}/gnome-session@gnome-login.target.d/session.conf
+
+%files -n libgdm1
+%{_libdir}/libgdm.so.*
+
+%files -n typelib-1_0-Gdm-1_0
+%{_libdir}/girepository-1.0/Gdm-1.0.typelib
+
+%files schema
+%{_datadir}/glib-2.0/schemas/org.gnome.login-screen.gschema.xml
+
+%files devel
+%{_includedir}/gdm/
+%{_libdir}/libgdm.so
+%{_libdir}/pkgconfig/gdm.pc
+%{_libdir}/pkgconfig/gdm-pam-extensions.pc
+%{_datadir}/gir-1.0/Gdm-1.0.gir
+
+%files branding-upstream
+%config(noreplace) %{_sysconfdir}/gdm/custom.conf
+
+%files systemd
+%{_unitdir}/gdm.service
+
+%files -n gdmflexiserver
+%{_bindir}/gdmflexiserver
+
+%files lang -f %{name}.lang
+
+%changelog

gdm.sysusers

@@ -0,0 +1,3 @@
+# Type Name ID GECOS Home
+u      gdm  -  "Gnome Display Manager daemon"	/var/lib/gdm
+m      gdm video

gdm.tmpfiles

@@ -0,0 +1,4 @@
+d /var/lib/gdm 0750 gdm gdm -
+d /var/log/gdm 0711 root gdm -
+d /var/cache/gdm 1755 root root -
+d /run/gdm 0711 root gdm -

gdmflexiserver-wrapper

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if test ! -x "${GDMFLEXISERVER:-@LIBEXECDIR@/gdm/gdmflexiserver}"; then
+  echo "No gdmflexiserver implementation found. Maybe install gdm?" >&2
+  exit 1
+else
+  exec "${GDMFLEXISERVER:-@LIBEXECDIR@/gdm/gdmflexiserver}"
+fi

reserveVT.conf

@@ -0,0 +1,2 @@
+[Login]
+ReserveVT=1