Index: gdm-2.24.0/common/gdm-settings-keys.h
===================================================================
--- gdm-2.24.0.orig/common/gdm-settings-keys.h
+++ gdm-2.24.0/common/gdm-settings-keys.h
@@ -36,6 +36,7 @@ G_BEGIN_DECLS
 #define GDM_KEY_LOCAL_XSERVER_COMMAND "daemon/LocalXserverCommand"
 #define GDM_KEY_DISALLOW_TCP "security/DisallowTCP"
 #define GDM_KEY_ALLOW_ROOT "security/AllowRoot"
+#define GDM_KEY_ALLOW_REMOTE_ROOT "security/AllowRemoteRoot"
 
 #define GDM_KEY_XDMCP_ENABLE "xdmcp/Enable"
 #define GDM_KEY_MAX_PENDING "xdmcp/MaxPending"
Index: gdm-2.24.0/common/gdm-settings-system-backend.c
===================================================================
--- gdm-2.24.0.orig/common/gdm-settings-system-backend.c
+++ gdm-2.24.0/common/gdm-settings-system-backend.c
@@ -44,6 +44,7 @@
 #define SYSCONFIG_AUTOLOGIN_KEY "DISPLAYMANAGER_AUTOLOGIN"
 #define SYSCONFIG_LOCAL_XSERVER_KEY "DISPLAYMANAGER_STARTS_XSERVER"
 #define SYSCONFIG_XDMCP_ENABLE_KEY "DISPLAYMANAGER_REMOTE_ACCESS"
+#define SYSCONFIG_XDMCP_ROOT_ENABLE_KEY "DISPLAYMANAGER_ROOT_LOGIN_REMOTE"
 
 #define GDM_SETTINGS_SYSTEM_BACKEND_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), GDM_TYPE_SETTINGS_SYSTEM_BACKEND, GdmSettingsSystemBackendPrivate))
 
@@ -105,7 +106,8 @@ gdm_settings_system_backend_get_value (G
         if (strcasecmp (key, GDM_KEY_AUTO_LOGIN_ENABLE) &&
             strcasecmp (key, GDM_KEY_AUTO_LOGIN_USER) && 
 	    strcasecmp (key, GDM_KEY_LOCAL_XSERVER_ENABLE) &&
-	    strcasecmp (key, GDM_KEY_XDMCP_ENABLE)) {
+	    strcasecmp (key, GDM_KEY_XDMCP_ENABLE) &&
+	    strcasecmp (key, GDM_KEY_ALLOW_REMOTE_ROOT)) {
                 g_set_error (error, GDM_SETTINGS_BACKEND_ERROR, GDM_SETTINGS_BACKEND_ERROR_KEY_NOT_FOUND, "Key not found");
                 goto out;
         }
@@ -128,6 +130,18 @@ gdm_settings_system_backend_get_value (G
 
 	        if (val && !strcasecmp (val, "no"))
         		new_val = "false";
+        	else
+		        new_val = "true";
+
+		g_free (val);
+                val = g_strdup (new_val);
+	} else if (!strcasecmp (key, GDM_KEY_ALLOW_REMOTE_ROOT)) {
+                const gchar *new_val;
+
+                val = gdm_sysconfig_get_value ((const gchar **) priv->lines, SYSCONFIG_XDMCP_ROOT_ENABLE_KEY);
+
+	        if (val && !strcasecmp (val, "no"))
+        		new_val = "false";
         	else
 		        new_val = "true";
 
Index: gdm-2.24.0/daemon/gdm-display.c
===================================================================
--- gdm-2.24.0.orig/daemon/gdm-display.c
+++ gdm-2.24.0/daemon/gdm-display.c
@@ -607,9 +607,6 @@ gdm_display_prepare (GdmDisplay *display
 static gboolean
 gdm_display_real_manage (GdmDisplay *display)
 {
-        char    *command;
-        char    *log_file;
-        char    *log_path;
         gboolean res;
 
         g_return_val_if_fail (GDM_IS_DISPLAY (display), FALSE);
Index: gdm-2.24.0/daemon/gdm-session-direct.c
===================================================================
--- gdm-2.24.0.orig/daemon/gdm-session-direct.c
+++ gdm-2.24.0/daemon/gdm-session-direct.c
@@ -1462,6 +1462,7 @@ do_introspect (DBusConnection *connectio
                                "      <arg name=\"display_device\" type=\"s\"/>\n"
                                "      <arg name=\"hostname\" type=\"s\"/>\n"
                                "      <arg name=\"x11_authority_file\" type=\"s\"/>\n"
+                               "      <arg name=\"display_is_local\" type=\"b\"/>\n"
                                "    </signal>\n"
                                "    <signal name=\"SetupForUser\">\n"
                                "      <arg name=\"service_name\" type=\"s\"/>\n"
@@ -1470,6 +1471,7 @@ do_introspect (DBusConnection *connectio
                                "      <arg name=\"hostname\" type=\"s\"/>\n"
                                "      <arg name=\"x11_authority_file\" type=\"s\"/>\n"
                                "      <arg name=\"username\" type=\"s\"/>\n"
+                               "      <arg name=\"display_is_local\" type=\"b\"/>\n"
                                "    </signal>\n"
                                "    <signal name=\"Authenticate\">\n"
                                "    </signal>\n"
@@ -1898,6 +1900,7 @@ send_setup (GdmSessionDirect *session,
         dbus_message_iter_append_basic (&iter, DBUS_TYPE_STRING, &display_device);
         dbus_message_iter_append_basic (&iter, DBUS_TYPE_STRING, &display_hostname);
         dbus_message_iter_append_basic (&iter, DBUS_TYPE_STRING, &display_x11_authority_file);
+        dbus_message_iter_append_basic (&iter, DBUS_TYPE_BOOLEAN, &session->priv->display_is_local);
 
         if (! send_dbus_message (session->priv->worker_connection, message)) {
                 g_debug ("GdmSessionDirect: Could not send %s signal", "Setup");
@@ -1959,6 +1962,7 @@ send_setup_for_user (GdmSessionDirect *s
         dbus_message_iter_append_basic (&iter, DBUS_TYPE_STRING, &display_hostname);
         dbus_message_iter_append_basic (&iter, DBUS_TYPE_STRING, &display_x11_authority_file);
         dbus_message_iter_append_basic (&iter, DBUS_TYPE_STRING, &selected_user);
+        dbus_message_iter_append_basic (&iter, DBUS_TYPE_BOOLEAN, &session->priv->display_is_local);
 
         if (! send_dbus_message (session->priv->worker_connection, message)) {
                 g_debug ("GdmSessionDirect: Could not send %s signal", "SetupForUser");
Index: gdm-2.24.0/daemon/gdm-session-private.h
===================================================================
--- gdm-2.24.0.orig/daemon/gdm-session-private.h
+++ gdm-2.24.0/daemon/gdm-session-private.h
@@ -65,6 +65,8 @@ void             _gdm_session_selected_u
                                                             const char   *text);
 
 /* call and response stuff */
+void             _gdm_session_radio_info_query             (GdmSession   *session,
+                                                            const char   *text);
 void             _gdm_session_info_query                   (GdmSession   *session,
                                                             const char   *text);
 void             _gdm_session_secret_info_query            (GdmSession   *session,
Index: gdm-2.24.0/daemon/gdm-session-worker.c
===================================================================
--- gdm-2.24.0.orig/daemon/gdm-session-worker.c
+++ gdm-2.24.0/daemon/gdm-session-worker.c
@@ -118,6 +118,7 @@ struct GdmSessionWorkerPrivate
         char             *display_device;
         char             *hostname;
         char             *username;
+        gboolean          display_is_local;
         uid_t             uid;
         gboolean          password_is_required;
 
@@ -199,14 +200,7 @@ open_ck_session (GdmSessionWorker  *work
 
         g_assert (worker->priv->username != NULL);
 
-        /* FIXME: this isn't very good */
-        if (display_hostname == NULL
-            || display_hostname[0] == '\0'
-            || strcmp (display_hostname, "localhost") == 0) {
-                is_local = TRUE;
-        } else {
-                is_local = FALSE;
-        }
+        is_local = worker->priv->display_is_local;
 
         pwent = getpwnam (worker->priv->username);
         if (pwent == NULL) {
@@ -1277,31 +1271,43 @@ gdm_session_worker_authorize_user (GdmSe
 {
         int error_code;
         int authentication_flags;
-        gboolean allow_root;
+        char *username;
+        struct passwd *pwent = NULL;
 
         g_debug ("GdmSessionWorker: determining if authenticated user is authorized to session");
 
-       gdm_settings_direct_get_boolean (GDM_KEY_ALLOW_ROOT, &allow_root);
+        gdm_session_worker_get_username (worker, &username);
+        if (username) {
+                pwent = getpwnam (username);
+                g_free (username);
+        }
 
-       if (!allow_root) {
-               char *username;
-               struct passwd *pwent;
-
-               gdm_session_worker_get_username (worker, &username);
-               if (username) {
-                       pwent = getpwnam (username);
-                       g_free (username);
-
-                       if (pwent && (pwent->pw_uid == GDM_SESSION_ROOT_UID)) {
-                               g_set_error (error,
-                                            GDM_SESSION_WORKER_ERROR,
-                                            GDM_SESSION_WORKER_ERROR_AUTHORIZING,
-                                           "%s", _("System administator is not allowed to login."));
-                               gdm_session_worker_uninitialize_pam (worker, PAM_PERM_DENIED);
-                               return FALSE;
-                       }
-               }
-       }
+        if (pwent && (pwent->pw_uid == GDM_SESSION_ROOT_UID)) {
+                gboolean allow_root;
+
+                gdm_settings_direct_get_boolean (GDM_KEY_ALLOW_ROOT, &allow_root);
+                if (!allow_root) {
+                        g_set_error (error,
+                                     GDM_SESSION_WORKER_ERROR,
+                                     GDM_SESSION_WORKER_ERROR_AUTHORIZING,
+                                     "%s", _("System administrator is not allowed to login."));
+                        gdm_session_worker_uninitialize_pam (worker, PAM_PERM_DENIED);
+                        return FALSE;
+                }
+                if (!worker->priv->display_is_local) {
+                        gboolean allow_remote_root;
+
+                        gdm_settings_direct_get_boolean (GDM_KEY_ALLOW_REMOTE_ROOT, &allow_remote_root);
+                        if (!allow_remote_root) {
+                                g_set_error (error,
+                                             GDM_SESSION_WORKER_ERROR,
+                                             GDM_SESSION_WORKER_ERROR_AUTHORIZING,
+                                             "%s", _("System administrator is not allowed to remote login."));
+                                gdm_session_worker_uninitialize_pam (worker, PAM_PERM_DENIED);
+                                return FALSE;
+                        }
+                }
+        }
 
         authentication_flags = 0;
 
@@ -2503,6 +2509,8 @@ on_setup (GdmSessionWorker *worker,
         const char *x11_authority_file;
         const char *console;
         const char *hostname;
+        const gboolean display_is_local;
+
         dbus_bool_t res;
 
         if (worker->priv->state != GDM_SESSION_WORKER_STATE_NONE) {
@@ -2518,6 +2526,7 @@ on_setup (GdmSessionWorker *worker,
                                      DBUS_TYPE_STRING, &console,
                                      DBUS_TYPE_STRING, &hostname,
                                      DBUS_TYPE_STRING, &x11_authority_file,
+                                     DBUS_TYPE_BOOLEAN, &display_is_local,
                                      DBUS_TYPE_INVALID);
         if (res) {
                 worker->priv->service = g_strdup (service);
@@ -2526,6 +2535,7 @@ on_setup (GdmSessionWorker *worker,
                 worker->priv->display_device = g_strdup (console);
                 worker->priv->hostname = g_strdup (hostname);
                 worker->priv->username = NULL;
+		worker->priv->display_is_local = display_is_local;
 
                 g_debug ("GdmSessionWorker: queuing setup: %s %s", service, console);
                 queue_state_change (worker);
@@ -2546,6 +2556,7 @@ on_setup_for_user (GdmSessionWorker *wor
         const char *console;
         const char *hostname;
         const char *username;
+        const gboolean display_is_local;
         dbus_bool_t res;
 
         if (worker->priv->state != GDM_SESSION_WORKER_STATE_NONE) {
@@ -2562,6 +2573,7 @@ on_setup_for_user (GdmSessionWorker *wor
                                      DBUS_TYPE_STRING, &hostname,
                                      DBUS_TYPE_STRING, &x11_authority_file,
                                      DBUS_TYPE_STRING, &username,
+                                     DBUS_TYPE_BOOLEAN, &display_is_local,
                                      DBUS_TYPE_INVALID);
         if (res) {
                 worker->priv->service = g_strdup (service);
@@ -2570,6 +2582,7 @@ on_setup_for_user (GdmSessionWorker *wor
                 worker->priv->display_device = g_strdup (console);
                 worker->priv->hostname = g_strdup (hostname);
                 worker->priv->username = g_strdup (username);
+		worker->priv->display_is_local = display_is_local;
 
                 g_debug ("GdmSessionWorker: queuing setup for user %s %s", service, console);
                 queue_state_change (worker);
Index: gdm-2.24.0/data/gdm.schemas.in
===================================================================
--- gdm-2.24.0.orig/data/gdm.schemas.in
+++ gdm-2.24.0/data/gdm.schemas.in
@@ -49,6 +49,12 @@
     </schema>
 
     <schema>
+      <key>security/AllowRemoteRoot</key>
+      <signature>b</signature>
+      <default>false</default>
+    </schema>
+
+    <schema>
       <key>security/DisallowTCP</key>
       <signature>b</signature>
       <default>true</default>
Index: gdm-2.24.0/data/gdm.schemas.in.in
===================================================================
--- gdm-2.24.0.orig/data/gdm.schemas.in.in
+++ gdm-2.24.0/data/gdm.schemas.in.in
@@ -60,6 +60,12 @@
     </schema>
 
     <schema>
+      <key>security/AllowRemoteRoot</key>
+      <signature>b</signature>
+      <default>false</default>
+    </schema>
+
+    <schema>
       <key>xdmcp/Enable</key>
       <signature>b</signature>
       <default>false</default>
