xhost +SI:localuser:lightdm allows the
lightdm user to access the running X server. The current X server is indicated by the
DISPLAY environment variable.
The manpage has reasonably good explanations:
[+]name The given name (the plus sign is optional) is added to the list
allowed to connect to the X server. The name can be a host
name or a complete name (See NAMES for more details).
A complete name has the syntax ``family:name'' where the families are
si Server Interpreted
the server interpreted address "si:localuser:username" can be used to
specify a single local user. (See the Xsecurity(7) manual page for more
Xsecurity manpage says:
SERVER INTERPRETED ACCESS TYPES
The sample implementation includes several Server Interpreted
IPv6 IPv6 literal addresses
hostname Network host name
localuser Local connection user id
localgroup Local connection group id
With a bit of context: There are two commonly used ways to allow access to an X server. One is via an
Xauthority file, which is shared by the clients, and needs no further server-side configuration. The other is via the
xhost list, where configuration is done on the server at runtime (so this is not a permanent change).
localuser is a keyword to be retained as is (
lightdm is the username here, the one that LightDM runs as). This is somewhat like adding to a group, in that the groups are in the server's understanding of authorization. However, no system groups or users are affected. Only the X server's runtime configuration is changed.
The default behaviour of
xhost when run without arguments is to print the list, as the manpage says:
nothing If no command line arguments are given, a message indicating
whether or not access control is currently enabled is printed,
followed by the list of those allowed to connect.
access control enabled, only authorized clients can connect
We'll probably need to examine code to determine how a user is added to the list, and how X uses that list.
The reason this is done is to use
gsettings, which uses
dbus, which in turn usually needs an X server running. However, this is not necessary, and you could see this AskUbuntu answer.