iceauth

ICE is a transport layer of its own and so got an authority file of its own. Each entry in ~/.ICEauthority names a protocol — ICE for the connection itself or XSMP for the sub-protocol — the network ID of a listening socket, typically local/hostname:/tmp/.ICE-unix/PID, the method MIT-MAGIC-COOKIE-1 and the cookie itself. The format is essentially Xauthority with one more column, and iceauth, written by Ralph Mor for X11R6 in 1994, is a copy of xauth with the same commands: list, add, remove, extract and merge, interactively or on the command line. The session manager does the writing: xsm, ksmserver and gnome-session insert their cookie when they open their socket, and every client connecting through libSM reads the same file to be able to answer.

Almost nobody runs iceauth by hand, but the file has made itself known. A sudo that launches a graphical program can leave ~/.ICEauthority owned by root, and at the next login gnome-session could not write its entry, gave up and logged straight back out — "Could not update ICEauthority file" was for years one of the commonest ways to lock yourself out of a GNOME desktop, with a full home directory a close second. The fix was to move the file: the ICEAUTHORITY environment variable now usually points into $XDG_RUNTIME_DIR, which is wiped at logout and can never inherit the wrong owner, while the file in the home directory sits there empty.