Heh.  The only way to really fix X security is to have the framebuffer
drivers in the kernel, AFAIK.

You could always use systrace with dbus, though writing a good
systrace policy is not trivial, at least for me.

IMHO, writing to /dev/mem is the real problem here.
It is not the Right Thing(tm) to do.

--Blair