diff --git a/gdm-2.22.0-enable-tcp.patch b/gdm-2.22.0-enable-tcp.patch
index 3a177d3..3ccd311 100644
--- a/gdm-2.22.0-enable-tcp.patch
+++ b/gdm-2.22.0-enable-tcp.patch
@@ -1,12 +1,60 @@
-diff -up gdm-2.22.0/daemon/gdm-server.c.enable-tcp gdm-2.22.0/daemon/gdm-server.c
---- gdm-2.22.0/daemon/gdm-server.c.enable-tcp	2008-06-25 10:03:11.000000000 -0400
-+++ gdm-2.22.0/daemon/gdm-server.c	2008-06-25 10:03:14.000000000 -0400
-@@ -916,7 +916,7 @@ gdm_server_class_init (GdmServerClass *k
-                                          g_param_spec_boolean ("disable-tcp",
-                                                                NULL,
-                                                                NULL,
--                                                               TRUE,
-+                                                               FALSE,
-                                                                G_PARAM_READWRITE | G_PARAM_CONSTRUCT));
+diff -up gdm-2.22.0/common/gdm-settings-keys.h.enable-tcp gdm-2.22.0/common/gdm-settings-keys.h
+--- gdm-2.22.0/common/gdm-settings-keys.h.enable-tcp	2008-04-17 23:29:27.000000000 -0400
++++ gdm-2.22.0/common/gdm-settings-keys.h	2008-06-25 11:19:51.000000000 -0400
+@@ -31,6 +31,8 @@ G_BEGIN_DECLS
+ #define GDM_KEY_TIMED_LOGIN_USER "daemon/TimedLogin"
+ #define GDM_KEY_TIMED_LOGIN_DELAY "daemon/TimedLoginDelay"
  
- }
++#define GDM_KEY_DISALLOW_TCP "security/DisallowTCP"
++
+ #define GDM_KEY_XDMCP_ENABLE "xdmcp/Enable"
+ #define GDM_KEY_MAX_PENDING "xdmcp/MaxPending"
+ #define GDM_KEY_MAX_SESSIONS "xdmcp/MaxSessions"
+diff -up gdm-2.22.0/daemon/gdm-simple-slave.c.enable-tcp gdm-2.22.0/daemon/gdm-simple-slave.c
+--- gdm-2.22.0/daemon/gdm-simple-slave.c.enable-tcp	2008-06-25 11:19:51.000000000 -0400
++++ gdm-2.22.0/daemon/gdm-simple-slave.c	2008-06-25 11:29:44.000000000 -0400
+@@ -1003,8 +1003,18 @@ gdm_simple_slave_run (GdmSimpleSlave *sl
+          * exist */
+         if (display_is_local) {
+                 gboolean res;
++                gboolean disable_tcp;
+ 
+                 slave->priv->server = gdm_server_new (display_name, auth_file);
++
++                disable_tcp = TRUE;
++                if (gdm_settings_client_get_boolean (GDM_KEY_DISALLOW_TCP,
++                                                     &disable_tcp)) {
++                        g_object_set (slave->priv->server,
++                                      "disable-tcp", disable_tcp,
++                                      NULL);
++                }
++
+                 g_signal_connect (slave->priv->server,
+                                   "exited",
+                                   G_CALLBACK (on_server_exited),
+diff -up gdm-2.22.0/data/gdm.conf-custom.in.enable-tcp gdm-2.22.0/data/gdm.conf-custom.in
+--- gdm-2.22.0/data/gdm.conf-custom.in.enable-tcp	2008-04-17 23:29:29.000000000 -0400
++++ gdm-2.22.0/data/gdm.conf-custom.in	2008-06-25 11:19:51.000000000 -0400
+@@ -4,4 +4,6 @@
+ 
+ [chooser]
+ 
++[security]
++
+ [debug]
+diff -up gdm-2.22.0/data/gdm.schemas.in.enable-tcp gdm-2.22.0/data/gdm.schemas.in
+--- gdm-2.22.0/data/gdm.schemas.in.enable-tcp	2008-04-20 09:51:56.000000000 -0400
++++ gdm-2.22.0/data/gdm.schemas.in	2008-06-25 11:19:51.000000000 -0400
+@@ -28,6 +28,12 @@
+     </schema>
+ 
+     <schema>
++      <key>security/DisallowTCP</key>
++      <signature>b</signature>
++      <default>true</default>
++    </schema>
++
++    <schema>
+       <key>xdmcp/Enable</key>
+       <signature>b</signature>
+       <default>false</default>
diff --git a/gdm.spec b/gdm.spec
index c07a66b..68927e4 100644
--- a/gdm.spec
+++ b/gdm.spec
@@ -15,7 +15,7 @@
 Summary: The GNOME Display Manager
 Name: gdm
 Version: 2.22.0
-Release: 7%{?dist}
+Release: 8%{?dist}
 Epoch: 1
 License: GPLv2+
 Group: User Interface/X
@@ -308,6 +308,10 @@ fi
 %{_datadir}/gnome-2.0/ui/GNOME_FastUserSwitchApplet.xml
 
 %changelog
+* Wed Jun 25 2008 Ray Strode <rstrode@redhat.com> - 1:2.22.0-8
+- After discussion with X team, turn tcp connections off by default,
+  but add back option to toggle on (bug 446672)
+
 * Wed Jun 25 2008 Ray Strode <rstrode@redhat.com> - 1:2.22.0-7
 - enable tcp connections by default