The -sp server option.

Would I be right in assuming that (for the XFree86 server):

  1 The non specifying of the -sp option to the server
    results in the use of a default security policy file.

  2 The strongest curtailment of untrusted clients is obtained
    by specifying "-sp /dev/null" to the server.

Cheers.