XACE is probably a better solution:

http://www.x.org/releases/X11R7.5/doc/security/XACE-Spec.htm...