Comment 6 for bug 1169075

There are three cases:

The system compositor (e.g. unity_system_compositor) needs privileged access - but doesn't export any endpoint and should be supplying a socket fd to processes it trusts (assuming that is now implemented).

A session compositor - this shouldn't need to run as root (as it should be in "nested" mode with the system compositor as host). This ought to run as the user and creates an endpoint identified to clients by $MIR_SOCKET.

Standalone Mir needs privileged access - and exports a "well known endpoint". This is the historical configuration and has the default /tmp/mir_socket with default permissions.