It's been well over a month since I last reported on this, so I think it's fine time I reported about the latest on the subject.

My above comment was mostly correct and slightly wrong.  Interestingly, stock Ubuntu 21.10 does not use Wayland (on my setup, at least, with Intel integrated graphics); it uses X11, just like Ubuntu MATE does.  But interestingly, Ubiquity on stock Ubuntu starts the *GNOME Shell*, whereas Ubiquity on Ubuntu MATE only starts Marco, a generic Ubiquity top panel (which is supposed to be stocked with indicators, but Ubiquity's panel only works with Unity indicators and not Ayatana indicators), the MATE Settings Daemon, and a handful of other programs.

Furthermore, like I suspected, both Ubuntu and Ubuntu MATE start the Ubiquity greeter as root, except their *effective* user IDs are both the respective live session users (`ubuntu` and `ubuntu-mate`, respectively).  The latter is done probably to allow communication over D-Bus, because my experiments show that if the process' effective UID is not 999 (the live session user), neither version of Ubiquity will interact with the screen reader.

Here's the proof.  The first snippet was taken on an Ubuntu 21.10 system (that took me eons to download); the second is from an Ubuntu MATE 21.10 system.

Ubuntu:

   RUSER    EUSER        PID    PPID COMMAND
   ubuntu   ubuntu      1948    1941 /usr/bin/pipewire
   ubuntu   ubuntu      1949    1941 /usr/bin/pipewire-media-session
   ubuntu   ubuntu      1950    1941 /usr/bin/pulseaudio --daemonize=no --log-target=journal
   ubuntu   ubuntu      1953    1941 /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
   ubuntu   ubuntu      1966    1941 /usr/libexec/dconf-service
   ubuntu   ubuntu      1983    1703 /usr/libexec/gsd-a11y-settings
   ubuntu   ubuntu      1986    1703 /usr/libexec/gsd-keyboard
   ubuntu   ubuntu      1987    1703 /usr/libexec/gsd-media-keys
   ubuntu   ubuntu      2004    1703 /usr/libexec/gsd-power
   ubuntu   ubuntu      2005    1703 /usr/libexec/gsd-xsettings
   ubuntu   ubuntu      2006    1703 gnome-shell --sm-disable --mode=ubiquity
   root     ubuntu      2028    2009 /usr/bin/python3 /usr/lib/ubiquity/bin/ubiquity --greeter --only
   ubuntu   ubuntu      2151    2146 /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3
   ubuntu   ubuntu      2166    1941 /usr/libexec/at-spi2-registryd --use-gnome-session

Ubuntu MATE:

   RUSER    EUSER        PID    PPID COMMAND
   ubuntu-+ ubuntu-+    1882    1875 /usr/bin/pulseaudio --daemonize=no --log-target=journal
   ubuntu-+ ubuntu-+    1893    1875 /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
   ubuntu-+ ubuntu-+    1896    1875 /usr/libexec/dconf-service
   ubuntu-+ ubuntu-+    1926    1694 /usr/bin/mate-settings-daemon
   ubuntu-+ ubuntu-+    1927    1694 marco --sm-disable
   ubuntu-+ ubuntu-+    1931    1694 /usr/lib/ubiquity/panel
   ubuntu-+ ubuntu-+    1938    1694 nm-applet
   ubuntu-+ ubuntu-+    2000    1875 /usr/libexec/at-spi-bus-launcher
   ubuntu-+ ubuntu-+    2007    2000 /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3
   root     ubuntu-+    2008    1942 /usr/bin/python3 /usr/lib/ubiquity/bin/ubiquity --greeter --only
   ubuntu-+ ubuntu-+    2093    1875 /usr/libexec/at-spi2-registryd --use-gnome-session

The output was abbreviated slightly; I remove unrelated processes like the RealtimeKit daemon and UDisks.

As you can see, the Ubiquity process (`/usr/bin/python3 /usr/lib/ubiquity/bin/ubiquity` on both of them) runs with a real UID of root, but an effective UID of either `ubuntu` or `ubuntu-mate` (the latter was chopped off by `ps`).  So there's no dissimilarity there.

***However...***

With the screen reader enabled, from a command line (Ctrl-Alt-F2) I tried launching a text editor on each of them, first as user 999:

   DISPLAY=":0" pluma &

...and then as root:

   sudo env DISPLAY=":0" pluma &

...and then with a real UID of 0 and an effective UID of 999, just like Ubiquity:

   sudo env DISPLAY=":0" setpriv --ruid 0 --rgid 0 --euid 999 --egid 999 --init-groups pluma &

The first command cooperated with the screen reader on both systems (i.e., the screen reader told me stuff like "Edit menu... Select All Ctrl-A").  The last two commands worked fine on Ubuntu but not on Ubuntu MATE.

I tried these experiments also on the live desktop, not just at the Ubiquity greeter.  The results were the same regardless of whether I tried it on the live desktop or on the Ubiquity greeter.

Clearly, Ubuntu and Ubuntu MATE are configured differently, somehow pertaining to user IDs allowed to use accessibility features.  But where?

I ran the above experiments, but through `strace -s 1048576` to capture all (or most) communications going on between pluma / gedit and D-Bus.  The results were stunning:

On **both systems**, the first command (running as user ID 999) printed loads of D-Bus interactions involving the accessibility bus; I ran `grep a11y` and that turned up dozens of results.  On **only the Ubuntu system** did I find any instance of the word `a11y` from the last two commands.  I didn't even find any D-Bus interaction at all from the last two commands on the Ubuntu MATE system!

The working theory I have so far is that Ubuntu MATE's D-Bus permissions are somehow more strict than Ubuntu's, so processes like Ubiquity which could "potentially" elevate their privileges above where they are currently can't communicate on the bus.  But I have no outright *proof* of that yet.

Anyway, I'll keep digging!