The GDM daemon normally runs as root, as does the slave.  However GDM
should also have a dedicated user id and a group id which it uses for
its graphical interfaces such as gdmgreeter and
gdmlogin.  You can choose the name of this user
and group in the [daemon] section of the
configuration file.
The GDM user, and group, which are normally just
gdm should not be user or group of any particular
privilege.  The reason for using them is to have the user interface
run as a user without privileges so that in the unlikely case that
someone finds a weakness in the GUI, they cannot access root on the
computer.
It should however be noted that the GDM user and group have some
privileges that make them somewhat dangerous.  For one they have
access to the server authorization directory (the
ServAuthDir), which contains all the X server
authorization files and other private information.  This means that
someone who gains the GDM user/group privileges can then connect to
any session.  So you should not, under any circumstances, make this
some user/group which may be easy to get access to, such as the
user nobody.
The server authorization directory (the
ServAuthDir) is used for a host of random
internal data in addition to the X server authorization files, and the
naming is really a relic of history.  GDM daemon enforces this
directory to be owned by root.gdm with the
permissions of 1770.  This way, only root and the GDM group have write
access to this directory, but the GDM group cannot remove the root
owned files from this directory, such as the X server authorization
files.
GDM by default doesn't trust the server authorization directory and
treats it in the same way as the temporary directory with respect to
creating files.  This way someone breaking the GDM user cannot mount
attacks by creating links in this directory.  Similarly the X server
log directory is treated safely, but that directory should really be
owned and writable only by root.
Anybody found not using a dedicated user for GDM should be whacked over
the head with a large, blunt, heavy and rusty object, although the
rusty requirement may be dropped if there is not enough time to have
the object develop rust.
