diff --git a/etc/permission-hardening.d/25_default_whitelist_pam.conf b/etc/permission-hardening.d/25_default_whitelist_pam.conf
new file mode 100644
index 0000000..0c13f5d
--- /dev/null
+++ b/etc/permission-hardening.d/25_default_whitelist_pam.conf
@@ -0,0 +1,9 @@
+## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
+## See the file COPYING for copying conditions.
+
+## Please use "/etc/permission-hardening.d/20_user.conf" or
+## "/usr/local/etc/permission-hardening.d/20_user.conf" for your custom
+## configuration. When security-misc is updated, this file may be overwritten.
+
+## Without this, Xfce fails to start with a dbus-launch error.
+/usr/sbin/pam-tmpdir-helper exactwhitelist