So I'm not sure if stopping kdm really gets us the level of safety which we achive by switching to RL3 during d-u.
Today I made a little investigation about this, on my LXDE netbook and also on my KDE desktop. You guys can try it and see if it is the same for your systems.
When you are logged in to the GUI as a user on TTY7, open a terminal and run
px aux | most
When you scroll down the list, at a point you find a section that looks like this:
root 27343 0.0 0.0 26808 780 ? Ss 07:43 0:00 /usr/bin/kdm
.
.
.
root 27346 0.0 1.5 207128 91716 tty7 Ss+ 07:43 0:07 /usr/bin/X :0 vt7 -br -nolisten tcp -auth /var/run/xauth/A:0-t1v2
root 27364 0.0 0.0 0 0 ? S 07:43 0:00 [kworker/2:1]
root 27366 0.0 0.0 24344 1448 ? S 07:43 0:00 /sbin/udevd
root 27367 0.0 0.0 24344 1444 ? S 07:43 0:00 /sbin/udevd
root 27373 0.0 0.0 75268 2460 ? S 07:43 0:00 -:0
root 27489 0.0 0.0 0 0 ? S 08:59 0:00 [kworker/1:1]
root 27535 0.0 0.0 0 0 ? S 09:59 0:00 [flush-8:0]
root 27561 0.0 0.0 0 0 ? S 10:27 0:00 [kworker/0:0]
root 27569 0.0 0.0 0 0 ? S 10:35 0:00 [kworker/0:2]
don 27580 0.0 0.0 4324 696 ? Ss 10:38 0:00 /bin/sh /usr/bin/startkde
don 27626 0.0 0.0 12592 336 ? Ss 10:38 0:00 /usr/bin/ssh-agent /usr/bin/dbus-launch --exit-with-session /usr/
don 27629 0.0 0.0 24468 880 ? S 10:38 0:00 /usr/bin/dbus-launch --exit-with-session /usr/bin/startkde
don 27630 1.2 0.0 35228 3128 ? Ss 10:38 0:01 /usr/bin/dbus-daemon --fork --print-pid 5 --print-address 7 --ses
don 27670 0.0 0.0 4088 88 ? S 10:38 0:00 /usr/lib/kde4/libexec/start_kdeinit +kcminit_startup
don 27671 0.1 0.7 367672 46348 ? Ss 10:38 0:00 kdeinit4: kdeinit4 Running...
don 27672 0.0 0.4 373980 24608 ? S 10:38 0:00 kdeinit4: klauncher [kdeinit] --fd=9
don 27674 0.4 0.7 1417788 48716 ? Sl 10:38 0:00 kdeinit4: kded4 [kdeinit]
don 27690 0.1 0.2 285160 17080 ? S 10:38 0:00 /usr/bin/kglobalaccel
.
.
.
Now go to the console on tty1, log in as root, and issue:
service kdm stop
(or slim, gdm, lightdm, or whatever your DM is) and then run the same list of processes. On the two systems I looked at, all of the user processes were killed, as well as the X-related root processes including /usr/bin/X on tty7.
So it looks safe to me to run d-u after the DM is stopped. Right?
Of course if a new version of a video driver (or other hardware driver) is installed, we will still need to either unload/reload the applicable kernel module or reboot to run the new module.