Redhat ships with a targeted policy. Most of the non-network programs are put in a very permissive domain to avoid breakage. I just checked the CentOS policy[0

Redhat ships with a targeted policy. Most of the non-network programs are put in a very permissive domain to avoid breakage. I just checked the CentOS policy[0] (not at work and don't have easy access to the Redhat repos). It appears that xserver_t does have write access to both etc_t and shadow_t [1]. More specifically, xserver_t is part of the selinux_unconfined_type attribute, which means that it can do pretty much anything. (Even more specifically, it is part of the files_unconfined_type attribute, which gives it write permissions to everything in file_type): > sesearch --allow -s xserver_t -t shadow_t -c file policy.31 allow files_unconfined_type file_type:file execmod; [ selinuxuser_execmod ]:True allow files_unconfined_type file_type:file { append audit_access create execute execute_no_trans getattr ioctl link lock mounton open quotaon read relabelfrom relabelto rename setattr swapon unlink write }; [0] https://centos.pkgs.org/7/centos-updates-x86_64/selinux-policy-targeted-3.13.1-192.el7_5.6.noarch.rpm.html https://centos.pkgs.org/7/centos-updates-x86_64/selinux-poli... [1] Because of its sensitive nature, /etc/shadow has its own SELinux label