How many linux servers have Xorg installed? Certainly none of mine, though I mainly work with web & db servers.

Lots of RHEL servers do, but I would guess that selinux stops this exploit, I see no reason for X to have write permission in /etc.

Redhat ships with a targeted policy. Most of the non-network programs are put in a very permissive domain to avoid breakage.

I just checked the CentOS policy[0] (not at work and don't have easy access to the Redhat repos).

It appears that xserver_t does have write access to both etc_t and shadow_t [1].

More specifically, xserver_t is part of the selinux_unconfined_type attribute, which means that it can do pretty much anything. (Even more specifically, it is part of the files_unconfined_type attribute, which gives it write permissions to everything in file_type):

  > sesearch --allow -s xserver_t -t shadow_t -c file policy.31
  allow files_unconfined_type file_type:file execmod; [ selinuxuser_execmod ]:True
  allow files_unconfined_type file_type:file { append audit_access create execute execute_no_trans getattr ioctl link lock mounton open quotaon read relabelfrom relabelto rename setattr swapon unlink write };

[0] https://centos.pkgs.org/7/centos-updates-x86_64/selinux-poli...

[1] Because of its sensitive nature, /etc/shadow has its own SELinux label

Already been patched in any case.

https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885...

Some people install Xorg on their servers because they need to render stuff (e.g. using OpenGL or Vulkan).

that's not needed at all, unless you have legacy applications.

you can open a dri render device node, and use it directly

xorg-server doesn't need suid useflag these days anymore, does it?

The Xorg process runs as the root user unless you are using Wayland.

innovative way of using X11.

% ls -l /bin/Xorg -rwxr-xr-x 1 root root 271 Oct 25 18:42 /bin/Xorg

That 271 byte file is just a shell script that execs either Xorg.wrap or Xorg from the X basedir (eg /usr/lib/xorg/). One of those target files is usually setuid.

If you have Xorg.wrap, it will be the setuid file and it is usually configured to drop root before executing the real Xorg if root isn't needed (eg. KMS is available).