[Reiko]

They were indeed set to enforcing. They're multi-user systems that are used for web hosting, like you'd see with CPanel, Directadmin, Plesk, etc. The user is allowed to write to his own home directory by DAC and SElinux, and his processes run as children of the HTTP server, so they inherit its role.

The attack scenario here would be a PHP/CGI shell writing the key out, then logging in to remove SEL (and other) restrictions.