Privilege escsllation only. Big words to start with, but they require existing unprivileged access to the system.
I generally assume privesc is possible, since a friend told me he managed to delete the root password to an estate of servers at work using cash, and then privesc-ed each to regain full access..