Indeed, Russell Coker even has a public demo machine (I don't know if it still works) where anyone can log in as root/uid 0, and still can't do much useful due

Indeed, Russell Coker even has a public demo machine (I don't know if it still works) where anyone can log in as root/uid 0, and still can't do much useful due to the SELinux policies on the machine: https://www.coker.com.au/selinux/play.html https://www.coker.com.au/selinux/play.html