Um, if you can compromise "passwd" it's game over; you are root equivalent. Looking at other suids in /bin... Compromise mount, game over. Compromise su, gam

Um, if you can compromise "passwd" it's game over; you are root equivalent. Looking at other suids in /bin... Compromise mount, game over. Compromise su, game over. arping? ping? Dunno; they can generating normally-prohibited packets. umount? Hmmm.... feels like some kind of clever trick lurking here. As for kernel subsystems, there's very little which cannot lead to full system compromise, either directly or indirectly by tricking a user.