Those are all explicit privileges given to the guest. You can also "escape" from a VM if you give it access to the Docker daemon on the host... It's like sayin

Those are all explicit privileges given to the guest. You can also "escape" from a VM if you give it access to the Docker daemon on the host... It's like saying "2 ways to escape an unprivileged user account: 1. type su then the root password, or 2. convince the admin to setuid your shell"