Also, if you have any untrusted PLs available, a superuser can create one of those and do what they like.