The Sandbox subsystem in Apple OS X prior to 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters.
apple mac os x