I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it to invoke /bin/sh and authenticating with my low-priv user results in root privileges.
How this works and how to prevent it are unclear to me. I've read up on pkexec (and polkit), but I just don't get it. Any explanation would be helpful.