Our current bootstrap config on the perm side straddles the "where does fab stop and machine config begin" - on our setup, it is granted by the sudoers file...seems like this case the sudoers might not allow for it.