use privileged options for shell provisioning