fix one-off commands being executed as root