explicitly sudo when necessary, don't require sudo fab