dont use su, pass user/group to exec and let puppet handle it instead