rewrote gatekeeper to use an exec