step 4: elevate privileges + run root shell