nearly there with running as nobody and getting permissions right