skip the secondary group thing. End-user must setup sudo accordingly