spawn with sudo

instead of setuid

allows better restricted access, and doesn't require the user to be root.