make runuser call the shell explicitly