must be run as root (setgid experiment doesnt work for interpreted code)