move privileged out of config, onto build

this cannot be reconfigured