prevent privilege escalation

This allowed a non-privileged user to run an arbitrary executable with root privileges
refactor modules/services.py