diff --git a/engine/autoedge_test.go b/engine/autoedge_test.go
index 19c6ec8c..5b4fd4da 100644
--- a/engine/autoedge_test.go
+++ b/engine/autoedge_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package engine
 
 import (
diff --git a/engine/graph/autogroup/autogroup_test.go b/engine/graph/autogroup/autogroup_test.go
index 2d3f43ed..438bd72b 100644
--- a/engine/graph/autogroup/autogroup_test.go
+++ b/engine/graph/autogroup/autogroup_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package autogroup
 
 import (
diff --git a/engine/graph/semaphore_test.go b/engine/graph/semaphore_test.go
index 8af3e9fd..6b03c7ca 100644
--- a/engine/graph/semaphore_test.go
+++ b/engine/graph/semaphore_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package graph
 
 import (
diff --git a/engine/metaparams_test.go b/engine/metaparams_test.go
index be6afc47..5c12790e 100644
--- a/engine/metaparams_test.go
+++ b/engine/metaparams_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package engine
 
 import (
diff --git a/engine/resources/exec_test.go b/engine/resources/exec_test.go
index 011919e0..7adb0054 100644
--- a/engine/resources/exec_test.go
+++ b/engine/resources/exec_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package resources
 
 import (
diff --git a/engine/resources/file_test.go b/engine/resources/file_test.go
index 81bca361..c47f7aad 100644
--- a/engine/resources/file_test.go
+++ b/engine/resources/file_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package resources
 
 import (
diff --git a/engine/resources/mount_test.go b/engine/resources/mount_test.go
index 13039eaf..fcd404ea 100644
--- a/engine/resources/mount_test.go
+++ b/engine/resources/mount_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package resources
 
 import (
diff --git a/engine/resources/msg_test.go b/engine/resources/msg_test.go
index 5f897b16..909a9056 100644
--- a/engine/resources/msg_test.go
+++ b/engine/resources/msg_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package resources
 
 import (
diff --git a/engine/resources/noop_test.go b/engine/resources/noop_test.go
index 614bd6d7..28cbb473 100644
--- a/engine/resources/noop_test.go
+++ b/engine/resources/noop_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package resources
 
 import (
diff --git a/engine/resources/pkg_test.go b/engine/resources/pkg_test.go
index 213bf647..16e72ddb 100644
--- a/engine/resources/pkg_test.go
+++ b/engine/resources/pkg_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package resources
 
 import (
diff --git a/engine/resources/test_test.go b/engine/resources/test_test.go
index bb8f0183..49dd3d74 100644
--- a/engine/resources/test_test.go
+++ b/engine/resources/test_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package resources
 
 import (
diff --git a/engine/util/util_test.go b/engine/util/util_test.go
index 8195be21..661c6e9e 100644
--- a/engine/util/util_test.go
+++ b/engine/util/util_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package util
 
 import (
diff --git a/etcd/etcd_test.go b/etcd/etcd_test.go
index 48d02bdd..d8b111e3 100644
--- a/etcd/etcd_test.go
+++ b/etcd/etcd_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package etcd
 
 import (
diff --git a/etcd/fs/fs_test.go b/etcd/fs/fs_test.go
index 7df3db7a..0c0879f5 100644
--- a/etcd/fs/fs_test.go
+++ b/etcd/fs/fs_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package fs_test // named this way to make it easier for examples
 
 import (
diff --git a/integration/basic_test.go b/integration/basic_test.go
index 4e113d74..5572c8bc 100644
--- a/integration/basic_test.go
+++ b/integration/basic_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package integration
 
 import (
diff --git a/integration/util_test.go b/integration/util_test.go
index 0bfdd9dc..059ecb7d 100644
--- a/integration/util_test.go
+++ b/integration/util_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package integration
 
 import (
diff --git a/lang/funcs/facts/func_test.go b/lang/funcs/facts/func_test.go
index 35e0657f..934cf136 100644
--- a/lang/funcs/facts/func_test.go
+++ b/lang/funcs/facts/func_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package facts
 
 import (
diff --git a/lang/funcs/funcs_test.go b/lang/funcs/funcs_test.go
index fbe7cfab..f447508d 100644
--- a/lang/funcs/funcs_test.go
+++ b/lang/funcs/funcs_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package funcs
 
 // most of the testing of this package is inside of the adjacent `facts` package
diff --git a/lang/interpolate_test.go b/lang/interpolate_test.go
index c6ea15a7..534c9728 100644
--- a/lang/interpolate_test.go
+++ b/lang/interpolate_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package lang
 
 import (
diff --git a/lang/interpret_test.go b/lang/interpret_test.go
index 40fd0f16..4929ea62 100644
--- a/lang/interpret_test.go
+++ b/lang/interpret_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package lang
 
 import (
diff --git a/lang/lang_test.go b/lang/lang_test.go
index 3a32d734..469db498 100644
--- a/lang/lang_test.go
+++ b/lang/lang_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package lang
 
 import (
diff --git a/lang/lexparse_test.go b/lang/lexparse_test.go
index 475581df..5a062f8d 100644
--- a/lang/lexparse_test.go
+++ b/lang/lexparse_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package lang
 
 import (
diff --git a/lang/types/type_test.go b/lang/types/type_test.go
index 6758c5b4..9e06edde 100644
--- a/lang/types/type_test.go
+++ b/lang/types/type_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package types
 
 import (
diff --git a/lang/types/value_test.go b/lang/types/value_test.go
index 78d006cf..6b73c37d 100644
--- a/lang/types/value_test.go
+++ b/lang/types/value_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package types
 
 import (
diff --git a/lang/unification_test.go b/lang/unification_test.go
index 8822dd8c..0d4f6378 100644
--- a/lang/unification_test.go
+++ b/lang/unification_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package lang
 
 import (
diff --git a/lib/main_test.go b/lib/main_test.go
index 7b9976df..0c477cb1 100644
--- a/lib/main_test.go
+++ b/lib/main_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package lib
 
 import (
diff --git a/pgraph/graphsync_test.go b/pgraph/graphsync_test.go
index 6cdb5c9e..14c427bd 100644
--- a/pgraph/graphsync_test.go
+++ b/pgraph/graphsync_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package pgraph
 
 import (
diff --git a/pgraph/pgraph_test.go b/pgraph/pgraph_test.go
index 9750adf3..751a7b5b 100644
--- a/pgraph/pgraph_test.go
+++ b/pgraph/pgraph_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package pgraph
 
 import (
diff --git a/pgraph/subgraph_test.go b/pgraph/subgraph_test.go
index 1aa04453..b73c813b 100644
--- a/pgraph/subgraph_test.go
+++ b/pgraph/subgraph_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package pgraph
 
 import (
diff --git a/pgraph/util_test.go b/pgraph/util_test.go
index 2f124264..9698c941 100644
--- a/pgraph/util_test.go
+++ b/pgraph/util_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package pgraph
 
 import (
diff --git a/prometheus/prometheus_test.go b/prometheus/prometheus_test.go
index 4b255f86..27cac0b2 100644
--- a/prometheus/prometheus_test.go
+++ b/prometheus/prometheus_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package prometheus
 
 import (
diff --git a/test.sh b/test.sh
index e2fe6523..6326d16b 100755
--- a/test.sh
+++ b/test.sh
@@ -63,11 +63,22 @@ if env | grep -q -e '^TRAVIS=true$' -e '^JENKINS_URL=' -e '^BUILD_TAG=jenkins';
 	run-testsuite ./test/test-gotest.sh --race
 	run-testsuite ./test/test-integration.sh
 	run-testsuite ./test/test-integration.sh --race
+
+	# XXX: fix and enable these on travis (sudo: go: command not found)
+	#run-testsuite ./test/test-gotest.sh --root
+	#run-testsuite ./test/test-gotest.sh --root --race
+	#run-testsuite ./test/test-integration.sh --root
+	#run-testsuite ./test/test-integration.sh --root --race
 else
 	REASON="CI server only test" skip-testsuite ./test/test-shell.sh
 	REASON="CI server only test" skip-testsuite ./test/test-gotest.sh --race
 	REASON="CI server only test" skip-testsuite ./test/test-integration.sh
 	REASON="CI server only test" skip-testsuite ./test/test-integration.sh --race
+
+	REASON="CI server only test" skip-testsuite ./test/test-gotest.sh --root
+	REASON="CI server only test" skip-testsuite ./test/test-gotest.sh --root --race
+	REASON="CI server only test" skip-testsuite ./test/test-integration.sh --root
+	REASON="CI server only test" skip-testsuite ./test/test-integration.sh --root --race
 fi
 
 run-testsuite ./test/test-gometalinter.sh
diff --git a/test/test-gotest.sh b/test/test-gotest.sh
index ba80679f..c03f1267 100755
--- a/test/test-gotest.sh
+++ b/test/test-gotest.sh
@@ -7,26 +7,38 @@ ROOT=$(dirname "${BASH_SOURCE}")/..
 cd "${ROOT}"
 . test/util.sh
 
+# if we want to run this test as root, use build tag -root to ask each test...
+XSUDO=''
+XTAGS=''
+if [[ "$@" = *"--root"* ]]; then
+	if ! timeout 1s sudo -A true; then
+		echo "sudo disabled: can't run as root"
+		exit 1
+	fi
+	XSUDO='sudo -E'
+	XTAGS='-tags root'
+fi
+
 failures=''
 function run-test()
 {
-	$@ || failures=$( [ -n "$failures" ] && echo "$failures\\n$@" || echo "$@" )
+	$XSUDO $@ || failures=$( [ -n "$failures" ] && echo "$failures\\n$@" || echo "$@" )
 }
 
 base=$(go list .)
 if [[ "$@" = *"--integration"* ]]; then
 	if [[ "$@" = *"--race"* ]]; then
-		run-test go test -race "${base}/integration" -v
+		GOCACHE=off run-test go test -race "${base}/integration" -v ${XTAGS}
 	else
-		run-test go test "${base}/integration" -v
+		GOCACHE=off run-test go test "${base}/integration" -v ${XTAGS}
 	fi
 else
 	for pkg in `go list -e ./... | grep -v "^${base}/vendor/" | grep -v "^${base}/examples/" | grep -v "^${base}/test/" | grep -v "^${base}/old" | grep -v "^${base}/old/" | grep -v "^${base}/tmp" | grep -v "^${base}/tmp/" | grep -v "^${base}/integration"`; do
 		echo -e "\ttesting: $pkg"
 		if [[ "$@" = *"--race"* ]]; then
-			run-test go test -race "$pkg"
+			GOCACHE=off run-test go test -race "$pkg" ${XTAGS}
 		else
-			run-test go test "$pkg"
+			GOCACHE=off run-test go test "$pkg" ${XTAGS}
 		fi
 	done
 fi
diff --git a/util/code_test.go b/util/code_test.go
index 4afffcfd..e68c2d97 100644
--- a/util/code_test.go
+++ b/util/code_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package util
 
 import (
diff --git a/util/home_test.go b/util/home_test.go
index f66eed99..f0727352 100644
--- a/util/home_test.go
+++ b/util/home_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package util
 
 import (
diff --git a/util/root_test.go b/util/root_test.go
new file mode 100644
index 00000000..e5b3e0bd
--- /dev/null
+++ b/util/root_test.go
@@ -0,0 +1,37 @@
+// Mgmt
+// Copyright (C) 2013-2018+ James Shubin and the project contributors
+// Written by James Shubin <james@shubin.ca> and the project contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// +build root
+
+package util
+
+import (
+	"os/user"
+	"testing"
+)
+
+func TestIsRoot(t *testing.T) {
+	u, err := user.Current()
+	if err != nil {
+		t.Errorf("error running user.Current(): %+v", err)
+		return
+	}
+	if u.Uid != "0" {
+		t.Errorf("expected uid 0, got: %s", u.Uid)
+		return
+	}
+}
diff --git a/util/util_test.go b/util/util_test.go
index ea4cca31..9bd6a633 100644
--- a/util/util_test.go
+++ b/util/util_test.go
@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !root
+
 package util
 
 import (