It's better to have sudo ask for a password upfront than letting the
wrapper start children which might lead to entangled sudo prompt and
log lines.