diff --git a/nova/tests/unit/test_utils.py b/nova/tests/unit/test_utils.py
index ca6465d7..76468267 100644
--- a/nova/tests/unit/test_utils.py
+++ b/nova/tests/unit/test_utils.py
@@ -197,6 +197,17 @@ class GenericUtilsTestCase(test.NoDBTestCase):
         self.assertEqual(
             value, utils.get_hash_str(base_str))
 
+    def test_use_rootwrap(self):
+        self.flags(disable_rootwrap=False, group='workarounds')
+        self.flags(rootwrap_config='foo')
+        cmd = utils._get_root_helper()
+        self.assertEqual('sudo nova-rootwrap foo', cmd)
+
+    def test_use_sudo(self):
+        self.flags(disable_rootwrap=True, group='workarounds')
+        cmd = utils._get_root_helper()
+        self.assertEqual('sudo', cmd)
+
 
 class MonkeyPatchTestCase(test.NoDBTestCase):
     """Unit test for utils.monkey_patch()."""
diff --git a/nova/utils.py b/nova/utils.py
index b1fc3b73..30c68d25 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -92,6 +92,11 @@ Please use with care!
 Document the BugID that your workaround is paired with."""
 
 workarounds_opts = [
+    cfg.BoolOpt('disable_rootwrap',
+                default=False,
+                help='This option allows a fallback to sudo for performance '
+                     'reasons. For example see '
+                     'https://bugs.launchpad.net/nova/+bug/1415106'),
     ]
 CONF = cfg.CONF
 CONF.register_opts(monkey_patch_opts)
@@ -171,7 +176,11 @@ def vpn_ping(address, port, timeout=0.05, session_id=None):
 
 
 def _get_root_helper():
-    return 'sudo nova-rootwrap %s' % CONF.rootwrap_config
+    if CONF.workarounds.disable_rootwrap:
+        cmd = 'sudo'
+    else:
+        cmd = 'sudo nova-rootwrap %s' % CONF.rootwrap_config
+    return cmd
 
 
 def execute(*cmd, **kwargs):