diff --git a/nova/flags.py b/nova/flags.py
index eb6366ed..7916501a 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -392,3 +392,6 @@ DEFINE_bool('start_guests_on_host_boot', False,
             'Whether to restart guests when the host reboots')
 DEFINE_bool('resume_guests_state_on_host_boot', False,
             'Whether to start guests, that was running before the host reboot')
+
+DEFINE_string('root_helper', 'sudo',
+              'Command prefix to use for running commands as root')
diff --git a/nova/tests/test_libvirt.py b/nova/tests/test_libvirt.py
index 17f1be96..2180cf4f 100644
--- a/nova/tests/test_libvirt.py
+++ b/nova/tests/test_libvirt.py
@@ -921,18 +921,18 @@ class IptablesFirewallTestCase(test.TestCase):
 #        self.fw.add_instance(instance_ref)
         def fake_iptables_execute(*cmd, **kwargs):
             process_input = kwargs.get('process_input', None)
-            if cmd == ('sudo', 'ip6tables-save', '-t', 'filter'):
+            if cmd == ('ip6tables-save', '-t', 'filter'):
                 return '\n'.join(self.in6_filter_rules), None
-            if cmd == ('sudo', 'iptables-save', '-t', 'filter'):
+            if cmd == ('iptables-save', '-t', 'filter'):
                 return '\n'.join(self.in_filter_rules), None
-            if cmd == ('sudo', 'iptables-save', '-t', 'nat'):
+            if cmd == ('iptables-save', '-t', 'nat'):
                 return '\n'.join(self.in_nat_rules), None
-            if cmd == ('sudo', 'iptables-restore'):
+            if cmd == ('iptables-restore',):
                 lines = process_input.split('\n')
                 if '*filter' in lines:
                     self.out_rules = lines
                 return '', ''
-            if cmd == ('sudo', 'ip6tables-restore'):
+            if cmd == ('ip6tables-restore',):
                 lines = process_input.split('\n')
                 if '*filter' in lines:
                     self.out6_rules = lines
diff --git a/nova/tests/test_volume.py b/nova/tests/test_volume.py
index c0f89601..7888b6b0 100644
--- a/nova/tests/test_volume.py
+++ b/nova/tests/test_volume.py
@@ -414,8 +414,9 @@ class ISCSITestCase(DriverTestCase):
         self.mox.StubOutWithMock(self.volume.driver, '_execute')
         for i in volume_id_list:
             tid = db.volume_get_iscsi_target_num(self.context, i)
-            self.volume.driver._execute("sudo", "ietadm", "--op", "show",
-                                        "--tid=%(tid)d" % locals())
+            self.volume.driver._execute("ietadm", "--op", "show",
+                                        "--tid=%(tid)d" % locals(),
+                                        run_as_root=True)
 
         self.stream.truncate(0)
         self.mox.ReplayAll()
@@ -433,8 +434,9 @@ class ISCSITestCase(DriverTestCase):
         # the first vblade process isn't running
         tid = db.volume_get_iscsi_target_num(self.context, volume_id_list[0])
         self.mox.StubOutWithMock(self.volume.driver, '_execute')
-        self.volume.driver._execute("sudo", "ietadm", "--op", "show",
-                                    "--tid=%(tid)d" % locals()).AndRaise(
+        self.volume.driver._execute("ietadm", "--op", "show",
+                                    "--tid=%(tid)d" % locals(),
+                                    run_as_root=True).AndRaise(
                                             exception.ProcessExecutionError())
 
         self.mox.ReplayAll()
diff --git a/nova/tests/test_xenapi.py b/nova/tests/test_xenapi.py
index 952277e3..1deb5a78 100644
--- a/nova/tests/test_xenapi.py
+++ b/nova/tests/test_xenapi.py
@@ -548,8 +548,8 @@ class XenAPIVMTestCase(test.TestCase):
             return '', ''
 
         fake_utils.fake_execute_set_repliers([
-            # Capture the sudo tee .../etc/network/interfaces command
-            (r'(sudo\s+)?tee.*interfaces', _tee_handler),
+            # Capture the tee .../etc/network/interfaces command
+            (r'tee.*interfaces', _tee_handler),
         ])
         self._test_spawn(glance_stubs.FakeGlance.IMAGE_MACHINE,
                          glance_stubs.FakeGlance.IMAGE_KERNEL,
@@ -592,9 +592,9 @@ class XenAPIVMTestCase(test.TestCase):
             return '', ''
 
         fake_utils.fake_execute_set_repliers([
-            (r'(sudo\s+)?mount', _mount_handler),
-            (r'(sudo\s+)?umount', _umount_handler),
-            (r'(sudo\s+)?tee.*interfaces', _tee_handler)])
+            (r'mount', _mount_handler),
+            (r'umount', _umount_handler),
+            (r'tee.*interfaces', _tee_handler)])
         self._test_spawn(1, 2, 3, check_injection=True)
 
         # tee must not run in this case, where an injection-capable