Merge "ref/services/groups: a command-line client for interacting with the group server"
diff --git a/runtime/internal/rpc/client.go b/runtime/internal/rpc/client.go
index 8b74229..d7aa5b8 100644
--- a/runtime/internal/rpc/client.go
+++ b/runtime/internal/rpc/client.go
@@ -911,7 +911,7 @@
 		return fc.close(berr)
 	}
 	if fc.response.Error != nil {
-		return verror.New(verror.ErrBadProtocol, fc.ctx, fc.response.Error)
+		return fc.response.Error
 	}
 	if fc.response.EndStreamResults {
 		// Return EOF to indicate to the caller that there are no more stream
diff --git a/services/device/devicex b/services/device/devicex
index 56849a5..12625d9 100755
--- a/services/device/devicex
+++ b/services/device/devicex
@@ -86,10 +86,11 @@
   if [[ "${devmgr_user}" == $(whoami) ]]; then
     "$@"
   else
-    sudo -u "${devmgr_user}" \
-      V23_NAMESPACE="${V23_NAMESPACE}" \
-      V23_DEVICE_DIR="${V23_DEVICE_DIR}" \
-      "$@"
+    # We use sudo/su rather than just sudo -u because the latter is often
+    # set up to require a password in common GCE and EC2 images.
+    sudo V23_NAMESPACE="${V23_NAMESPACE}"  V23_DEVICE_DIR="${V23_DEVICE_DIR}" \
+      su "${devmgr_user}" -s /bin/bash -c \
+      "$*"
   fi
 }