Make ceoquery non-SUID