Replace the nologin shell script with a tiny c version. Just for the sake