Call setgroups() before setgid() to drop supplementary groups.