Oops -- have to call setgroups() before giving up root.