Comment # 2 on bug 1095670 from Jan Ritzerfeld

POS36-C: "Consequently, it is recommended that a program relinquish
supplementary group IDs immediately before relinquishing root privileges."
rpmlint warns about a missing-call-to-setgroups-before-setuid.