The dnsmasq package in the network project finally contains a patch to initialize the supplementary groups. Please review and test before I submit it to Factory.