SystemCallFilter=~setgroups

HI! With the recent Tumbleweed updates some of my systemd units with SystemCallFilter= did not work anymore. It turned out that setgroups(2) in @privileged was the culprit. But I wonder which change is now triggering the use of setgroups(2). Because these processes are not configured to tweak their supplementary group IDs. Anything ringing a bell? (Yes, I will write a ticket *after* I have at least some clue what to write in there.) Ciao, Michael.