static void clean_supplementary_groups(gid_t gid) {
	assert(cfg.username);
	gid_t groups[MAX_GROUPS];
	int ngroups = MAX_GROUPS;

	if (arg_nogroups && check_can_drop_all_groups()) {
		if (setgroups(0, NULL) < 0)
			errExit("setgroups");
		if (arg_debug)
			printf("No supplementary groups\n");
		return;
	}

	int rv = getgrouplist(cfg.username, gid, groups, &ngroups);
	if (rv == -1)
		goto clean_all;

	// clean supplementary group list
	gid_t new_groups[MAX_GROUPS];
	int new_ngroups = 0;
	char *allowed[] = {
		"firejail",
		"tty",
		"games",
		NULL
	};

	int i = 0;
	while (allowed[i]) {
		copy_group_ifcont(allowed[i], groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
		i++;
	}

	if (!arg_nosound) {
		copy_group_ifcont("audio", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_novideo) {
		copy_group_ifcont("video", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_no3d) {
		copy_group_ifcont("render", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
		copy_group_ifcont("vglusers", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_noprinters) {
		copy_group_ifcont("lp", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_nodvd) {
		copy_group_ifcont("cdrom", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
		copy_group_ifcont("optical", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_noinput) {
		copy_group_ifcont("input", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (new_ngroups) {
		rv = setgroups(new_ngroups, new_groups);
		if (rv)
			goto clean_all;

		if (arg_debug) {
			printf("Supplementary groups: ");
			for (i = 0; i < new_ngroups; i++)
				printf("%d ", new_groups[i]);
			printf("\n");
		}
	}
	else
		goto clean_all;

	return;

clean_all:
	fwarning("cleaning all supplementary groups\n");
	if (setgroups(0, NULL) < 0)
		errExit("setgroups");
}
static void clean_supplementary_groups(gid_t gid) {
	assert(cfg.username);
	gid_t groups[MAX_GROUPS];
	int ngroups = MAX_GROUPS;

	if (arg_nogroups && check_can_drop_all_groups()) {
		if (setgroups(0, NULL) < 0)
			errExit("setgroups");
		if (arg_debug)
			printf("No supplementary groups\n");
		return;
	}

	int rv = getgrouplist(cfg.username, gid, groups, &ngroups);
	if (rv == -1)
		goto clean_all;

	 
	gid_t new_groups[MAX_GROUPS];
	int new_ngroups = 0;
	char *allowed[] = {
		"firejail",
		"tty",
		"games",
		NULL
	};

	int i = 0;
	while (allowed[i]) {
		copy_group_ifcont(allowed[i], groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
		i++;
	}

	if (!arg_nosound) {
		copy_group_ifcont("audio", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_novideo) {
		copy_group_ifcont("video", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_no3d) {
		copy_group_ifcont("render", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
		copy_group_ifcont("vglusers", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_noprinters) {
		copy_group_ifcont("lp", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_nodvd) {
		copy_group_ifcont("cdrom", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
		copy_group_ifcont("optical", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (!arg_noinput) {
		copy_group_ifcont("input", groups, ngroups,
		                  new_groups, &new_ngroups, MAX_GROUPS);
	}

	if (new_ngroups) {
		rv = setgroups(new_ngroups, new_groups);
		if (rv)
			goto clean_all;

		if (arg_debug) {
			printf("Supplementary groups: ");
			for (i = 0; i < new_ngroups; i++)
				printf("%d ", new_groups[i]);
			printf("\n");
		}
	}
	else
		goto clean_all;

	return;

clean_all:
	fwarning("cleaning all supplementary groups\n");
	if (setgroups(0, NULL) < 0)
		errExit("setgroups");
}