Don't call setgroups() unless root