call setgroups before setgid