fix --group

Syscalls weren't actually being enabled.