naparuba/shinken — pull request #1335 by dhozac (2014-09-30 05:21:13+00:00)
Title: Set supplementary groups to avoid running daemons as %wheel

If you don't drop your supplementary groups, you still have significant access. The wheel group will quite often have unrestricted sudo. os.initgroups isn't available on Python <2.7, so RHEL <7 (and I'm sure other similar distributions) would also be affected by this.

In addition, this means that you can make shinken a member of the nagios group to give it access to the plugins like check_icmp that are setuid root but only the nagios group can run them.