---
 mcelog.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/mcelog.c
+++ b/mcelog.c
@@ -37,6 +37,7 @@
 #include <assert.h>
 #include <signal.h>
 #include <pwd.h>
+#include <grp.h>
 #include <sys/wait.h>
 #include <fnmatch.h>
 #include "mcelog.h"
@@ -1284,6 +1285,14 @@
 
 static void drop_cred(void)
 {
+	/* When dropping privileges from root, the `setgroups` call will
+	 * remove any extraneous groups. If we don't call this, then
+	 * even though our uid has dropped, we may still have groups
+	 * that enable us to do super-user things. This will fail if we
+	 * aren't root, so don't bother checking the return value, this
+	 * is just done as an optimistic privilege dropping function.
+	 */
+	setgroups(0, NULL);
 	if (runcred.uid != -1U && runcred.gid == -1U) {
 		struct passwd *pw = getpwuid(runcred.uid);
 		if (pw)