Groups not dropped before running subprocess when using empty 'extra_groups' parameter

...