I'm probably being extremely dense at the moment, but the program below doesn't behave as I'd expect on OSX:

#include <unistd.h>

int main(void)
{
#if 1
	gid_t gids[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20 };
	int r;
	r = setgroups(16, gids);
	if (r == -1) {
		perror("setgroups");
		return 1;
	}
#endif
	setgid(3);
	setuid(502);
	execl("/usr/bin/id", "/usr/bin/id", NULL);
	perror("exec");
	return 1;
}


I'd expect it to print something simular to this (when started as root, either through sudo or by logging in as root):

uid=502 gid=3(sys) groups=1(bin),2(daemon),3(sys),4,5(tty),6(disk),7(lp),8(www),9(kmem),10(wheel),11,12(mail),13(news),14(uucp),15(shadow),16(dialout)

That doesn't happen however, the output above is from a linux system. On OSX it prints the group information that's associated with the 502 account in the user database, and only prints the expected values when I call setuid(600), which is a UID that isn't in use on my system.

This is both with and without setting _DARWIN_C_SOURCE and even when compiling with deployment target 10.4 and using the 10.4 SDK.

I'm therefore in favor of keeping _DARWIN_C_SOURCE and adding the workaround for a larger number of groups as implemented in os-getgroups.patch.

This means that using