noroot removes all user groups, nogroups redundant

[neirenoir]

I'm not sure if it is intended behaviour, but setting noroot as an option will remove all of the user's groups, regardless of whether nogroups is present or not. Right now, I had to configure the profile of a program to ignore both nogroups and noroot, but I could have done away ignoring only nogroups: I need some of my user's groups, but I don't need the program knowing about the existence of users other than mine, including root.

Could noroot be implemented in such a way that it does not overlap with nogroups, so I can set them both independently, or does noroot necessarily require the removal of other groups?

[rusty-snake]

$ groups
rusty-snake wheel games wireshark
$ firejail --noprofile groups
rusty-snake wheel games wireshark
$ firejail --noprofile --nogroups groups
rusty-snake
$ firejail --noprofile --noroot groups
rusty-snake games

😕 , there are exceptions for tty, audio, video, games.

firejail/src/firejail/util.c

Line 63 in ec0a097

static void clean_supplementary_groups(gid_t gid) {

IMHO the best would be that #2042 also applies to noroot.