This is an updated version of my previous patch set, with the fourth patch removed. This is rebased on current v17-dev and includes Serge's recommended changes to may_setgid().