Per issue 7900, os.getgroups on OSX does not behave the same way as on any other unix platform. This seems worthy of a documentation note, since anyone trying to write portable code could get bit by this. I don't really understand the relationship on OSX between what the current os.getgroups returns, what the normal unix os.getgroups returns, and what things a process can actually *do*, so I can't write that documentation. Hopefully someone else can. A doc note is probably also needed about the relationship between os.setgroups and os.getgroups on OSX, which again I do not understand and so cannot write.
I do understand the issue, but I'm not sure if I can write it down consisely. I've attached an initial attempt (patch is relative to the default branch, I'll port to 2.7 and 3.2 if it looks OK)
Here's a revised doc patch. As noted from my investigation in Issue7900, the key getgroups behavior change is with the OS X 10.6 ABI (so > 10.5), not 10.5.
