From f77cd14b488fb1b62ae5a6c5c2b85c2c346f5e46 Mon Sep 17 00:00:00 2001
From: "Gregory P. Smith" <68491+gpshead@users.noreply.github.com>
Date: Sun, 5 Apr 2026 11:07:07 -0700
Subject: [PATCH] gh-94632: document the subprocess need for extra_groups=()
 with user= (GH-148129) (cherry picked from commit
 a1cf4430ed89ec702528ef074138c407ccf89946)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
---
 Doc/library/subprocess.rst | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Doc/library/subprocess.rst b/Doc/library/subprocess.rst
index 755ff4c6f0f23f..552af2ac9d3047 100644
--- a/Doc/library/subprocess.rst
+++ b/Doc/library/subprocess.rst
@@ -630,6 +630,12 @@ functions.
    the value in ``pw_uid`` will be used. If the value is an integer, it will
    be passed verbatim. (POSIX only)
 
+   .. note::
+
+      Specifying *user* will not drop existing supplementary group memberships!
+      The caller must also pass ``extra_groups=()`` to reduce the group membership
+      of the child process for security purposes.
+
    .. availability:: POSIX
    .. versionadded:: 3.9