gh-94632: document the subprocess need for extra_groups=() with user= (GH-148129)

diff --git a/Doc/library/subprocess.rst b/Doc/library/subprocess.rst
index 9e261a0ca039023af2db4d3b1428d81fbf0919d8..fe64daa3291d67033b85a1dc178f86473fa5c692 100644 (file)
--- a/Doc/library/subprocess.rst
+++ b/Doc/library/subprocess.rst
@@ -627,6 +627,12 @@ functions.
    the value in ``pw_uid`` will be used. If the value is an integer, it will
    be passed verbatim. (POSIX only)
 
+   .. note::
+
+      Specifying *user* will not drop existing supplementary group memberships!
+      The caller must also pass ``extra_groups=()`` to reduce the group membership
+      of the child process for security purposes.
+
    .. availability:: POSIX
    .. versionadded:: 3.9