Jon,
What are your patches? What do they do? I made some changes to nsmain.c to make sure that:
- user is valid
- group is valid
- root group wasn't used (root user is already checked)
- user in group, even if not the main group
I offered the patch to the core team (hmm, I'm on that) but it hasn't been applied.