ST> Apparently access() restricts itself to the real gid, without ST> including supplementary group IDs.
As IEEE 1003.1:2004 says, at least by omission, it should. There's no mention of supplementary group IDs in the definition of the access() call. This isn't a particularly well-specified aspect of the call, so it's somewhat misleading to classify this as a non-conformance. There's nothing in the standard requiring such behaviour in the first place. Indeed, there's extensive discussion in the Rationale of the difficulties of standardizing supplementary group IDs, which should be read before one makes definite claims about which of the supplementary group IDs are the ones that should be employed by access(). Implementations are permitted to make one of them the effective GID, which access() is required *not* to use.
