Drop group privileges after opening the kvm descriptor, otherwise, the code
would not drop privileges as expected.

While there also add checks for the drop and bail out immediately if we
failed.

MFC after: 3 days