Currently, if you use su and only give it a user (not a group too), it results in an error like this:

error: error switching euid to 2048 and egid to -1: Invalid argument

It's not at all obvious what the problem is here. Instead, we should do one of three things if a group isn't specified:

1. Give an error that says "su requires both a user and a group, but only a user was specified", or something to that effect
2. Default to using the specified user's primary group
3. Just leave the egid alone and only switch the euid

If you let me know which approach you prefer, I can make a PR for it.