Use setresuid/gid() directly to change user and group.  Otherwise
Suricata uses libcap-ng on Linux and runs as root elsewhere.

Index: src/suricata.c
--- src/suricata.c.orig
+++ src/suricata.c
@@ -1609,7 +1609,7 @@ static TmEcode ParseCommandLine(int argc, char** argv,
                 return TM_ECODE_FAILED;
 #endif /* UNITTESTS */
             } else if (strcmp((long_opts[option_index]).name, "user") == 0) {
-#ifndef HAVE_LIBCAP_NG
+#if 0
                 SCLogError("libcap-ng is required to"
                            " drop privileges, but it was not compiled into Suricata.");
                 return TM_ECODE_FAILED;
@@ -1618,7 +1618,7 @@ static TmEcode ParseCommandLine(int argc, char** argv,
                 suri->do_setuid = TRUE;
 #endif /* HAVE_LIBCAP_NG */
             } else if (strcmp((long_opts[option_index]).name, "group") == 0) {
-#ifndef HAVE_LIBCAP_NG
+#if 0
                 SCLogError("libcap-ng is required to"
                            " drop privileges, but it was not compiled into Suricata.");
                 return TM_ECODE_FAILED;
@@ -3055,6 +3055,7 @@ int SuricataMain(int argc, char **argv)
         SystemHugepageSnapshotDestroy(prerun_snap);
         SystemHugepageSnapshotDestroy(postrun_snap);
     }
+    SCSetUserID(suricata.userid, suricata.groupid);
     SCPledge();
     SuricataMainLoop(&suricata);
 
