Apparmor recorder allows extra capabilities in the profile which doesn't seem to be required

[ccojocar]

What happened:

The apparmor recorder apparently allows extra capabilities in the profile such as sys_admin and setpcap for nginx container when recording an apparmor profile. It seems that these capabilities are not required.

What you expected to happen:

Allow in the Apparmor profile only the minimum required capabilities.

How to reproduce it (as minimally and precisely as possible):

Record an apparmor profile for nginx container image, and check the recorded capabilities in the corresponding CR.

Anything else we need to know?:

Environment:

• Cloud provider or hardware configuration: GKE
• OS (e.g: cat /etc/os-release): COS
• Kernel (e.g. uname -a):
• Others:

[ccojocar]

cc @mhils