Don't we have to apply the apparmor profile before we drop caps to make sure we have permission to even apply it?