I'm thinking to start making apparmor profiles for my server, but before I start, I want to make sure that I'm doing in a right way.
So, I'm thinking to begin with
apache2 profiling. Right now I'm running couple of websites and some of non-default apache modules like
aa-status, there are already some of default profiles:
/usr/sbin/clamd /usr/sbin/mysqld /usr/sbin/named /usr/sbin/tcpdump
So if I fire
aa-genprof apache2, it will return:
Profiling: /usr/sbin/apache2 [(S)can system log for AppArmor events] / (F)inish
What should I do after that, restart apache, browse on my sites in order to catch apache movement?