Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 208

To use a single Novell AppArmor profile for all Web pages and CGI scripts served by
Apache, a good approach is to edit the DEFAULT_URI subprofile.
20.4.2 Immunizing Network Agents
To find network server daemons and network clients (such as fetchmail, Firefox, amaroK
or Banshee) that should be profiled, you should inspect the open ports on your machine,
consider the programs that are answering on those ports, and provide profiles for as
many of those programs as possible. If you provide profiles for all programs with open
network ports, an attacker cannot get to the file system on your machine without passing
through a Novell AppArmor profile policy.
Scan your server for open network ports manually from outside the machine using a
scanner, such as nmap, or from inside the machine using the netstat --inet -n
-p command. Then inspect the machine to determine which programs are answering
on the discovered open ports.
TIP
Refer to the man page of the netstat command for a detailed reference of
all possible options.
196 Security Guide