One more thing. Your question regarding apparmor; It is uninstalled. That subsystem seems to cause a lot more problems than it fixes, IMHO. I'm sure it has a place, but not on a closed and tightly monitored system such as those I administer.
I'd agree with that sentiment. I'm glad you've got ZCS working.