AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy

[madaidan]

Use environment scrubbing everywhere except /lib

Following Restrict root access - #104 by madaidan, this isn’t nearly as restrictive as I thought but it’s still better than nothing.