AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy

[Patrick]

@madaidan

I can make a compromise. /opt can be read-write for the user’s own programs while /usr/bin and other will be read-only.

Question: What about software installation to home folder?
(Related to noexec - (re-)mount home [and other?] with noexec (and nosuid [among other useful mount options]) for better security?)