The default guest user can't read the home directory and its contents, but it can read the root directory and other directories with the same permissions as home. So, where is this particular limitation specified?
The package used to handle the restricted permissions for the guest session is AppArmor.
(From the Ubuntu Server Guide)
It utilizes so called "profiles" to permit/deny access to files/directories, the network,...
Those profiles are stored under