I'm trying to write an apparmor profile to protect against windows malware run via wine. As I understand it, unless wine is run as root, it's not possible for windows apps to modify system files, but I'd like to further confine windows programs to just ~/.wine to protect user files, so that windows programs:
1) Cannot be run unless placed in the wine c drive
2) When run, cannot see or interact with any files outside of those in ~/.wine
I've read this page and it looks like the section about running all programs under wine-loader and wineserver profiles is what I'm looking for, but because I haven't tinkered with apparmor before I'd like to make sure that's actually the approach I should be using, and what changes I might need to make to the example profile there to make it work.