Comment 2 for bug 528274

Here's a profile that works for me -- likely will need to be tuned for new user directory creation, but that should be trivial.

This should ship in the package in /etc/apparmor.d and gain the appropriate maintainer-script stanzas to activate the profile on install. For more details see:
https://help.ubuntu.com/community/AppArmor#Creating%20a%20new%20profile