Setup apparmor for xserver.

playbooks/roles/xserver/files/01-sandbox

+makeitso ALL=(sandbox) NOPASSWD:/usr/bin/python-sandbox

playbooks/roles/xserver/files/sandbox.conf

+sandbox       hard   core  0
+sandbox       hard   data  100000
+sandbox       hard   fsize 10000
+sandbox       hard   memlock 10000
+sandbox       hard   nofile 20
+sandbox       hard   rss    10000
+sandbox       hard   stack  100000
+sandbox       hard   cpu    0
+sandbox       hard   nproc  8
+sandbox       hard   as     32000
+sandbox       hard   maxlogins  1
+sandbox       hard   priority  19
+sandbox       hard   locks     4
+sandbox       hard   sigpending  100
+sandbox       hard   msgqueue  100000
+sandbox       hard   nice     19

playbooks/roles/xserver/files/usr.bin.python-sandbox

+#include <tunables/global>
+
+/usr/bin/python-sandbox {
+  #include <abstractions/base>
+
+  /usr/bin/python-sandbox mr,
+  /usr/include/python2.7/** r,
+  /usr/local/lib/python2.7/** r,
+  /usr/lib/python2.7** rix,
+
+  /tmp/** rix,
+}
+

playbooks/roles/xserver/tasks/main.yml

 # Provision and bring up xserver
 ---
 
+- name: ensure sandbox group exists
+  group: name=sandbox
+
+- name: ensure sandbox user exists
+  user: name=sandbox group=sandbox
+
+- name: create sandbox python
+  shell: cp /usr/bin/python2.7 /usr/bin/python-sandbox
+
+- name: set sandbox sudoers settings
+  copy: src=01-sandbox dest=/etc/sudoers.d/01-sandbox
+
+# Make sure this line is in the common-session file.
+- name: ensure pam-limits module is loaded
+  lineinfile:
+    dest=/etc/pam.d/common-session
+    regexp="session required pam_limits.so"
+    line="session required pam_limits.so"
+
+- name: set sandbox limits
+  copy: src=sandbox.conf dest=/etc/security/limits.d/sandbox.conf
+
+- name: ensure apparmor package
+  apt: pkg=apparmor-utils state=present
+
+- name: load python-sandbox apparmor profile
+  copy: src=usr.bin.python-sandbox dest=/etc/apparmor.d/usr.bin.python-sandbox
+
+- name: enforce app-armor rules
+  shell: aa-enforce /usr/bin/python-sandbox
+
 - include: deploy.yml