Where does the bug appear (feature/product)?
Cursor IDE
Describe the Bug
Cursor fails to establish Remote-SSH connections on AppArmor-enabled systems due to missing signal permissions between cursor-system and cursor_sandbox.
Environment
Linux with AppArmor enabled (enforce mode)
Cursor (Linux packaged build)
AppArmor profiles: cursor-system, cursor_sandbox
Symptoms
Remote-SSH does not attempt to connect or hangs silently
No obvious user-facing error
Works temporarily if cursor_sandbox is set to complain mode
Steps to Reproduce
Upgrade to Cursor 2.4.22 via debian package. Use an extension like Remote-SSH. Start cursor.
Expected Behavior
It should connect to the remote system. Instead, it just hangs without trying to connect.
Operating System
Linux
Version Information
Version: 2.4.22
VSCode Version: 1.105.1
Commit: 618c607a249dd7fd2ffc662c6531143833bebd40
Date: 2026-01-26T22:51:47.692Z
Build Type: Stable
Release Track: Default
Electron: 39.2.7
Chromium: 142.0.7444.235
Node.js: 22.21.1
V8: 14.2.231.21-electron.0
OS: Linux x64 6.17.0-8-generic
Additional Information
Ubuntu 24.10
The cursor_sandbox AppArmor profile lacks explicit permission to send/receive signals to/from the cursor-system profile. This prevents proper supervision and lifecycle management of sandboxed helper processes, blocking Remote-SSH initialization.
Kernel logs show repeated AppArmor signal mediation events between the two profiles.
apparmor=“ALLOWED” operation=“signal”
profile=“cursor_sandbox” peer=“cursor-system”
signal=term
Does this stop you from using Cursor
Yes - Cursor is unusable
Fix / Workaround
Add explicit signal permissions to the cursor_sandbox profile:
signal (send, receive) peer=cursor-system,
Reload AppArmor profiles and restart Cursor.
After this change, Cursor functions correctly in enforce mode (no aa-complain required).
Hi, can you tell us what distro + version you are using and the output of uname -ar? Also, is Cursor installed on the remote machine?
Laptop:
Ubuntu 24.10
Linux asmith-t15 6.17.0-8-generic #8-Ubuntu SMP PREEMPT_DYNAMIC Fri Nov 14 21:44:46 UTC 2025 x86_64 GNU/Linux
Desktop:
Ubuntu 24.04.2
Linux asmith-desktop2 6.11.0-26-generic #26~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 17 19:20:47 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
The desktop only has the cursor server components automatically installed by Remote-SSH, plus cursor-agent. All changes were implemented only on the laptop. After fixing the AppArmor profile, I had to pkill -f cursor on the desktop so that cursor on the laptop could install the upgraded server components.
Here are the contents of my cursor apparmor profiles after my changes:
/etc/apparmor.d/cursor-sandbox:
profile cursor_sandbox /usr/share/cursor/resources/app/resources/helpers/cursorsandbox flags=(complain) {
file,
/** ix,
capability sys_admin,
capability chown,
capability setuid,
capability setgid,
capability setpcap,
userns,
mount,
remount,
umount,
# REQUIRED: allow Cursor to manage sandbox lifecycle
signal (send, receive) peer=cursor-system,
# Allow binary execution and mapping
/usr/share/cursor/resources/app/resources/helpers/cursorsandbox mr,
}
/etc/apparmor.d/cursor-system:
abi <abi/4.0>,
include <tunables/global>
profile cursor-system /usr/share/cursor/** flags=(unconfined) {
userns,
include if exists <local/cursor>
}
So, for the moment, the solution to this issue is to install the Cursor Linux desktop app on the remote (you don’t have to use it remotely, just install it). It comes with the AppArmor profile necessary for both local use and remote SSH. (I realize this is annoying on a server because it will pull in a bunch of deps)
In the future (once I make a better download URL for it), we will have a package that just installs the profile, and Cursor will advise you if you need it. We can’t install it automatically as part of the Remote SSH connection, because we don’t have the privileges to do so (good!) - you need to sudo to write to /etc/apparmor.d
1 Like
Issue persists in the latest deb:
Version: 2.4.28
VSCode Version: 1.105.1
Commit: f3f5cec40024283013878b50c4f9be4002e0b580
Date: 2026-02-03T00:56:18.293Z
Build Type: Stable
Release Track: Default
Electron: 39.2.7
Chromium: 142.0.7444.235
Node.js: 22.21.1
V8: 14.2.231.21-electron.0
OS: Linux x64 6.17.0-12-generic
Issue persists in the latest deb:
Version: 2.4.31
VSCode Version: 1.105.1
Commit: 3578107fdf149b00059ddad37048220e41681000
Date: 2026-02-08T07:42:24.999Z
Build Type: Stable
Release Track: Default
Electron: 39.2.7
Chromium: 142.0.7444.235
Node.js: 22.21.1
V8: 14.2.231.21-electron.0
OS: Linux x64 6.17.0-12-generic
Installing on the remote isn’t an option for me as it is locked down by the admin folks. I’ll need to continue modifying the apparmor profile for the sandbox.