Two additional blockers on Ubuntu 24.04 (kernel 6.14, AppArmor 4.0) that aren’t covered above. Even with network, signal, and userns fixed as described, the sandbox still won’t start without addressing these.
1. Missing dac_override capability
The suggested profile lists sys_admin, net_admin, chown, setuid, setgid, setpcap — but newuidmap and newgidmap also need dac_override to write to /proc/[pid]/uid_map and /proc/[pid]/gid_map. Without it, UID/GID mapping fails and the namespace can’t be set up. This shows up in dmesg as:
apparmor="DENIED" operation="capable" class="cap" profile="cursor_sandbox"
comm="newuidmap" capability=1 capname="dac_override"
Adding capability dac_override, to the profile fixes it. Or use blanket capability, — the profile already grants file, and /** ix, so selective capability restrictions don’t meaningfully reduce the attack surface.
2. No AppArmor profile for the main Cursor binary (unprivileged_userns)
This is a separate failure mode from the cursor_sandbox profile issues. Ubuntu 24.04 ships a system-wide unprivileged_userns AppArmor profile (/etc/apparmor.d/unprivileged_userns) that restricts user namespace creation. When an unconfined process creates a user namespace, it transitions to this profile, which denies sys_admin.
The cursor_sandbox profile only covers the helper binary at /usr/share/cursor/resources/app/resources/helpers/cursorsandbox. The main Electron binary at /usr/share/cursor/cursor has no profile — it runs unconfined and gets caught by unprivileged_userns:
apparmor="DENIED" operation="capable" class="cap" profile="unprivileged_userns"
comm="cursor" capability=21 capname="sys_admin"
Neither the cursor .deb nor the cursor-sandbox-apparmor companion package installs a profile for this binary. The fix is to create /etc/apparmor.d/cursor:
abi <abi/4.0>,
profile cursor /usr/share/cursor/cursor flags=(unconfined) {
userns,
}
This is the same pattern Docker Desktop uses on Ubuntu. It prevents the transition to unprivileged_userns without changing what Cursor can otherwise do — it was already running unconfined.
Upgrade overwrite
As a note for anyone who gets this working: /etc/apparmor.d/cursor-sandbox is owned by the cursor package, so every .deb upgrade overwrites your patched profile. The upgrade doesn’t reload the profile afterward either, so the old (now incorrect) profile stays in kernel memory. Cursor then silently falls back to unsandboxed execution with no warning — as @fscm44xyz noted, a clear diagnostic on failure would be much better than silent fallback.
chattr +i on the file (as suggested above) prevents the overwrite. Otherwise, re-patch and reload after each upgrade:
sudo apparmor_parser -r /etc/apparmor.d/cursor-sandbox
sudo apparmor_parser -r /etc/apparmor.d/cursor