Cursor AppArmor profile prevents root from killing stuck cursorsandbox process

Support Bug Reports
, , ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Cursor starts agent shell tool calls via:
/usr/share/cursor/resources/app/resources/helpers/cursorsandbox

A tool call got stuck. The process was owned by my user, but sudo kill failed:
sudo kill
kill: (): Permission denied

Process details:

  • AppArmor: cursor_sandbox (enforce)
  • NoNewPrivs: 1
  • Seccomp: 2
  • uid_map: 0 1000 1
    /proc//attr/current:
    cursor_sandbox (enforce)

The command inside the sandbox was just:
helm show values oci://registry-1.docker.io/bitnamicharts/kube-prometheus --version 11.3.10

Workaround:
Add to /etc/apparmor.d/cursor-sandbox profiles:
signal (receive) peer=unconfined,
Then reload:
sudo apparmor_parser -r /etc/apparmor.d/cursor-sandbox

After that sudo kill works.

Steps to Reproduce

  1. Use Cursor on Linux with AppArmor enabled.
  2. Trigger any long-running or stuck agent shell tool call, for example a command that hangs inside Cursor’s shell tool execution.
  3. Find the spawned Cursor sandbox helper process:
    ps aux | grep ‘[c]ursorsandbox’
  4. Confirm it is confined by AppArmor:
    cat /proc//attr/current
    Output:
    cursor_sandbox (enforce)
  5. Try to terminate it as root:
    sudo kill -TERM
  6. Observe that kill fails with:
    kill: (): Permission denied

Expected Behavior

The machine owner/root user should always be able to terminate a local Cursor sandbox helper process

Operating System

Linux

Version Information

Version: 3.2.21
VSCode Version: 1.105.1
Commit: 806df57ed3b6f1ee0175140d38039a38574ec720
Date: 2026-05-03T01:46:14.413Z
Layout: editor
Build Type: Stable
Release Track: Default
Electron: 39.8.1
Chromium: 142.0.7444.265
Node.js: 22.22.1
V8: 14.2.231.22-electron.0
OS: Linux x64 6.17.0-23-generic

Does this stop you from using Cursor

No - Cursor works, but with this issue

8

This is a known bug. The AppArmor profile shipped with Cursor doesn’t include signal rules, so on Ubuntu 24.04+ (which enables signal mediation by default), signals from outside the sandbox boundary get blocked. Your workaround is exactly right.

Our team is tracking this and working on updating the profile. In the meantime, there are a few other options if you hit a stuck process:

  1. Kill the parent bwrap process (it’s in the host namespace, so it’s killable): pkill -9 bwrap

  2. Close the terminal tab in Cursor that started the process.

  3. Restart Cursor — all sandboxed processes will be cleaned up on exit.

  4. Disable the sandbox temporarily: Cursor Settings > Agents > Sandbox (removes the isolation layer entirely).

There’s also more discussion on this in a related thread. We will update that thread with the latest information, closing this one to ensure it’s well tracked.