This is a known issue on Ubuntu 24.04+ and related distros like Kubuntu, Zorin OS, and Linux Mint. AppArmor blocks unprivileged user namespaces by default on kernel 6.2+, and Cursor’s terminal sandbox needs them.
Step 1 - Check what AppArmor is blocking:
grep -R "Failed to apply sandbox" ~/.config/Cursor/logs | tail -n 20
sudo journalctl -k -b --since "5 minutes ago" --no-pager | grep -iE 'apparmor="DENIED"|cursor_sandbox'
Step 2 - Install the AppArmor profile package latest version:
curl -fsSL https://downloads.cursor.com/lab/enterprise/cursor-sandbox-apparmor_0.6.0_all.deb -o cursor-sandbox-apparmor.deb
sudo dpkg -i cursor-sandbox-apparmor.deb
Step 3 - If the sandbox still fails, the shipped profile is probably missing rules. Add them like this:
sudo install -d -m 0755 /etc/apparmor.d/local
sudo tee /etc/apparmor.d/local/cursor-sandbox > /dev/null <<'EOF'
userns,
network netlink raw,
network netlink dgram,
network unix stream,
network unix dgram,
capability dac_override,
EOF
sudo apparmor_parser -r /etc/apparmor.d/cursor-sandbox
Step 4 - Remove any conflicting old profile:
sudo aa-status | grep cursor
If you see cursor_sandbox the old one, remove it:
sudo apparmor_parser -R /etc/apparmor.d/cursor_sandbox
sudo rm /etc/apparmor.d/cursor_sandbox
sudo systemctl restart apparmor
Step 5 - Restart Cursor.
Quick workaround if you need it working right now, less secure:
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
The team knows about this and is working on a proper fix. More details: Terminal Sandbox Issue Linux
Let me know what you see in the step 1 logs. That’ll help narrow it down if this doesn’t fully fix it.