Sandbox network fails on Ubuntu 24.04 / AppArmor 4 — shipped `cursor-sandbox` profile missing `attach_disconnected` flag and `inet dgram` rule

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Where does the bug appear (feature/product)?

Cursor IDE — agent terminal sandbox - network requests

Describe the Bug

On Ubuntu 24.04 with AppArmor 4.0.1, the terminal sandbox starts successfully, but all network access from sandboxed agent commands fails. Every domain fails with a connection reset, allowed or not. The allowlist is never consulted. So failure includes domains explicitly listed in ~/.cursor/sandbox.json under networkPolicy.allow. Every request fails with:

curl: (56) Recv failure: Connection reset by peer

This is distinct from the widely reported “sandbox fails to start” issues (e.g. Terminal Sandbox Issue Linux #152979, and the cursor-sandbox-remote ABI/network reports). In those cases preflight fails and Cursor falls back to unsandboxed execution. Here the sandbox starts fine and the proxy’s TCP listener accepts connections — the failure happens inside the running proxy.

There are two missing pieces in /etc/apparmor.d/cursor-sandbox.

1. Profiles lack flags=(attach_disconnected)

The proxy’s internal Unix socket handoff is denied:

apparmor="DENIED" operation="connect" class="file"
info="Failed name lookup - disconnected path" error=-13
profile="cursor_sandbox" name="tmp/sandbox-proxy-http-17486.sock"
comm="tokio-rt-worker" requested_mask="wr" denied_mask="wr"

The socket lives on a mount that can’t be resolved back to the namespace root, so AppArmor cannot construct an absolute pathname and denies outright — the blanket file, rule in the profile does not help. The listener accepts the client’s TCP connection, fails to hand it off, and drops it, which reaches the client as a reset.

Critically, this occurs before any allowlist evaluation, so allowed and non-allowed domains fail identically. registry.npmjs.org fails even though it is allowed by default.

2. Profiles lack network inet dgram

After adding attach_disconnected, the next denial appears:

apparmor="DENIED" operation="create" class="net" profile="cursor_sandbox"
comm="tokio-rt-worker" family="inet" sock_type="dgram" protocol=0
requested="create" denied="create"

The profile grants network inet stream and network inet6 stream but no datagram rules, so the proxy cannot perform DNS lookups.

Fix (verified working)

sudo cp /etc/apparmor.d/cursor-sandbox /etc/apparmor.d/cursor-sandbox.bak

# Add attach_disconnected to all three profile headers
sudo sed -i -E 's/^(profile [^ ]+ [^ ]+) \{$/\1 flags=(attach_disconnected) {/' \
  /etc/apparmor.d/cursor-sandbox

# Allow UDP so the proxy can resolve DNS
sudo sed -i 's/^  network inet stream,$/  network inet stream,\n  network inet dgram,\n  network inet6 dgram,/' \
  /etc/apparmor.d/cursor-sandbox

sudo apparmor_parser -r /etc/apparmor.d/cursor-sandbox

Then fully restart Cursor (not a window reload).

After this, behaviour is correct: allowed domains return HTTP responses, and a non-allowed domain such as example.com is properly refused.

Suggested upstream fix: ship the profile with flags=(attach_disconnected) on all three profiles (cursor_sandbox, cursor_sandbox_remote, cursor_sandbox_agent_cli) and add network inet dgram, / network inet6 dgram,.

Operating System

Linux — Ubuntu 24.04.2 LTS, kernel 7.0.0-34-generic

Version Information

  • Cursor 3.21.18 (deb package 3.21.18-1790045713)
  • AppArmor parser 4.0.1
  • No separate cursor-sandbox-apparmor package installed; the profile was supplied by the main cursor deb

Does this stop you from using Cursor?

No — but it silently defeats the sandbox’s network allowlist. The only workarounds are running commands unsandboxed or patching the profile manually.

Steps to Reproduce

  1. Ubuntu 24.04.2 LTS, AppArmor 4.0.1, Cursor 3.21.18

  2. Create ~/.cursor/sandbox.json:

    { "networkPolicy": { "default": "deny", "allow": ["registry.npmjs.org"] } }

  3. Have the agent run a sandboxed command: curl -sS https://registry.npmjs.org/

  4. Observe curl: (56) Recv failure: Connection reset by peer

  5. Inspect denials: sudo journalctl -k | grep 'apparmor="DENIED"' | grep cursor

Expected Behavior

Domains in networkPolicy.allow are reachable from sandboxed commands; domains not listed are refused.

Actual Behavior

Every domain fails with a connection reset, allowed or not. The allowlist is never consulted.

Operating System

Linux

Version Information

Version: 3.21.18
VS Code Extension API: 1.128.0
Commit: c4730f7d93d787d9ab120af715999f0345ee5bc0
Date: 2026-09-22T02:04:34.641Z
Layout: IDE
Build Type: Stable
Release Track: Default
Electron: 42.10.0
Chromium: 148.0.7778.280
Node.js: 24.18.1
V8: 14.8.178.38-electron.0
xterm.js: 6.1.0-beta.291
OS: Linux x64 7.0.0-34-generic

Does this stop you from using Cursor

No - Cursor works, but with this issue

13

Hey @Dominika_Oles, thanks for the report and for tracking down both denials.

We reproduced this on a clean Ubuntu 24.04 machine with the profile that ships in the Cursor package. I’ve shared it with the team.

15

Hey @Dominika_Oles,

Quick update: a fix for sandboxed commands getting connection resets on Ubuntu 24.04 is coming in Cursor 3.24. The AppArmor profile that ships with Cursor now includes both the attach_disconnected flag and the UDP (dgram) network rules, the same two changes from your fix.

Once you’re on 3.24 you shouldn’t need your manual patch anymore. Please give it another try then and let me know if allowed domains still get reset.