Thanks for the updates. It’s really helpful that you confirmed this is reproducible across three versions (2.6.13, 2.6.14, 2.6.18).
The root cause is clear. The default AppArmor profile shipped in the .deb package is incomplete (userns is commented out, and network is missing), and every update overwrites your changes.
Until this is fixed in the package, there’s a more durable workaround. Make the profile immutable after patching it:
sudo chattr +i /etc/apparmor.d/cursor-sandbox
sudo chattr +i /etc/apparmor.d/cursor-sandbox-remote
This prevents the .deb installer from overwriting the files during updates. When you need to edit them, revert it with sudo chattr -i.
Other users with the same issue described this approach here: AppArmor cursor-sandbox profile incomplete on Linux — sandbox does not work correctly (missing network, signal, userns)
I’ve shared this with the team, including the detail that the profile gets reset on every upgrade.