# The in-sandbox forwarder connects to the network proxy's socket from its own
# mount namespace, which AppArmor reports as a disconnected path.
profile cursor_sandbox /usr/share/cursor/resources/app/resources/helpers/cursorsandbox flags=(attach_disconnected) {
  file,
  /** ix,

  capability sys_admin,
  capability net_admin,
  capability chown,
  capability setuid,
  capability setgid,
  capability setpcap,
  network unix,
  network inet stream,
  network inet6 stream,
  # The network proxy runs under this profile and resolves hostnames over UDP.
  network inet dgram,
  network inet6 dgram,
  network netlink raw,

  # Allow unconfined host processes (e.g. root running `kill`) to signal sandboxed processes.
  signal (receive) peer=unconfined,

  ## Uncomment this on AppArmor 4.0
  #userns,

  mount,
  remount,
  umount,

  /usr/share/cursor/resources/app/resources/helpers/cursorsandbox mr,
}

profile cursor_sandbox_remote /home/*/.cursor-server/bin/*/*/resources/helpers/cursorsandbox flags=(attach_disconnected) {
  file,
  /** ix,

  capability sys_admin,
  capability net_admin,
  capability chown,
  capability setuid,
  capability setgid,
  capability setpcap,
  network unix,
  network inet stream,
  network inet6 stream,
  network inet dgram,
  network inet6 dgram,
  network netlink raw,
  signal (receive) peer=unconfined,

  ## Uncomment this on AppArmor 4.0
  #userns,

  mount,
  remount,
  umount,

  /home/*/.cursor-server/bin/*/*/resources/helpers/cursorsandbox mr,
}

profile cursor_sandbox_agent_cli /home/*/.local/share/cursor-agent/versions/*/cursorsandbox flags=(attach_disconnected) {
  file,
  /** ix,

  capability sys_admin,
  capability net_admin,
  capability chown,
  capability setuid,
  capability setgid,
  capability setpcap,
  network unix,
  network inet stream,
  network inet6 stream,
  network inet dgram,
  network inet6 dgram,
  network netlink raw,
  signal (receive) peer=unconfined,

  ## Uncomment this on AppArmor 4.0
  #userns,

  mount,
  remount,
  umount,

  /home/*/.local/share/cursor-agent/versions/*/cursorsandbox mr,
}
