AppArmor's default profile for curl restricts creating output files outside of /tmp and /home (curl's openat(... O_CREAT ...) fails with -EACCES). Brilliant. Nobody ever will try to use curl outside ...