keepass*: note that private-dev blocks access to new hardware keys

Which may be surprising to some users (see #4883).

Fixes #4883.

3 files changed, 9 insertions, 0 deletions

diff --git a/etc/profile-a-l/keepass.profile b/etc/profile-a-l/keepass.profile
index dae3b03f0..bc7878ac9 100644
--- a/etc/profile-a-l/keepass.profile
+++ b/etc/profile-a-l/keepass.profile
@@ -38,6 +38,9 @@ seccomp
 shell none
 
 private-cache
+# Note: private-dev prevents the program from seeing new devices (such as
+# hardware keys) on /dev after it has already started; add "ignore nou2f" to
+# keepassxc.local if this is an issue (see #4883).
 private-dev
 private-tmp
 
diff --git a/etc/profile-a-l/keepassx.profile b/etc/profile-a-l/keepassx.profile
index 549fd9d81..8c5e6168e 100644
--- a/etc/profile-a-l/keepassx.profile
+++ b/etc/profile-a-l/keepassx.profile
@@ -39,6 +39,9 @@ shell none
 tracelog
 
 private-bin keepassx,keepassx2
+# Note: private-dev prevents the program from seeing new devices (such as
+# hardware keys) on /dev after it has already started; add "ignore nou2f" to
+# keepassxc.local if this is an issue (see #4883).
 private-dev
 private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
 private-tmp
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile
index 2d8cc35cb..8f57cb706 100644
--- a/etc/profile-a-l/keepassxc.profile
+++ b/etc/profile-a-l/keepassxc.profile
@@ -86,6 +86,9 @@ shell none
 tracelog
 
 private-bin keepassxc,keepassxc-cli,keepassxc-proxy
+# Note: private-dev prevents the program from seeing new devices (such as
+# hardware keys) on /dev after it has already started; add "ignore nou2f" to
+# keepassxc.local if this is an issue (see #4883).
 private-dev
 private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
 private-tmp