Follow-up for #4165 (#4271)

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* Follow-up for #4165

* fix noroot comment

As suggested [here](https://github.com/netblue30/firejail/pull/4271#discussion_r630981737).

* fix dbus-user comment

As suggested [here](https://github.com/netblue30/firejail/pull/4271#discussion_r630982527).

* fix private-dev comment

As suggested [here](https://github.com/netblue30/firejail/pull/4271#discussion_r630980029).

* fix private-etc comment

As suggested [here](https://github.com/netblue30/firejail/pull/4271#discussion_r630979698).

* move writable-var comment cfr. profile.template

13 files changed, 76 insertions, 54 deletions

diff --git a/etc/profile-a-l/amarok.profile b/etc/profile-a-l/amarok.profile
index a15d3628d..a7caddc4c 100644
--- a/etc/profile-a-l/amarok.profile
+++ b/etc/profile-a-l/amarok.profile
@@ -35,14 +35,14 @@ private-dev
 # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,machine-id,pki,pulse,ssl
 private-tmp
 
-# If you ain't on kde-plasma you need to uncomment the following
 dbus-user filter
 dbus-user.own org.kde.amarok
-#dbus-user.own org.kde.kded
-#dbus-user.own org.kde.klauncher
 dbus-user.own org.mpris.amarok
 dbus-user.own org.mpris.MediaPlayer2.amarok
 dbus-user.talk org.freedesktop.Notifications
-#dbus-user.talk org.kde.knotify
 dbus-user.talk org.kde.StatusNotifierWatcher
+# If you're not on kde-plasma add the next lines to your amarok.local.
+#dbus-user.own org.kde.kded
+#dbus-user.own org.kde.klauncher
+#dbus-user.talk org.kde.knotify
 dbus-system none
diff --git a/etc/profile-a-l/cin.profile b/etc/profile-a-l/cin.profile
index 542d6600d..e1f9523c4 100644
--- a/etc/profile-a-l/cin.profile
+++ b/etc/profile-a-l/cin.profile
@@ -26,7 +26,7 @@ nou2f
 noroot
 protocol unix
 
-# if an 1-1.2% gap per thread hurts you, comment seccomp
+# If a 1-1.2% gap per thread hurts you, add 'ignore seccomp' to your cin.local.
 seccomp
 shell none
 
diff --git a/etc/profile-a-l/enpass.profile b/etc/profile-a-l/enpass.profile
index feae5abb3..c4123b4c2 100644
--- a/etc/profile-a-l/enpass.profile
+++ b/etc/profile-a-l/enpass.profile
@@ -32,10 +32,10 @@ whitelist ${DOCUMENTS}
 include whitelist-common.inc
 include whitelist-var-common.inc
 
-# machine-id and nosound break audio notification functionality
-# comment both if you need that functionality or put 'ignore machine-id'
-# and 'ignore nosound' in your enpass.local
-
+# machine-id and nosound break audio notification functionality.
+# Add the next lines to your enpass.local if you need that functionality.
+#ignore machine-id
+#ignore nosound
 caps.drop all
 machine-id
 netfilter
diff --git a/etc/profile-a-l/eog.profile b/etc/profile-a-l/eog.profile
index aabef65fc..5892374bd 100644
--- a/etc/profile-a-l/eog.profile
+++ b/etc/profile-a-l/eog.profile
@@ -10,11 +10,13 @@ noblacklist ${HOME}/.config/eog
 
 whitelist /usr/share/eog
 
-# private-bin, private-etc and private-lib break 'Open With' / 'Open in file manager'
-# comment those if you need that functionality
-# or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local
-private-bin eog
+# private-bin, private-etc and private-lib break 'Open With' / 'Open in file manager'.
+# Add the next lines to your eog.local if you need that functionality.
+#ignore private-bin
+#ignore private-etc
+#ignore private-lib
 
+private-bin eog
 
 # broken on Debian 10 (buster) running LXDE got the folowing error:
 # Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown
diff --git a/etc/profile-a-l/eom.profile b/etc/profile-a-l/eom.profile
index 5bfeb8c8f..7143a8e03 100644
--- a/etc/profile-a-l/eom.profile
+++ b/etc/profile-a-l/eom.profile
@@ -10,9 +10,12 @@ noblacklist ${HOME}/.config/mate/eom
 
 whitelist /usr/share/eom
 
-# private-bin, private-etc and private-lib break 'Open With' / 'Open in file manager'
-# comment those if you need that functionality
-# or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eom.local
+# private-bin, private-etc and private-lib break 'Open With' / 'Open in file manager'.
+# Add the next lines to your eom.local if you need that functionality.
+#ignore private-bin
+#ignore private-etc
+#ignore private-lib
+
 private-bin eom
 
 # Redirect
diff --git a/etc/profile-a-l/libreoffice.profile b/etc/profile-a-l/libreoffice.profile
index 0041f2540..e4440eac0 100644
--- a/etc/profile-a-l/libreoffice.profile
+++ b/etc/profile-a-l/libreoffice.profile
@@ -9,8 +9,8 @@ include globals.local
 noblacklist /usr/local/sbin
 noblacklist ${HOME}/.config/libreoffice
 
-# libreoffice uses java for some certain operations
-# comment if you don't care about java functionality
+# libreoffice uses java for some functionality.
+# Add 'ignore include allow-java.inc' to your libreoffice.local if you don't need that functionality.
 # Allow java (blacklisted by disable-devel.inc)
 include allow-java.inc
 
@@ -22,26 +22,28 @@ include disable-programs.inc
 
 include whitelist-var-common.inc
 
-# ubuntu 18.04 comes with its own apparmor profile, but it is not in enforce mode.
-# comment the next line to use the ubuntu profile instead of firejail's apparmor profile
+# Debian 10/Ubuntu 18.04 come with their own apparmor profile, but it is not in enforce mode.
+# Add the next lines to your libreoffice.local to use the Ubuntu profile instead of firejail's apparmor profile.
+#ignore apparmor
+#ignore nonewprivs
+#ignore protocol
+#ignore seccomp
+#ignore tracelog
+
 apparmor
 caps.drop all
 netfilter
 nodvd
 nogroups
 noinput
-# comment nonewprivs when using the ubuntu 18.04/debian 10 apparmor profile
 nonewprivs
 noroot
 notv
 nou2f
 novideo
-# comment the protocol line when using the ubuntu 18.04/debian 10 apparmor profile
 protocol unix,inet,inet6
-# comment seccomp when using the ubuntu 18.04/debian 10 apparmor profile
 seccomp
 shell none
-# comment tracelog when using the ubuntu 18.04/debian 10 apparmor profile
 tracelog
 
 #private-bin libreoffice,sh,uname,dirname,grep,sed,basename,ls
diff --git a/etc/profile-a-l/librewolf.profile b/etc/profile-a-l/librewolf.profile
index 0934e1271..8e3e58f19 100644
--- a/etc/profile-a-l/librewolf.profile
+++ b/etc/profile-a-l/librewolf.profile
@@ -18,8 +18,8 @@ whitelist ${HOME}/.librewolf
 #noblacklist ${HOME}/.mozilla
 #whitelist ${HOME}/.mozilla
 
-# Uncomment or put in your librewolf.local one of the following whitelist to enable KeePassXC Plugin
-# NOTE: start KeePassXC before Librewolf and keep it open to allow communication between them
+# To enable KeePassXC Plugin add one of the following lines to your librewolf.local.
+# NOTE: start KeePassXC before Librewolf and keep it open to allow communication between them.
 #whitelist ${RUNUSER}/kpxc_server
 #whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer
 
@@ -31,25 +31,24 @@ include whitelist-usr-share-common.inc
 
 # Add the next line to your librewolf.local to enable private-bin (Arch Linux).
 #private-bin dbus-launch,dbus-send,librewolf,sh
-# Add the next line to your librewolf.local to enable private-etc. Note
-# that private-etc must first be enabled in firefox-common.local.
+# Add the next line to your librewolf.local to enable private-etc.
+# NOTE: private-etc must first be enabled in firefox-common.local.
 #private-etc librewolf
 
 dbus-user filter
-# Uncomment or put in your librewolf.local to enable native notifications.
+# Add the next line to your librewolf.local to enable native notifications.
 #dbus-user.talk org.freedesktop.Notifications
-# Uncomment or put in your librewolf.local to allow to inhibit screensavers
+# Add the next line to your librewolf.local to allow inhibiting screensavers.
 #dbus-user.talk org.freedesktop.ScreenSaver
-# Uncomment or put in your librewolf.local for plasma browser integration
+# Add the next lines to your librewolf.local for plasma browser integration.
 #dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration
 #dbus-user.talk org.kde.JobViewServer
 #dbus-user.talk org.kde.kuiserver
-# Uncomment or put in your librewolf.local to allow screen sharing under wayland.
+# Add the next lines to your librewolf.local to allow screensharing under Wayland.
 #whitelist ${RUNUSER}/pipewire-0
 #dbus-user.talk org.freedesktop.portal.*
-# Also uncomment or put in your librewolf.local if screen sharing sharing still
-# does not work with the above lines (might depend on the portal
-# implementation)
+# Also add the next line to your librewolf.local if screensharing does not work with
+# the above lines (depends on the portal implementation).
 #ignore noroot
 ignore dbus-user none
 
diff --git a/etc/profile-m-z/minecraft-launcher.profile b/etc/profile-m-z/minecraft-launcher.profile
index cdea91b8f..2536d0b38 100644
--- a/etc/profile-m-z/minecraft-launcher.profile
+++ b/etc/profile-m-z/minecraft-launcher.profile
@@ -6,7 +6,8 @@ include minecraft-launcher.local
 # Persistent global definitions
 include globals.local
 
-# On some distros executable may be in '/opt/minecraft-launcher/', if so, run 'firejail /opt/minecraft-launcher/minecraft-launcher' to start it.
+# Some distros put the executable in /opt/minecraft-launcher.
+# Run 'firejail /opt/minecraft-launcher/minecraft-launcher' to start it.
 
 ignore noexec ${HOME}
 
@@ -50,7 +51,8 @@ disable-mnt
 private-bin java,java-config,minecraft-launcher
 private-cache
 private-dev
-# If multiplayer or realms break add your own java folder from /etc or comment the line below.
+# If multiplayer or realms break, add 'private-etc <your-own-java-folder-from-/etc>'
+# or 'ignore private-etc' to your minecraft-launcher.local.
 private-etc alternatives,asound.conf,ati,ca-certificates,crypto-policies,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-14-openjdk,java-7-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,login.defs,machine-id,mime.types,nvidia,passwd,pki,pulse,resolv.conf,selinux,services,ssl,timezone,X11,xdg
 private-opt minecraft-launcher
 private-tmp
diff --git a/etc/profile-m-z/nano.profile b/etc/profile-m-z/nano.profile
index 45d5f59dd..4698c2287 100644
--- a/etc/profile-m-z/nano.profile
+++ b/etc/profile-m-z/nano.profile
@@ -47,8 +47,12 @@ x11 none
 private-bin nano,rnano
 private-cache
 private-dev
-# Comment the next line if you want to edit files in /etc directly
+# Add the next lines to your nano.local if you want to edit files in /etc directly.
+#ignore private-etc
+#writable-etc
 private-etc alternatives,nanorc
+# Add the next line to your nano.local if you want to edit files in /var directly.
+#writable-var
 
 dbus-user none
 dbus-system none
diff --git a/etc/profile-m-z/ostrichriders.profile b/etc/profile-m-z/ostrichriders.profile
index e0be078a7..310b90919 100644
--- a/etc/profile-m-z/ostrichriders.profile
+++ b/etc/profile-m-z/ostrichriders.profile
@@ -29,6 +29,7 @@ ipc-namespace
 net none
 nodvd
 nogroups
+# Add 'ignore noinput' to your ostrichriders.local if you need controller support.
 noinput
 nonewprivs
 noroot
@@ -43,7 +44,6 @@ tracelog
 disable-mnt
 private-bin ostrichriders
 private-cache
-# comment the following line if you need controller support
 private-dev
 private-tmp
 
diff --git a/etc/profile-m-z/spotify.profile b/etc/profile-m-z/spotify.profile
index f679be9e7..01bc2bc05 100644
--- a/etc/profile-m-z/spotify.profile
+++ b/etc/profile-m-z/spotify.profile
@@ -44,7 +44,7 @@ tracelog
 disable-mnt
 private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity
 private-dev
-# Comment the next line or put 'ignore private-etc' in your spotify.local if want to see the albums covers or if you want to use the radio
+# If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local.
 private-etc alternatives,ca-certificates,crypto-policies,fonts,group,host.conf,hosts,ld.so.cache,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl
 private-opt spotify
 private-srv none
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile
index 369255324..06d08f3a2 100644
--- a/etc/profile-m-z/steam.profile
+++ b/etc/profile-m-z/steam.profile
@@ -119,7 +119,7 @@ whitelist ${HOME}/.steampid
 include whitelist-common.inc
 include whitelist-var-common.inc
 
-# Note: The following were intentionally left out as they are alternative
+# NOTE: The following were intentionally left out as they are alternative
 # (i.e.: unnecessary and/or legacy) paths whose existence may potentially
 # clobber other paths (see #4225).  If you use any, either add the entry to
 # steam.local or move the contents to a path listed above (or open an issue if
@@ -131,34 +131,36 @@ caps.drop all
 #ipc-namespace
 netfilter
 nodvd
-# nVidia users may need to comment / ignore nogroups and noroot
 nogroups
 nonewprivs
+# If you use nVidia you might need to add 'ignore noroot' to your steam.local.
 noroot
 notv
 nou2f
-# novideo should be commented for VR
+# For VR support add 'ignore novideo' to your steam.local.
 novideo
 protocol unix,inet,inet6,netlink
-# seccomp sometimes causes issues (see #2951, #3267),
-# comment it or add 'ignore seccomp' to steam.local if so.
+# seccomp sometimes causes issues (see #2951, #3267).
+# Add 'ignore seccomp' to your steam.local if you experience this.
 seccomp !ptrace
 shell none
 # tracelog breaks integrated browser
 #tracelog
 
-# private-bin is disabled while in testing, but has been tested working with multiple games
+# private-bin is disabled while in testing, but is known to work with multiple games.
+# Add the next line to your steam.local to enable private-bin.
 #private-bin awk,basename,bash,bsdtar,bzip2,cat,chmod,cksum,cmp,comm,compress,cp,curl,cut,date,dbus-launch,dbus-send,desktop-file-edit,desktop-file-install,desktop-file-validate,dirname,echo,env,expr,file,find,getopt,grep,gtar,gzip,head,hostname,id,lbzip2,ldconfig,ldd,ln,ls,lsb_release,lsof,lspci,lz4,lzip,lzma,lzop,md5sum,mkdir,mktemp,mv,netstat,ps,pulseaudio,python*,readlink,realpath,rm,sed,sh,sha1sum,sha256sum,sha512sum,sleep,sort,steam,steamdeps,steam-native,steam-runtime,sum,tail,tar,tclsh,test,touch,tr,umask,uname,update-desktop-database,wc,wget,which,whoami,xterm,xz,zenity
-# extra programs are available which might be needed for select games
+# Extra programs are available which might be needed for select games.
+# Add the next line to your steam.local to enable support for these programs.
 #private-bin java,java-config,mono
-# picture viewers are needed for viewing screenshots
+# To view screenshots add the next line to your steam.local.
 #private-bin eog,eom,gthumb,pix,viewnior,xviewer
 
 private-dev
-# private-etc breaks a small selection of games on some systems, comment to support those
+# private-etc breaks a small selection of games on some systems. Add 'ignore private-etc'
+# to your steam.local to support those.
 private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl
 private-tmp
 
-# breaks appindicator support
 # dbus-user none
 # dbus-system none
diff --git a/etc/profile-m-z/sysprof.profile b/etc/profile-m-z/sysprof.profile
index 2473988e4..b52b25b96 100644
--- a/etc/profile-m-z/sysprof.profile
+++ b/etc/profile-m-z/sysprof.profile
@@ -15,8 +15,15 @@ include disable-passwdmgr.inc
 include disable-programs.inc
 include disable-xdg.inc
 
-# help menu functionality (yelp) - comment or add this block prepended with 'ignore'
-# to your sysprof.local if you don't need the help functionality
+# Add the next lines to your sysprof.local if you don't need (yelp) help menu functionality.
+#ignore noblacklist ${HOME}/.config/yelp
+#ignore mkdir ${HOME}/.config/yelp
+#nowhitelist ${HOME}/.config/yelp
+#nowhitelist /usr/share/help/C/sysprof
+#nowhitelist /usr/share/yelp
+#nowhitelist /usr/share/yelp-tools
+#nowhitelist /usr/share/yelp-xsl
+
 noblacklist ${HOME}/.config/yelp
 mkdir ${HOME}/.config/yelp
 whitelist ${HOME}/.config/yelp
@@ -41,7 +48,8 @@ nodvd
 nogroups
 noinput
 nonewprivs
-# Ubuntu 16.04 version needs root privileges - comment or put 'ignore noroot' in sysprof.local if you run Xenial
+# Some older Debian/Ubuntu sysprof versions need root privileges.
+# Add 'ignore noroot' to your sysprof.local if you run one of these.
 noroot
 nosound
 notv
@@ -57,7 +65,7 @@ disable-mnt
 private-cache
 private-dev
 private-etc alternatives,fonts,ld.so.cache,machine-id,ssl
-# private-lib breaks help menu
+# private-lib - breaks help menu
 #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so
 private-tmp