Subject: Re: __pycache__
To:     Russell Coker <russell@coker.com.au>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
References: <1857551.fKAPn0m0Tg@liv>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <4b058ca2-e3b5-e8c8-1c1a-2e90b766cb08@ieee.org>
Date:   Fri, 25 Jan 2019 21:49:54 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <1857551.fKAPn0m0Tg@liv>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 1/25/19 5:55 PM, Russell Coker wrote:
> type=AVC msg=audit(1548301606.546:586): avc:  denied  { write } for  pid=8055
> comm="semanage" name="__pycache__" dev="vda" ino=147333
> scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:lib_t:s0 tclass=dir permissive=0
> 
> What can we do about these __pycache__ write attempts?  Is there something the
> distribution should be doing in terms of automatically generating those cache
> files when packages are installed?

It is possible to precompile the bytecode (Gentoo does this).

python -m py_compile file1.py file2.py ...

or recursively do all .py files:

python -m compileall /path/to/files

If you wanted, you could disable writing the bytecode by adding -B to 
the python command, though that's probably not what distros want to do.

https://docs.python.org/3/library/py_compile.html
https://docs.python.org/3/library/compileall.html

-- 
Chris PeBenito