Merge lp:~xnox/apparmor/py3 into lp:apparmor/2.12

[Dimitri John Ledkov]

This is a complete port to make apparmor Python2/Python3 bilingual.
There are 3 variables in use:
PYTHON, used by common/Make.rule and libapparmor configure script pointing to a python interpreter
PYTHON_VERSION, used by libapparmor configure script with just version number e.g. '3.2' or '2.7'
PYTHON_VERSIONS, list of all pythons to run checks/tests with for python utilities e.g. 'python2 python3'

If none are specified, defaults will be autodetected to:
PYTHON=/usr/bin/python2 in Make.rule
PYTHON=/usr/bin/python2.7 in configure
PYTHON_VERSION=2.7
PYTHON_VERSIONS='python2 python3'

To build libapparmor (including the python swig bindings) with python3 it seems like you must set these two variables:
PYTHON=/usr/bin/python3.2
PYTHON_VERSIONS=3.2

All test and check targets pass and build succeeds.
Scripts are functional.
Swig python module can import and doesn't segfault in smoke testing.

TODO:
/usr/bin/aa-easyprof gets installed without updated shebang to point at python3
ac_python_devel patch should probably be submitted to autoconf-archive (updating it's ax_python_devel), not sure about the install location as historically a*_python_devel installs into site-packages, instead of dist-packages.

[Barry Warsaw (barry)]

On Jun 11, 2012, at 05:04 PM, Dmitrijs Ledkovs wrote:

>Dmitrijs Ledkovs has proposed merging lp:~dmitrij.ledkov/apparmor/py3 into lp:apparmor.
>
>Requested reviews:
> Canonical Foundations Team (canonical-foundations)
> AppArmor Developers (apparmor-dev)
>
>For more details, see:
>https://code.launchpad.net/~dmitrij.ledkov/apparmor/py3/+merge/109682
>
>Initial port to python3 for utilities.
>
>Python2 compatibility is not broken, all code should be 'bilingual'.
>
>Adds helpers in the Make.rules to detect python2 and/or python3.
>
>Runs test and check targets with both pythons, if available.
>
>Python3 is entirely optional with these changes, but the test/check targets will fail if python3 incompatible code is introduced and python3 is available during build. If you do not want the build to fail export PYTHON_VERSIONS=python2 before running check/test targets.
>
>Currently the install defaults to python2, with fallback to python3
>
>This does not have anything to do with swig python binding.

=== modified file 'utils/apparmor/easyprof.py'
--- utils/apparmor/easyprof.py 2012-05-08 05:37:48 +0000
+++ utils/apparmor/easyprof.py 2012-06-11 17:03:23 +0000
> @@ -70,7 +70,8 @@
> try:
> sp = subprocess.Popen(command, stdout=subprocess.PIPE,
> stderr=subprocess.STDOUT)
> - except OSError, ex:
> + except OSError:
> + ex = sys.exc_info()[1]
> return [127, str(ex)]

I think in general, a better way of doing this would be to change the except
line to

    except OSError as ex:

> @@ -181,7 +183,8 @@
> fn = policy
> else:
> f, fn = tempfile.mkstemp(prefix='aa-easyprof')
> - os.write(f, policy)
> + policy_bytes = bytes(policy, 'utf-8') if sys.version > '3' else policy
> + os.write(f, policy_bytes)

I generally don't like version checks unless there's no other way. In this
case, you could do something like this instead:

    if not isinstance(policy, bytes):
        policy = policy.encode('utf-8')

=== modified file 'utils/test/test-aa-easyprof.py'
--- utils/test/test-aa-easyprof.py 2012-05-09 18:05:07 +0000
+++ utils/test/test-aa-easyprof.py 2012-06-11 17:03:23 +0000
> @@ -101,6 +101,7 @@
> def tearDown(self):
> '''Teardown for tests'''
> if os.path.exists(self.tmpdir):
> + sys.stdout.write("%s\n" % self.tmpdir)
> recursive_rm(self.tmpdir)
>
> #

Why did you decide against using print(). I'm sure there's a good reason, but
it might be useful in at least some of these cases to explain in comments why
sys.stdout.write() is being used instead of print(). Otherwise, when the next
person comes along they probably won't understand why this idiom was chosen.

[lp:~xnox/apparmor/py3]

2053. By Dimitri John Ledkov on 2012-06-11

newline parity with print statement vs sys.stdout.write

[Adam Conrad (adconrad)]

Looks good to me, but I can't commit to the parent branch, so waiting on someone from AppArmor Devs to pick it up and run with it.

review: Approve

[Evan (ev)]

> - print open(i).read()
> + sys.stdout.write(open(i).read()+"\n")

This will leak fds, which python wonderfully loudly complains about in Python 3. It's also a good opportunity to replace any pairs of open() and close() with a with statement. If an open() and close() isn't wrapped in a with or try/finally, I would argue that is a bug.

[Dimitri John Ledkov (xnox)]

On 11/06/12 21:34, Barry Warsaw wrote:
> On Jun 11, 2012, at 05:04 PM, Dmitrijs Ledkovs wrote:
>
>> Dmitrijs Ledkovs has proposed merging lp:~dmitrij.ledkov/apparmor/py3 into lp:apparmor.
>>
>> Requested reviews:
>> Canonical Foundations Team (canonical-foundations)
>> AppArmor Developers (apparmor-dev)
>>
>> For more details, see:
>> https://code.launchpad.net/~dmitrij.ledkov/apparmor/py3/+merge/109682
>>
>> Initial port to python3 for utilities.
>>
>> Python2 compatibility is not broken, all code should be 'bilingual'.
>>
>> Adds helpers in the Make.rules to detect python2 and/or python3.
>>
>> Runs test and check targets with both pythons, if available.
>>
>> Python3 is entirely optional with these changes, but the test/check targets will fail if python3 incompatible code is introduced and python3 is available during build. If you do not want the build to fail export PYTHON_VERSIONS=python2 before running check/test targets.
>>
>> Currently the install defaults to python2, with fallback to python3
>>
>> This does not have anything to do with swig python binding.
>
> === modified file 'utils/apparmor/easyprof.py'
> --- utils/apparmor/easyprof.py 2012-05-08 05:37:48 +0000
> +++ utils/apparmor/easyprof.py 2012-06-11 17:03:23 +0000
>> @@ -70,7 +70,8 @@
>> try:
>> sp = subprocess.Popen(command, stdout=subprocess.PIPE,
>> stderr=subprocess.STDOUT)
>> - except OSError, ex:
>> + except OSError:
>> + ex = sys.exc_info()[1]
>> return [127, str(ex)]
>
> I think in general, a better way of doing this would be to change the except
> line to
>
> except OSError as ex:
>

Ok, this does look better. This way was not documented on the Python/3
wiki page, nor in the porting to python3 book.

Noted.

>> @@ -181,7 +183,8 @@
>> fn = policy
>> else:
>> f, fn = tempfile.mkstemp(prefix='aa-easyprof')
>> - os.write(f, policy)
>> + policy_bytes = bytes(policy, 'utf-8') if sys.version > '3' else policy
>> + os.write(f, policy_bytes)
>
> I generally don't like version checks unless there's no other way. In this
> case, you could do something like this instead:
>
> if not isinstance(policy, bytes):
> policy = policy.encode('utf-8')
>

Makes sense. Cjwatson was arguing for version checks, as they are easy
to grep for when eventually going python3 only.

> === modified file 'utils/test/test-aa-easyprof.py'
> --- utils/test/test-aa-easyprof.py 2012-05-09 18:05:07 +0000
> +++ utils/test/test-aa-easyprof.py 2012-06-11 17:03:23 +0000
>> @@ -101,6 +101,7 @@
>> def tearDown(self):
>> '''Teardown for tests'''
>> if os.path.exists(self.tmpdir):
>> + sys.stdout.write("%s\n" % self.tmpdir)
>> recursive_rm(self.tmpdir)
>>
>> #
>
> Why did you decide against using print(). I'm sure there's a good reason, but
> it might be useful in at least some of these cases to explain in comments why
> sys.stdout.write() is being used instead of print(). Otherwise, when the next
> person comes along they probably won't understand why this idiom was chosen.
>

You should ask this question to apparmor's upstre...

[Dimitri John Ledkov (xnox)]

Pushed revision 2054:
* closes file descriptors
* uses except OSError as ex
* doesn't do version checks
* more stray print statements converted to sys.stdXXX.write() syntax

[lp:~xnox/apparmor/py3]

2054. By Dimitri John Ledkov on 2012-06-12

* Use with open('file') as f, to prevent leaking file descriptors
* More print -> sys.stdXXX.write() conversions
* Use `except Error as ex` & no sys.version checks
* add with_statement import for py2.5 compat
* remove unused import

2055. By Dimitri John Ledkov on 2012-06-12

python2/3 compatible ac_python_devel.m4

2056. By Dimitri John Ledkov on 2012-06-12

Remaining typos

2057. By Dimitri John Ledkov on 2012-06-12

typo

[Jamie Strandboge (jdstrand)]

Thanks for your work on this, it looks great! :)

review: Approve

=== modified file 'common/Make.rules'
--- common/Make.rules	2012-04-11 16:16:47 +0000
+++ common/Make.rules	2012-06-12 13:52:18 +0000
@@ -27,6 +27,10 @@
 DISTRIBUTION=AppArmor
 VERSION=$(shell cat common/Version)
 
+# Convenience functions
+pathsearch = $(firstword $(wildcard $(addsuffix /$(1),$(subst :, ,$(PATH)))))
+map = $(foreach a,$(2),$(call $(1),$(a)))
+
 # OVERRIDABLE variables
 # Set these variables before including Make.rules to change its behavior
 #   SPECFILE - for packages that have a non-standard specfile name
@@ -127,6 +131,17 @@
 
 endif
 
+ifndef PYTHON_VERSIONS
+PYTHON_VERSIONS = $(call map, pathsearch, python2 python3)
+endif
+
+ifndef PYTHON
+PYTHON = $(firstword ${PYTHON_VERSIONS})
+endif
+
+#Helper function to be used with $(call pyalldo, run_test_with_all.py)
+pyalldo=set -e; $(foreach py, $(PYTHON_VERSIONS), $(py) $(1);)
+
 .PHONY: version
 .SILENT: version
 version:

=== modified file 'libraries/libapparmor/m4/ac_python_devel.m4'
--- libraries/libapparmor/m4/ac_python_devel.m4	2012-04-25 19:15:19 +0000
+++ libraries/libapparmor/m4/ac_python_devel.m4	2012-06-12 13:52:18 +0000
@@ -17,9 +17,9 @@
         # Check for a version of Python >= 2.1.0
         #
         AC_MSG_CHECKING([for a version of Python >= '2.1.0'])
-        ac_supports_python_ver=`$PYTHON -c "import sys, string; \
-                ver = string.split(sys.version)[[0]]; \
-                print ver >= '2.1.0'"`
+        ac_supports_python_ver=`$PYTHON -c "import sys; \
+                ver = sys.version.split()[[0]]; \
+                sys.stdout.write(str(ver >= '2.1.0'))"`
         if test "$ac_supports_python_ver" != "True"; then
                 if test -z "$PYTHON_NOVERSIONCHECK"; then
                         AC_MSG_RESULT([no])
@@ -44,9 +44,9 @@
         #
         if test -n "$1"; then
                 AC_MSG_CHECKING([for a version of Python $1])
-                ac_supports_python_ver=`$PYTHON -c "import sys, string; \
-                        ver = string.split(sys.version)[[0]]; \
-                        print ver $1"`
+                ac_supports_python_ver=`$PYTHON -c "import sys; \
+                        ver = sys.version.split()[[0]]; \
+                        sys.stdout.write("%s\n" % (ver == $1))"`
                 if test "$ac_supports_python_ver" = "True"; then
                    AC_MSG_RESULT([yes])
                 else
@@ -80,8 +80,8 @@
         #
         AC_MSG_CHECKING([for Python include path])
         if test -z "$PYTHON_CPPFLAGS"; then
-                python_path=`$PYTHON -c "import distutils.sysconfig; \
-                        print distutils.sysconfig.get_python_inc();"`
+                python_path=`$PYTHON -c "import sys; import distutils.sysconfig;\
+sys.stdout.write('%s\n' % distutils.sysconfig.get_python_inc());"`
                 if test -n "${python_path}"; then
                         python_path="-I$python_path"
                 fi
@@ -97,22 +97,20 @@
         if test -z "$PYTHON_LDFLAGS"; then
                 # (makes two attempts to ensure we've got a version number
                 # from the interpreter)
-                py_version=`$PYTHON -c "from distutils.sysconfig import *; \
-                        from string import join; \
-                        print join(get_config_vars('VERSION'))"`
+                py_version=`$PYTHON -c "import sys; from distutils.sysconfig import *; \
+sys.stdout.write('%s\n' % ''.join(get_config_vars('VERSION')))"`
                 if test "$py_version" == "[None]"; then
                         if test -n "$PYTHON_VERSION"; then
                                 py_version=$PYTHON_VERSION
                         else
                                 py_version=`$PYTHON -c "import sys; \
-                                        print sys.version[[:3]]"`
+sys.stdout.write("%s\n" % sys.version[[:3]])"`
                         fi
                 fi
 
-                PYTHON_LDFLAGS=`$PYTHON -c "from distutils.sysconfig import *; \
-                        from string import join; \
-                        print '-L' + get_python_lib(0,1), \
-                        '-lpython';"`$py_version
+                PYTHON_LDFLAGS=`$PYTHON -c "import sys; from distutils.sysconfig import *; \
+sys.stdout.write('-L' + get_python_lib(0,1) + ' -lpython\n')"`$py_version`$PYTHON -c \
+"import sys; sys.stdout.write('%s' % getattr(sys,'abiflags',''))"`
         fi
         AC_MSG_RESULT([$PYTHON_LDFLAGS])
         AC_SUBST([PYTHON_LDFLAGS])
@@ -122,8 +120,8 @@
         #
         AC_MSG_CHECKING([for Python site-packages path])
         if test -z "$PYTHON_SITE_PKG"; then
-                PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
-                        print distutils.sysconfig.get_python_lib(0,0);"`
+                PYTHON_SITE_PKG=`$PYTHON -c "import sys; import distutils.sysconfig; \
+sys.stdout.write('%s\n' % distutils.sysconfig.get_python_lib(0,0));"`
         fi
         AC_MSG_RESULT([$PYTHON_SITE_PKG])
         AC_SUBST([PYTHON_SITE_PKG])
@@ -133,9 +131,9 @@
         #
         AC_MSG_CHECKING(python extra libraries)
         if test -z "$PYTHON_EXTRA_LIBS"; then
-           PYTHON_EXTRA_LIBS=`$PYTHON -c "import distutils.sysconfig; \
-                conf = distutils.sysconfig.get_config_var; \
-                print conf('LOCALMODLIBS'), conf('LIBS')"`
+           PYTHON_EXTRA_LIBS=`$PYTHON -c "import sys; import distutils.sysconfig; \
+conf = distutils.sysconfig.get_config_var; \
+sys.stdout.write('%s %s\n' % (conf('LOCALMODLIBS'), conf('LIBS')))"`
         fi
         AC_MSG_RESULT([$PYTHON_EXTRA_LIBS])
         AC_SUBST(PYTHON_EXTRA_LIBS)
@@ -145,9 +143,9 @@
         #
         AC_MSG_CHECKING(python extra linking flags)
         if test -z "$PYTHON_EXTRA_LDFLAGS"; then
-                PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import distutils.sysconfig; \
-                        conf = distutils.sysconfig.get_config_var; \
-                        print conf('LINKFORSHARED')"`
+                PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import sys; import distutils.sysconfig; \
+conf = distutils.sysconfig.get_config_var; \
+sys.stdout.write('%s\n' % conf('LINKFORSHARED'))"`
         fi
         AC_MSG_RESULT([$PYTHON_EXTRA_LDFLAGS])
         AC_SUBST(PYTHON_EXTRA_LDFLAGS)

=== modified file 'utils/Makefile'
--- utils/Makefile	2012-05-08 05:37:48 +0000
+++ utils/Makefile	2012-06-12 13:52:18 +0000
@@ -65,7 +65,7 @@
 	$(MAKE) install_manpages DESTDIR=${DESTDIR}
 	$(MAKE) -C vim install DESTDIR=${DESTDIR}
 	ln -sf aa-status.8 ${DESTDIR}/${MANDIR}/man8/apparmor_status.8
-	python ${PYSETUP} install --prefix=${PYPREFIX} --root=${DESTDIR} --version=${VERSION}
+	${PYTHON} ${PYSETUP} install --prefix=${PYPREFIX} --root=${DESTDIR} --version=${VERSION}
 
 .PHONY: clean
 ifndef VERBOSE
@@ -105,6 +105,4 @@
 		test -s $$tmpfile && cat $$tmpfile && rm -f $$tmpfile && exit 1; \
 	done || true; \
 	rm -f $$tmpfile
-	for i in test/* ; do \
-		python $$i || exit 1; \
-	done
+	$(foreach test, $(wildcard test/test-*.py), $(call pyalldo, $(test)))

=== modified file 'utils/aa-easyprof'
--- utils/aa-easyprof	2012-05-09 18:05:07 +0000
+++ utils/aa-easyprof	2012-06-12 13:52:18 +0000
@@ -35,7 +35,7 @@
 
     try:
         easyp = apparmor.easyprof.AppArmorEasyProfile(binary, opt)
-    except AppArmorException, e:
+    except AppArmorException as e:
         error(e.value)
     except Exception:
         raise
@@ -61,5 +61,5 @@
     # if we made it here, generate a profile
     params = apparmor.easyprof.gen_policy_params(binary, opt)
     p = easyp.gen_policy(**params)
-    print p,
+    sys.stdout.write('%s\n' % p)
 

=== modified file 'utils/apparmor/easyprof.py'
--- utils/apparmor/easyprof.py	2012-05-08 05:37:48 +0000
+++ utils/apparmor/easyprof.py	2012-06-12 13:52:18 +0000
@@ -8,6 +8,8 @@
 #
 # ------------------------------------------------------------------
 
+from __future__ import with_statement
+
 import codecs
 import glob
 import optparse
@@ -40,7 +42,7 @@
 def error(out, exit_code=1, do_exit=True):
     '''Print error message and exit'''
     try:
-        print >> sys.stderr, "ERROR: %s" % (out)
+        sys.stderr.write("ERROR: %s\n" % (out))
     except IOError:
         pass
 
@@ -51,7 +53,7 @@
 def warn(out):
     '''Print warning message'''
     try:
-        print >> sys.stderr, "WARN: %s" % (out)
+        sys.stderr.write("WARN: %s\n" % (out))
     except IOError:
         pass
 
@@ -59,7 +61,7 @@
 def msg(out, output=sys.stdout):
     '''Print message'''
     try:
-        print >> output, "%s" % (out)
+        sys.stdout.write("%s\n" % (out))
     except IOError:
         pass
 
@@ -70,7 +72,7 @@
     try:
         sp = subprocess.Popen(command, stdout=subprocess.PIPE,
                               stderr=subprocess.STDOUT)
-    except OSError, ex:
+    except OSError as ex:
         return [127, str(ex)]
 
     out = sp.communicate()[0]
@@ -82,7 +84,7 @@
     try:
         sp1 = subprocess.Popen(command1, stdout=subprocess.PIPE)
         sp2 = subprocess.Popen(command2, stdin=sp1.stdout)
-    except OSError, ex:
+    except OSError as ex:
         return [127, str(ex)]
 
     out = sp2.communicate()[0]
@@ -93,7 +95,7 @@
     '''Print debug message'''
     if DEBUGGING:
         try:
-            print >> sys.stderr, "DEBUG: %s" % (out)
+            sys.stderr.write("DEBUG: %s\n" % (out))
         except IOError:
             pass
 
@@ -181,6 +183,8 @@
         fn = policy
     else:
         f, fn = tempfile.mkstemp(prefix='aa-easyprof')
+        if not isinstance(policy, bytes):
+            policy = policy.encode('utf-8')
         os.write(f, policy)
         os.close(f)
 
@@ -219,9 +223,9 @@
         if opt.policy_groups_dir and os.path.isdir(opt.policy_groups_dir):
             self.dirs['policygroups'] = os.path.abspath(opt.policy_groups_dir)
 
-        if not self.dirs.has_key('templates'):
+        if not 'templates' in self.dirs:
             raise AppArmorException("Could not find templates directory")
-        if not self.dirs.has_key('policygroups'):
+        if not 'policygroups' in self.dirs:
             raise AppArmorException("Could not find policygroups directory")
 
         self.aa_topdir = "/etc/apparmor.d"
@@ -445,11 +449,12 @@
 
 def print_basefilenames(files):
     for i in files:
-        print "%s" % (os.path.basename(i))
+        sys.stdout.write("%s\n" % (os.path.basename(i)))
 
 def print_files(files):
     for i in files:
-        print open(i).read()
+        with open(i) as f:
+            sys.stdout.write(f.read()+"\n")
 
 def parse_args(args=None):
     '''Parse arguments'''

=== modified file 'utils/test/test-aa-easyprof.py'
--- utils/test/test-aa-easyprof.py	2012-05-09 18:05:07 +0000
+++ utils/test/test-aa-easyprof.py	2012-06-12 13:52:18 +0000
@@ -101,6 +101,7 @@
     def tearDown(self):
         '''Teardown for tests'''
         if os.path.exists(self.tmpdir):
+            sys.stdout.write("%s\n" % self.tmpdir)
             recursive_rm(self.tmpdir)
 
 #
@@ -328,7 +329,7 @@
     def test_binary_symlink(self):
         '''Test binary (symlink)'''
         exe = os.path.join(self.tmpdir, 'exe')
-        open(exe, 'wa').close()
+        open(exe, 'a').close()
         symlink = exe + ".lnk"
         os.symlink(exe, symlink)
 
@@ -441,7 +442,7 @@
         self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p))
 
         if debugging:
-            print p
+            sys.stdout.write("%s\n" % p)
 
         return p
 
@@ -859,7 +860,7 @@
     # Create the necessary files to import aa-easyprof
     init = os.path.join(os.path.dirname(absfn), '__init__.py')
     if not os.path.exists(init):
-        open(init, 'wa').close()
+        open(init, 'a').close()
         created.append(init)
 
     symlink = os.path.join(os.path.dirname(absfn), 'easyprof.py')

=== modified file 'utils/vim/Makefile'
--- utils/vim/Makefile	2012-03-23 16:02:20 +0000
+++ utils/vim/Makefile	2012-06-12 13:52:18 +0000
@@ -14,12 +14,15 @@
 all: apparmor.vim
 
 apparmor.vim: apparmor.vim.in Makefile create-apparmor.vim.py
-	python create-apparmor.vim.py > $@
+	${PYTHON} create-apparmor.vim.py > apparmor.vim
 
 install: apparmor.vim
 	install -d $(VIM_INSTALL_PATH)
 	install -m 644 $< $(VIM_INSTALL_PATH)
 
+test: apparmor.vim.in Makefile create-apparmor.vim.py
+	#Testing with all pythons
+	$(call pyalldo, create-apparmor.vim.py > /dev/null)
 
 clean:
 	rm -f apparmor.vim common

=== modified file 'utils/vim/create-apparmor.vim.py'
--- utils/vim/create-apparmor.vim.py	2012-06-08 21:30:22 +0000
+++ utils/vim/create-apparmor.vim.py	2012-06-12 13:52:18 +0000
@@ -10,7 +10,6 @@
 #    Christian Boltz <[e-mail]>
 
 from __future__ import with_statement
-import os
 import re
 import subprocess
 import sys
@@ -30,9 +29,9 @@
     return a textual error if it failed.'''
 
     try:
-        sp = subprocess.Popen(command, stdin=stdin, stdout=stdout, stderr=stderr, close_fds=True)
-    except OSError, e:
-        return [127, str(e)]
+        sp = subprocess.Popen(command, stdin=stdin, stdout=stdout, stderr=stderr, close_fds=True, universal_newlines=True)
+    except OSError as ex:
+        return [127, str(ex)]
 
     out, outerr = sp.communicate(input)
 
@@ -47,7 +46,7 @@
 # get capabilities list
 (rc, output) = cmd(['make', '-s', '--no-print-directory', 'list_capabilities'])
 if rc != 0:
-    print >>sys.stderr, ("make list_capabilities failed: " + output)
+    sys.stderr.write("make list_capabilities failed: " + output)
     exit(rc)
 
 capabilities = re.sub('CAP_', '', output.strip()).lower().split(" ")
@@ -59,7 +58,7 @@
 # get network protos list
 (rc, output) = cmd(['make', '-s', '--no-print-directory', 'list_af_names'])
 if rc != 0:
-    print >>sys.stderr, ("make list_af_names failed: " + output)
+    sys.stderr.write("make list_af_names failed: " + output)
     exit(rc)
 
 af_names = []
@@ -106,7 +105,7 @@
 }
 
 def my_repl(matchobj):
-    #print matchobj.group(1)
+    matchobj.group(1)
     if matchobj.group(1) in aa_regex_map:
         return aa_regex_map[matchobj.group(1)]
 
@@ -164,16 +163,16 @@
 
 regex = "@@(" + "|".join(aa_regex_map) + ")@@"
 
-print '" generated from apparmor.vim.in by create-apparmor.vim.py'
-print '" do not edit this file - edit apparmor.vim.in or create-apparmor.vim.py instead' + "\n"
+sys.stdout.write('" generated from apparmor.vim.in by create-apparmor.vim.py\n')
+sys.stdout.write('" do not edit this file - edit apparmor.vim.in or create-apparmor.vim.py instead' + "\n\n")
 
-with file("apparmor.vim.in") as template:
+with open("apparmor.vim.in") as template:
     for line in template:
         line = re.sub(regex, my_repl, line.rstrip())
-        print line
-
-print "\n\n\n"
-
-print '" file rules added with create_file_rule()'
-print re.sub(regex, my_repl, filerule)
+        sys.stdout.write('%s\n' % line)
+
+sys.stdout.write("\n\n\n\n")
+
+sys.stdout.write('" file rules added with create_file_rule()\n')
+sys.stdout.write(re.sub(regex, my_repl, filerule)+'\n')