This keeps all existing permissions, and adds a few that were out of sync:
- /usr/lib*/python3./lib-dynload/.so missed 3.1[0-9]
- /usr/lib/python3/... was missing, only /usr/local/python3/ was allowed
Also add several permissions:
- allow reading .so.
- allow directory listings in .../site-packages/
- allow reading various metadata files
These additions are based on denials seen on openSUSE Leap 15.3 with python 3.9.
I propose this patch for 3.0 and master.