Best way to create rule for specific python script?

[mariomadproductions]

It seems like creating a regex that matches python3 /path/to/script.py and allows whatever after that string would be insecure, as you could just append ; some other script on the end, surely? Is there some non-regex way to do this? (some functionality that "understands" the command-line syntax?).

[gustavo-iniguez-goya]

That would not work. Appending ; to the end of a command is treated as a different command, so if the 2nd command opens a connection you'd be prompted to allow/deny it.

If you want to match exactly python3 /path/to/script.py you don't need a regex, just allow that command line. If you need to allow/deny certain arguments, then you could delimitate the end of the regex: ^python3 /path/to/script.py --option (xxx|yyy)$

If you have a real example, post it so I can take a look at it :)

[mariomadproductions]

Yeah basically I'd like to allow any argument to the script.
Real example:
python3 /home/user/bin/rom-get -u [url]
where [url] is a url

[gustavo-iniguez-goya]

The problem I see here is allowing that script to access any url. Probably you'll have a fixed number of urls that you'll use with the script, so you could enforce restrictions by allowing that script to access only to a list of urls:

[x] From this execuable: /usr/bin/python3
[x] From this command line:  ^(python3 /home/user/bin/rom-get \-u http(s|):\/\/.*)$
[x] From this user ID: 1000
[x] To this list of domains: /home/xxx/rom-get-allowed-urls.txt

Then add all the urls you use with script to the file rom-get-allowed-urls.txt

[mariomadproductions]

Thanks, that should be useful for multiple programs.