diff --git a/Makefile.am b/Makefile.am
index 8153496ded5c7c3c51c69288ec37b9e947aab196..53026f0d4b8b9de636f6f2a47f464a4de7837acd 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -47,6 +47,7 @@ EXTRA_DIST = \
   AUTHORS.in \
   scripts/augeas-gentest.py \
   build-aux/check-spacing.pl \
+  scripts/check-aclperms.py \
   scripts/header-ifdef.py \
   scripts/minimize-po.py \
   scripts/mock-noinline.py \
diff --git a/scripts/check-aclperms.py b/scripts/check-aclperms.py
new file mode 100755
index 0000000000000000000000000000000000000000..b1084a3758ec49f37c3a34db1c01cceb1dda3a43
--- /dev/null
+++ b/scripts/check-aclperms.py
@@ -0,0 +1,75 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2013-2019 Red Hat, Inc.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library.  If not, see
+# <http://www.gnu.org/licenses/>.
+#
+# This script just validates that the stringified version of
+# a virAccessPerm enum matches the enum constant name. We do
+# a lot of auto-generation of code, so when these don't match
+# problems occur, preventing auth from succeeding at all.
+
+from __future__ import print_function
+
+import re
+import sys
+
+if len(sys.argv) != 3:
+    print("syntax: %s HEADER IMPL" % (sys.argv[0]), file=sys.stderr)
+    sys.exit(1)
+
+hdr = sys.argv[1]
+impl = sys.argv[2]
+
+perms = {}
+
+with open(hdr) as fh:
+    for line in fh:
+        symmatch = re.search(r"^\s+VIR_ACCESS_PERM_([_A-Z]+)(,?|\s|$)", line)
+        if symmatch is not None:
+            perm = symmatch.group(1)
+
+            if not perm.endswith("_LAST"):
+                perms[perm] = 1
+
+warned = False
+
+with open(impl) as fh:
+    group = None
+
+    for line in fh:
+        symlastmatch = re.search(r"VIR_ACCESS_PERM_([_A-Z]+)_LAST", line)
+        if symlastmatch is not None:
+            group = symlastmatch.group(1)
+        elif re.search(r'''"[_a-z]+"''', line) is not None:
+            bits = line.split(",")
+            for bit in bits:
+                m = re.search(r'''"([_a-z]+)"''', bit)
+                if m is not None:
+                    perm = (group + "_" + m.group(1)).upper()
+                    if perm not in perms:
+                        print("Unknown perm string %s for group %s" %
+                              (m.group(1), group), file=sys.stderr)
+                        warned = True
+
+                    del perms[perm]
+
+for perm in perms.keys():
+    print("Perm %s had not string form" % perm, file=sys.stderr)
+    warned = True
+
+if warned:
+    sys.exit(1)
+sys.exit(0)
diff --git a/src/Makefile.am b/src/Makefile.am
index d7e56aa62e41d0844d7fe18d372b3bf351ebd5c5..8df1d41c3c820de5c5b22e556c51803e4485afb7 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -350,11 +350,11 @@ check-aclrules:
 		$(STATEFUL_DRIVER_SOURCE_FILES)
 
 check-aclperms:
-	$(AM_V_GEN)$(PERL) $(srcdir)/check-aclperms.pl \
+	$(AM_V_GEN)$(RUNUTF8) $(PYTHON) $(top_srcdir)/scripts/check-aclperms.py \
 		$(srcdir)/access/viraccessperm.h \
 		$(srcdir)/access/viraccessperm.c
 
-EXTRA_DIST += check-driverimpls.pl check-aclrules.pl check-aclperms.pl
+EXTRA_DIST += check-driverimpls.pl check-aclrules.pl
 
 check-local: check-protocol check-symfile check-symsorting \
 	check-drivername check-driverimpls check-aclrules \
diff --git a/src/check-aclperms.pl b/src/check-aclperms.pl
deleted file mode 100755
index 55b6598313da3e504aa346b5f0e3bfc6f940a1b0..0000000000000000000000000000000000000000
--- a/src/check-aclperms.pl
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/usr/bin/env perl
-#
-# Copyright (C) 2013 Red Hat, Inc.
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-#
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Lesser General Public License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with this library.  If not, see
-# <http://www.gnu.org/licenses/>.
-#
-# This script just validates that the stringified version of
-# a virAccessPerm enum matches the enum constant name. We do
-# a lot of auto-generation of code, so when these don't match
-# problems occur, preventing auth from succeeding at all.
-
-my $hdr = shift;
-my $impl = shift;
-
-my %perms;
-
-my @perms;
-
-open HDR, $hdr or die "cannot read $hdr: $!";
-
-while (<HDR>) {
-    if (/^\s+VIR_ACCESS_PERM_([_A-Z]+)(,?|\s|$)/) {
-        my $perm = $1;
-
-        $perms{$perm} = 1 unless ($perm =~ /_LAST$/);
-    }
-}
-
-close HDR;
-
-
-open IMPL, $impl or die "cannot read $impl: $!";
-
-my $group;
-my $warned = 0;
-
-while (defined (my $line = <IMPL>)) {
-    if ($line =~ /VIR_ACCESS_PERM_([_A-Z]+)_LAST/) {
-        $group = $1;
-    } elsif ($line =~ /"[_a-z]+"/) {
-        my @bits = split /,/, $line;
-        foreach my $bit (@bits) {
-            if ($bit =~ /"([_a-z]+)"/) {
-                my $perm = uc($group . "_" . $1);
-                if (!exists $perms{$perm}) {
-                    print STDERR "Unknown perm string $1 for group $group\n";
-                    $warned = 1;
-                }
-                delete $perms{$perm};
-            }
-        }
-    }
-}
-close IMPL;
-
-foreach my $perm (keys %perms) {
-    print STDERR "Perm $perm had not string form\n";
-    $warned = 1;
-}
-
-exit $warned;