On Tue, 18 Aug 2026 12:14:14 -0400 "Dan Langille" <[email protected]> wrote:
> On Tue, Aug 18, 2026, at 9:17 AM, Michael Gmelin wrote: > > On Mon, 10 Aug 2026 16:27:41 -0400 > > "Dan Langille" <[email protected]> wrote: > > > >> Hello, > >> > >> I use periodic/security/410.pkg-audit as part of a Nagios reporting > >> tool. This monitoring check lets me know when a particular host > >> has a vuln. I have used it, or something like it, for years. > >> > >> Alert fatigue is a real issue. Sometimes it takes months for given > >> known vuln to be fixed. In the meantime, a sea of red covers the > >> Nagios page making it difficult to see new / other vulns. > >> > >> My goal: selectively silence a vuln. > >> > >> Background: Back in April, I posted about this issue on Mastodon. > >> One solution, for ignoring vulns on a given port, worked. > >> https://bsd.network/web/@[email protected]/115925654143396302 > >> > >> However, now I want to modify this approach and ignore a list of > >> vulns. > >> > >> In short, alter 410.pkg-audit to use a user-specified file and to > >> ignore upon any vulns specified in that file. > >> > >> My short idea: > >> > >> 1 - use the --file option on pkg-audit > >> 2 - using /var/db/pkg/vuln.xml as input, remove the vuln you don't > >> want to see 3 - output the results to a new file, say: > >> /var/db/pkg/vuln-filtered.xml 4 - run pkg-audit -f > >> /var/db/pkg/vuln-filtered.xml > >> > >> For step 2, the file is XML and I'm sure there are many tools to > >> choose from which will delete based on vid in this: > >> > >> 6d3488ae-2e0f-11f1-88c7-00a098b42aeb > >> 0be929a5-2e0f-11f1-88c7-00a098b42aeb > >> > >> I'm posting in the hopes that someone takes up this challenge and > >> codes something up. I'm happy to test, but can't do the coding. > >> > > > > Hi Dan, > > > > I've been using something like this locally for a while. I polished > > it a bit and added[0] it as security/periodic-filter-vuxml to the > > ports tree. It's intentionally simple, testing is welcome, see > > pkg-message for usage. > > > > It basically adds a periodic job that runs prior to > > 405/410.pkg-audit, which downloads the vulnerability database if > > needed and removes entries as configured. No component/code of pkg > > is modified. > > I like the independent-of-pkg approach, and the idea of running the > script just before is a good idea. > > At > https://cgit.freebsd.org/ports/tree/security/periodic-filter-vuxml/files/400.filter-vuxml.in#n80 > how does that for-loop work? I had anticipated some kind of xml / > perl script for that. This seems to be entirely bourne shell. What > magic is that? > It's assembling command line arguments to be fed to xmlstarlet in line 96 (delete by xpath specification). Cheers Michael -- Michael Gmelin
