modifying pkg-audit to ignore specified vulns

Hello,

I use periodic/security/410.pkg-audit as part of a Nagios reporting tool. This monitoring check lets me know when a particular host has a vuln. I have used it, or something like it, for years.

Alert fatigue is a real issue. Sometimes it takes months for given known vuln to be fixed. In the meantime, a sea of red covers the Nagios page making it difficult to see new / other vulns.

My goal: selectively silence a vuln.

Background: Back in April, I posted about this issue on Mastodon.  One solution, for ignoring vulns on a given port, worked.  https://bsd.network/web/@[email protected]/115925654143396302

However, now I want to modify this approach and ignore a list of vulns.

In short, alter 410.pkg-audit to use a user-specified file and to ignore upon any vulns specified in that file.

My short idea:

1 - use the --file option on pkg-audit
2 - using /var/db/pkg/vuln.xml as input, remove the vuln you don't want to see
3 - output the results to a new file, say: /var/db/pkg/vuln-filtered.xml
4 - run pkg-audit -f /var/db/pkg/vuln-filtered.xml

For step 2, the file is XML and I'm sure there are many tools to choose from which will delete based on vid in this:

6d3488ae-2e0f-11f1-88c7-00a098b42aeb
0be929a5-2e0f-11f1-88c7-00a098b42aeb

I'm posting in the hopes that someone takes up this challenge and codes something up. I'm happy to test, but can't do the coding.

-- 
  Dan Langille
  [email protected]