311 Role vbotka.freebsd.packages¶
Use case¶
Install packages in Ansible clients using the role vbotka.freebsd.packages. Audit installed packages.
Tree¶
shell> tree .
.
├── ansible.cfg
├── group_vars
│ └── all
│ └── ansible-client.yml
├── hosts
│ ├── 02_iocage.yml
│ └── 99_constructed.yml
├── iocage-hosts.ini
└── pb-test-01.yml
Synopsis¶
Playbook pb-test-01.yml:
display variables
install packages
audit installed packages
Requirements¶
running jails at the iocage host.
Notes¶
Jail name doesn’t work in the parameter name of the module community.general.pkgng if the jail was created by iocage. Use JID instead.
The below plays run at the jails. The inventory iocage-hosts.ini is needed when a task is delegated to an iocage host.
The public key in files/pk_admins.txt is sanitized.
See also
Warning
vbotka.freebsd.packages is the role packages in the collection vbotka.freebsd
vbotka.freebsd_packages is the role freebsd_packages in the namespace vbotka
Please make sure the versions are the same before you switch between them.
List jails at iocage_02¶
[iocage_02]# iocage list -l
+-----+----------+------+-------+------+-----------------+--------------------+-----+----------------+----------+
| JID | NAME | BOOT | STATE | TYPE | RELEASE | IP4 | IP6 | TEMPLATE | BASEJAIL |
+=====+==========+======+=======+======+=================+====================+=====+================+==========+
| 12 | afa9e515 | off | up | jail | 14.1-RELEASE-p6 | epair0b|10.1.0.122 | - | ansible_client | no |
+-----+----------+------+-------+------+-----------------+--------------------+-----+----------------+----------+
| 11 | c1670497 | off | up | jail | 14.1-RELEASE-p6 | epair0b|10.1.0.135 | - | ansible_client | no |
+-----+----------+------+-------+------+-----------------+--------------------+-----+----------------+----------+
| 10 | test_111 | off | up | jail | 14.1-RELEASE-p6 | em0|10.1.0.111/24 | - | ansible_client | no |
+-----+----------+------+-------+------+-----------------+--------------------+-----+----------------+----------+
Configuration ansible.cfg¶
Do not display skipped hosts. See the option display_skipped_hosts
[defaults]
gathering = explicit
callback_result_format = yaml
display_skipped_hosts = false
[connection]
pipelining = true
Inventory hosts/02_iocage.yml¶
plugin: vbotka.freebsd.iocage
host: 10.1.0.73
user: admin
env:
CRYPTOGRAPHY_OPENSSL_NO_LEGACY: 1
get_properties: True
hooks_results:
- /var/db/dhclient-hook.address.epair0b
compose:
ansible_host: (iocage_hooks.0 == '-') | ternary(iocage_ip4, iocage_hooks.0)
iocage_tags: dict(iocage_properties.notes | split | map('split', '='))
Inventory hosts/99_constructed.yml¶
plugin: ansible.builtin.constructed
groups:
up: iocage_state == 'up'
Variables group_vars/all/ansible-client.yml¶
ansible_python_interpreter: auto_silent
freebsd_install_method: packages
freebsd_install_retries: 3
freebsd_install_delay: 5
pkg_delegate: "{{ iocage_tags.vmm }}"
pkg_jail: "{{ iocage_jid }}"
pkg_list:
- security/sudo
- lang/python311
- ports-mgmt/pkg
Display inventory¶
(env) > ansible-inventory -i hosts -i iocage-hosts.ini --graph
@all:
|--@ungrouped:
|--@up:
| |--afa9e515
| |--c1670497
| |--test_111
|--@iocage:
| |--iocage_01
| |--iocage_02
Playbook pb-test-01.yml¶
- name: Test role vbotka.freebsd.packages.
hosts: up
gather_facts: true
remote_user: admin
become: true
roles:
- vbotka.freebsd.packages
Playbook output. Display variables.¶
Limit the inventory to one jail test_111
(env) > ansible-playbook pb-test-01.yml -i hosts -l test_111 \
-t pkg_debug \
-e pkg_debug=true
PLAY [Test role vbotka.freebsd.packages.] *****************************************************
TASK [Gathering Facts] ************************************************************************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] ********************************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Debug pkg_debug=true] ***********************************
ok: [test_111] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
TASK [vbotka.freebsd.packages : Debug pkg_debug=true] *****************************************
ok: [test_111] =>
msg: |-
pkg_role_version: 2.7.0
pkg_version_community_general: 9.3.0
ansible_architecture: amd64
ansible_os_family: FreeBSD
ansible_distribution: FreeBSD
ansible_distribution_major_version: 14
ansible_distribution_version: 14.1
ansible_distribution_release: 14.1-RELEASE
ansible_python_version: 3.11.11
freebsd_install_method: packages
freebsd_install_retries: 3
freebsd_install_delay: 5
pkg_sanity: True
pkg_sanity_version_community_general: True
pkg_stat: False
pkg_audit_enable: False
pkg_backup_conf: False
pkg_dryrun: False
pkg_install_individually: False
pkg_delegate: "iocage_02"
pkg_owner: root
pkg_group: wheel
pkg_annotation: UNDEFINED
pkg_autoremove: UNDEFINED
pkg_cached: UNDEFINED
pkg_chroot: UNDEFINED
pkg_ignore_osver: UNDEFINED
pkg_jail: 10
pkg_pkgsite: UNDEFINED
pkg_rootdir: UNDEFINED
pkg_state: UNDEFINED
pkg_use_globs: UNDEFINED
pkg_default_repo_template: repo.j2
pkg_default_repo_conf:
[]
pkg_repos_template: repo.j2
pkg_repos_conf_clean: False
pkg_repos_conf:
[]
pkg_dict_all: False
pkg_dict_select:
[]
pkg_dict:
[]
pkg_list:
[security/sudo, lang/python311, ports-mgmt/pkg]
pkg_list_deinstall:
[]
PLAY RECAP ************************************************************************************
test_111: ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Playbook output. Install packages.¶
The inventory iocage-hosts.ini is needed to delegate the tasks Install list pkg_list
(env) > ansible-playbook pb-test-01.yml -i hosts -i iocage-hosts.ini
PLAY [Test role vbotka.freebsd.packages.] *****************************************************
TASK [Gathering Facts] ************************************************************************
ok: [afa9e515]
ok: [c1670497]
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] ********************************
ok: [afa9e515]
ok: [c1670497]
ok: [test_111]
TASK [vbotka.freebsd.packages : Sanity: Test collection community_general minimal version 9.3.0]
ok: [afa9e515]
ok: [c1670497]
ok: [test_111]
TASK [vbotka.freebsd.packages : Sanity: Required variable pkg_jail when pkg_delegate] *********
ok: [afa9e515]
ok: [c1670497]
ok: [test_111]
TASK [vbotka.freebsd.packages : Packages_install: Install list pkg_list] **********************
ok: [test_111 -> iocage_02(10.1.0.73)]
ok: [afa9e515 -> iocage_02(10.1.0.73)]
ok: [c1670497 -> iocage_02(10.1.0.73)]
PLAY RECAP ************************************************************************************
afa9e515: ok=5 changed=0 unreachable=0 failed=0 skipped=37 rescued=0 ignored=0
c1670497: ok=5 changed=0 unreachable=0 failed=0 skipped=36 rescued=0 ignored=0
test_111: ok=5 changed=0 unreachable=0 failed=0 skipped=36 rescued=0 ignored=0
Hint
Optionally, do not display OK hosts. See display_ok_hosts
Playbook output. Install packages. Enable debug.¶
Enable debug and limit the inventory to one jail test_111
(env) > ansible-playbook pb-test-01.yml -i hosts -i iocage-hosts.ini -l test_111 \
-e pkg_debug=true
PLAY [Test role vbotka.freebsd.packages.] *****************************************************
TASK [Gathering Facts] ************************************************************************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] ********************************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Debug pkg_debug=true] ***********************************
ok: [test_111] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
TASK [vbotka.freebsd.packages : Sanity: Test collection community_general minimal version 9.3.0]
ok: [test_111]
TASK [vbotka.freebsd.packages : Sanity: Required variable pkg_jail when pkg_delegate] *********
ok: [test_111]
TASK [vbotka.freebsd.packages : Debug pkg_debug=true] *****************************************
ok: [test_111] =>
msg: |-
pkg_role_version: 2.7.0
pkg_version_community_general: 9.3.0
ansible_architecture: amd64
ansible_os_family: FreeBSD
ansible_distribution: FreeBSD
ansible_distribution_major_version: 14
ansible_distribution_version: 14.1
ansible_distribution_release: 14.1-RELEASE
ansible_python_version: 3.11.11
freebsd_install_method: packages
freebsd_install_retries: 3
freebsd_install_delay: 5
pkg_sanity: True
pkg_sanity_version_community_general: True
pkg_stat: False
pkg_audit_enable: False
pkg_backup_conf: False
pkg_dryrun: False
pkg_install_individually: False
pkg_delegate: "iocage_02"
pkg_owner: root
pkg_group: wheel
pkg_annotation: UNDEFINED
pkg_autoremove: UNDEFINED
pkg_cached: UNDEFINED
pkg_chroot: UNDEFINED
pkg_ignore_osver: UNDEFINED
pkg_jail: 10
pkg_pkgsite: UNDEFINED
pkg_rootdir: UNDEFINED
pkg_state: UNDEFINED
pkg_use_globs: UNDEFINED
pkg_default_repo_template: repo.j2
pkg_default_repo_conf:
[]
pkg_repos_template: repo.j2
pkg_repos_conf_clean: False
pkg_repos_conf:
[]
pkg_dict_all: False
pkg_dict_select:
[]
pkg_dict:
[]
pkg_list:
[security/sudo, lang/python311, ports-mgmt/pkg]
pkg_list_deinstall:
[]
TASK [vbotka.freebsd.packages : Conf: Debug pkg_debug=true] ***********************************
ok: [test_111] =>
msg: |-
pkg_owner: root
pkg_group: wheel
pkg_backup_conf: False
pkg_default_repo_template: repo.j2
pkg_default_repo_conf:
[]
pkg_repos_template: repo.j2
pkg_repos_conf:
[]
TASK [vbotka.freebsd.packages : Packages_install: Debug list pkg_list pkg_debug=true] *********
ok: [test_111] =>
pkg_list:
- security/sudo
- lang/python311
- ports-mgmt/pkg
TASK [vbotka.freebsd.packages : Packages_install: Install list pkg_list] **********************
ok: [test_111 -> iocage_02(10.1.0.73)]
TASK [vbotka.freebsd.packages : Packages_install: Debug result pkg_debug=true] ****************
ok: [test_111] =>
result:
attempts: 1
changed: false
failed: false
msg: package(s) already present
stderr: ''
stderr_lines: []
stdout: |-
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
stdout_lines:
- Updating FreeBSD repository catalogue...
- FreeBSD repository is up to date.
- All repositories are up to date.
PLAY RECAP ************************************************************************************
test_111: ok=10 changed=0 unreachable=0 failed=0 skipped=32 rescued=0 ignored=0
Playbook output. Install packages. Enable cache.¶
Select the tag pkg_install skipping sanity tasks. Do not update FreeBSD repository catalogue by setting pkg_cached=true
(env) > ansible-playbook pb-test-01.yml -i hosts -i iocage-hosts.ini -l test_111 \
-t pkg_install \
-e pkg_debug=true -e pkg_cached=true
PLAY [Test role vbotka.freebsd.packages.] *****************************************************
TASK [Gathering Facts] ************************************************************************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] ********************************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Debug pkg_debug=true] ***********************************
ok: [test_111] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
TASK [vbotka.freebsd.packages : Packages_install: Debug list pkg_list pkg_debug=true] *********
ok: [test_111] =>
pkg_list:
- security/sudo
- lang/python311
- ports-mgmt/pkg
TASK [vbotka.freebsd.packages : Packages_install: Install list pkg_list] **********************
ok: [test_111 -> iocage_02(10.1.0.73)]
TASK [vbotka.freebsd.packages : Packages_install: Debug result pkg_debug=true] ****************
ok: [test_111] =>
result:
attempts: 1
changed: false
failed: false
msg: package(s) already present
stderr: ''
stderr_lines: []
stdout: ''
stdout_lines: []
PLAY RECAP ************************************************************************************
test_111: ok=6 changed=0 unreachable=0 failed=0 skipped=15 rescued=0 ignored=0
Playbook output. Audit installed packages.¶
There are no installed packages with known vulnerabilities
(env) > ansible-playbook pb-test-01.yml -i hosts \
-t pkg_stat \
-e pkg_stat=true -e pkg_audit_enable=true -e pkg_debug=true
PLAY [Test role vbotka.freebsd.packages.] *****************************************************
TASK [Gathering Facts] ************************************************************************
ok: [afa9e515]
ok: [c1670497]
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] ********************************
ok: [afa9e515]
ok: [c1670497]
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Debug pkg_debug=true] ***********************************
...
TASK [vbotka.freebsd.packages : Stat: Get pkg audit] ******************************************
ok: [test_111]
ok: [afa9e515]
ok: [c1670497]
TASK [vbotka.freebsd.packages : Stat: Debug pkg audit pkg_debug=true] *************************
ok: [afa9e515] =>
pkg_audit:
afa9e515:
pkg_count: 0
c1670497:
pkg_count: 0
test_111:
pkg_count: 0
PLAY RECAP ************************************************************************************
afa9e515: ok=5 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
c1670497: ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
test_111: ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Playbook output. Audit installed packages at iocage_02¶
There are 9 packages with known vulnerabilities
(env) > ansible-playbook pb-test-02.yml -i iocage-hosts.ini -l iocage_02 \
-t pkg_stat \
-e pkg_stat=true -e pkg_audit_enable=true -e pkg_debug=true
PLAY [Test role vbotka.freebsd.packages.] ******************************************************************
TASK [Gathering Facts] *************************************************************************************
ok: [iocage_02]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] *********************************************
ok: [iocage_02]
TASK [vbotka.freebsd.packages : Vars: Debug pkg_debug=true] ************************************************
ok: [iocage_02] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
TASK [vbotka.freebsd.packages : Stat: Get pkg audit] *******************************************************
ok: [iocage_02]
TASK [vbotka.freebsd.packages : Stat: Debug pkg audit pkg_debug=true] **************************************
ok: [iocage_02] =>
pkg_audit:
iocage_02:
packages:
cups:
issue_count: 1
issues:
- Affected versions:
- < 2.4.11
cve:
- CVE-2024-47176
- CVE-2024-47175
- CVE-2024-47076
description: cups-filters -- remote code execution
url: https://vuxml.FreeBSD.org/freebsd/24375796-7cbc-11ef-a3a9-001cc0382b2f.html
reverse dependencies:
- gtk3
version: 2.4.10_1
emacs-nox:
issue_count: 1
issues:
- Affected versions:
- < 30.1,3
cve:
- CVE-2025-1244
description: Emacs -- Arbitrary code execution vulnerability
url: https://vuxml.FreeBSD.org/freebsd/e60e538f-e795-4a00-b475-cc85a7546e00.html
reverse dependencies: []
version: 29.4,3
expat:
issue_count: 1
issues:
- Affected versions:
- < 2.6.3
cve:
- CVE-2024-45492
- CVE-2024-45491
- CVE-2024-45490
description: expat -- multiple vulnerabilities
url: https://vuxml.FreeBSD.org/freebsd/ca5f3bbc-7a62-11ef-9533-f875a43e1796.html
reverse dependencies:
- mesa-dri
- xorg-server
- nvidia-driver-304
- mesa-libs
- git
- py311-iocage
- apache24
- mod_php83
- apr
- dbus-glib
- avahi-app
- cups
- gtk3
- fontconfig
- ffmpeg
- libass
- librsvg2-rust
- pango
- cairo
- libXft
- dbus
- at-spi2-core
- colord
- polkit
- wayland
- libva
- vulkan-loader
- libplacebo
- libxkbcommon
version: 2.6.2
git:
issue_count: 1
issues:
- Affected versions:
- < 2.48.1
cve:
- CVE-2024-52006
- CVE-2024-50349
description: git -- multiple vulnerabilities
url: https://vuxml.FreeBSD.org/freebsd/3445e4b6-d2b8-11ef-9ff3-43c2b5d6c4c8.html
reverse dependencies:
- py311-iocage
version: 2.46.0
openssl:
issue_count: 1
issues:
- Affected versions:
- < 3.0.15,1
cve:
- CVE-2024-6119
- CVE-2024-5535
description: OpenSSL -- Multiple vulnerabilities
url: https://vuxml.FreeBSD.org/freebsd/21f505f4-6a1c-11ef-b611-84a93843eb75.html
reverse dependencies:
- ssmtp
- mod_php83
- acme-tiny
- git
- py311-iocage
- wget
- rsync
- rsnapshot
- apache24
- apr
- curl
- rust
- libevent
- avahi-app
- cups
- gtk3
- ruby
- portupgrade
- ruby32-bdb
- p5-Net-SSLeay
- p5-IO-Socket-SSL
- libssh2
- db18
- py311-cryptography
- py311-dnspython
- py311-aioquic
- py311-service-identity
- py311-certbot
- py311-openssl
- py311-acme
- py311-josepy
- py311-ansible-core
- py311-ansible-lint
- py311-ansible-compat
- py311-ansible
- py311-ansible-runner
version: 3.0.14,1
py311-Jinja2:
issue_count: 1
issues:
- Affected versions:
- < 3.1.4
cve:
- CVE-2024-34064
description: Jinja2 -- Vulnerable to HTML attribute injection
when passing user input as keys to xmlattr filter
url: https://vuxml.FreeBSD.org/freebsd/04c9c3f8-5ed3-11ef-8262-b0416f0c4c67.html
reverse dependencies:
- py311-ansible-core
- py311-ansible-lint
- py311-ansible-compat
- py311-ansible
- py311-ansible-runner
version: 3.1.3
py311-configobj:
issue_count: 1
issues:
- Affected versions:
- <= 5.0.8
cve:
- CVE-2023-26112
description: Configobj -- Regular Expression Denial of Service
attack
url: https://vuxml.FreeBSD.org/freebsd/46419e8c-65d9-11ef-ac06-b0416f0c4c67.html
reverse dependencies:
- py311-certbot
version: 5.0.8
rsync:
issue_count: 1
issues:
- Affected versions:
- < 3.4.0
cve:
- CVE-2024-12747
- CVE-2024-12088
- CVE-2024-12087
- CVE-2024-12086
- CVE-2024-12085
- CVE-2024-12084
description: rsync -- Multiple security fixes
url: https://vuxml.FreeBSD.org/freebsd/163edccf-d2ba-11ef-b10e-589cfc10a551.html
reverse dependencies:
- rsnapshot
version: 3.3.0
xorg-server:
issue_count: 1
issues:
- Affected versions:
- < 21.1.16,1
cve:
- CVE-2025-26601
- CVE-2025-26600
- CVE-2025-26599
- CVE-2025-26598
- CVE-2025-26597
- CVE-2025-26596
- CVE-2025-26595
- CVE-2025-26594
description: xorg server -- Multiple vulnerabilities
url: https://vuxml.FreeBSD.org/freebsd/f4297478-fa62-11ef-b597-001fc69cd6dc.html
reverse dependencies:
- nvidia-driver-304
version: 21.1.14,1
pkg_count: 9
PLAY RECAP *************************************************************************************************
iocage_02: ok=5 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0