stackrox · JoukoVirtanen · Aug 20, 2025 · Aug 6, 2025 · Aug 6, 2025 · Aug 7, 2025
diff --git a/central/alert/service/service_impl.go b/central/alert/service/service_impl.go
@@ -299,7 +299,7 @@ func (s *serviceImpl) ResolveAlert(ctx context.Context, req *v1.ResolveAlertRequ
 				ClusterId:     alert.GetDeployment().GetClusterId(),
 				Namespace:     alert.GetDeployment().GetNamespace(),
 			}
-			baseline, err := s.baselines.UpdateProcessBaselineElements(ctx, key, items, nil, false)
+			baseline, err := s.baselines.UpdateProcessBaselineElements(ctx, key, items, nil, false, false)
 			if err != nil {
 				return nil, err
 			}

diff --git a/central/detection/lifecycle/manager.go b/central/detection/lifecycle/manager.go
@@ -4,6 +4,7 @@ import (
 	"time"
 
 	"github.com/stackrox/rox/central/activecomponent/updater/aggregator"
+	clusterDatastore "github.com/stackrox/rox/central/cluster/datastore"
 	"github.com/stackrox/rox/central/deployment/cache"
 	deploymentDatastore "github.com/stackrox/rox/central/deployment/datastore"
 	"github.com/stackrox/rox/central/deployment/queue"
@@ -14,6 +15,7 @@ import (
 	baselineDataStore "github.com/stackrox/rox/central/processbaseline/datastore"
 	processDatastore "github.com/stackrox/rox/central/processindicator/datastore"
 	"github.com/stackrox/rox/central/reprocessor"
+	"github.com/stackrox/rox/central/sensor/service/connection"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/process/filter"
@@ -42,18 +44,20 @@ type Manager interface {
 	DeploymentRemoved(deploymentID string) error
 	RemovePolicy(policyID string) error
 	RemoveDeploymentFromObservation(deploymentID string)
+	SendBaselineToSensor(baseline *storage.ProcessBaseline) error
 }
 
 // newManager returns a new manager with the injected dependencies.
 func newManager(buildTimeDetector buildtime.Detector, deployTimeDetector deploytime.Detector, runtimeDetector runtime.Detector,
-	deploymentDatastore deploymentDatastore.DataStore, processesDataStore processDatastore.DataStore, baselines baselineDataStore.DataStore,
-	alertManager alertmanager.AlertManager, reprocessor reprocessor.Loop, deletedDeploymentsCache cache.DeletedDeployments, filter filter.Filter,
-	processAggregator aggregator.ProcessAggregator) *managerImpl {
+	clusterDatastore clusterDatastore.DataStore, deploymentDatastore deploymentDatastore.DataStore, processesDataStore processDatastore.DataStore,
+	baselines baselineDataStore.DataStore, alertManager alertmanager.AlertManager, reprocessor reprocessor.Loop, deletedDeploymentsCache cache.DeletedDeployments,
+	filter filter.Filter, processAggregator aggregator.ProcessAggregator, connectionManager connection.Manager) *managerImpl {
 	m := &managerImpl{
 		buildTimeDetector:       buildTimeDetector,
 		deployTimeDetector:      deployTimeDetector,
 		runtimeDetector:         runtimeDetector,
 		alertManager:            alertManager,
+		clusterDataStore:        clusterDatastore,
 		deploymentDataStore:     deploymentDatastore,
 		processesDataStore:      processesDataStore,
 		baselines:               baselines,
@@ -70,6 +74,8 @@ func newManager(buildTimeDetector buildtime.Detector, deployTimeDetector deployt
 
 		removedOrDisabledPolicies: set.NewStringSet(),
 		processAggregator:         processAggregator,
+
+		connectionManager: connectionManager,
 	}
 
 	go m.flushQueuePeriodically()

diff --git a/central/detection/lifecycle/manager_impl.go b/central/detection/lifecycle/manager_impl.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/stackrox/rox/central/activecomponent/updater/aggregator"
+	clusterDatastore "github.com/stackrox/rox/central/cluster/datastore"
 	"github.com/stackrox/rox/central/deployment/cache"
 	deploymentDatastore "github.com/stackrox/rox/central/deployment/datastore"
 	"github.com/stackrox/rox/central/deployment/queue"
@@ -20,9 +21,12 @@ import (
 	baselineDataStore "github.com/stackrox/rox/central/processbaseline/datastore"
 	processIndicatorDatastore "github.com/stackrox/rox/central/processindicator/datastore"
 	"github.com/stackrox/rox/central/reprocessor"
+	"github.com/stackrox/rox/central/sensor/service/connection"
+	"github.com/stackrox/rox/generated/internalapi/central"
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/concurrency"
 	"github.com/stackrox/rox/pkg/env"
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/policies"
 	"github.com/stackrox/rox/pkg/postgres/pgutils"
 	"github.com/stackrox/rox/pkg/process/filter"
@@ -40,7 +44,7 @@ import (
 var (
 	lifecycleMgrCtx = sac.WithGlobalAccessScopeChecker(context.Background(),
 		sac.AllowFixedScopes(sac.AccessModeScopeKeys(storage.Access_READ_ACCESS, storage.Access_READ_WRITE_ACCESS),
-			sac.ResourceScopeKeys(resources.Alert, resources.Deployment, resources.Image,
+			sac.ResourceScopeKeys(resources.Alert, resources.Deployment, resources.Image, resources.Cluster,
 				resources.DeploymentExtension, resources.WorkflowAdministration, resources.Namespace)))
 
 	genDuration = env.BaselineGenerationDuration.DurationSetting()
@@ -62,6 +66,7 @@ type managerImpl struct {
 
 	alertManager alertmanager.AlertManager
 
+	clusterDataStore        clusterDatastore.DataStore
 	deploymentDataStore     deploymentDatastore.DataStore
 	processesDataStore      processIndicatorDatastore.DataStore
 	baselines               baselineDataStore.DataStore
@@ -81,6 +86,8 @@ type managerImpl struct {
 	removedOrDisabledPolicies set.StringSet
 
 	processAggregator aggregator.ProcessAggregator
+
+	connectionManager connection.Manager
 }
 
 func (m *managerImpl) copyAndResetIndicatorQueue() map[string]*storage.ProcessIndicator {
@@ -248,6 +255,37 @@ func (m *managerImpl) buildMapAndCheckBaseline(indicatorSlice []*storage.Process
 	}
 }
 
+func (m *managerImpl) SendBaselineToSensor(baseline *storage.ProcessBaseline) error {
+	err := m.connectionManager.SendMessage(baseline.GetKey().GetClusterId(), &central.MsgToSensor{
+		Msg: &central.MsgToSensor_BaselineSync{
+			BaselineSync: &central.BaselineSync{
+				Baselines: []*storage.ProcessBaseline{baseline},
+			}},
+	})
+	if err != nil {
+		log.Errorf("Error sending process baseline to cluster %q: %v", baseline.GetKey().GetClusterId(), err)
+		return err
+	}
+	log.Infof("Successfully sent process baseline to cluster %q: %s", baseline.GetKey().GetClusterId(), baseline.GetId())
+
+	return nil
+}
+
+// Perhaps the cluster config should be kept in memory and calling the database should not be needed
+func (m *managerImpl) isAutolockEnabledForCluster(clusterId string) bool {
+	cluster, found, err := m.clusterDataStore.GetCluster(lifecycleMgrCtx, clusterId)
+
+	if !found || err != nil {
+		return false
+	}
+
+	return cluster.GetDynamicConfig().GetAutolockProcessBaseline().GetEnabled()
+}
+
+func checkIfBaselineCanBeSkipped(elements []*storage.BaselineItem, inObservation bool, baseline *storage.ProcessBaseline, autolockEnabled bool) bool {
+	return len(elements) == 0 && (inObservation || !autolockEnabled || processbaseline.IsUserLocked(baseline))
+}
+
 func (m *managerImpl) checkAndUpdateBaseline(baselineKey processBaselineKey, indicators []*storage.ProcessIndicator) (bool, error) {
 	key := &storage.ProcessBaselineKey{
 		DeploymentId:  baselineKey.deploymentID,
@@ -256,15 +294,19 @@ func (m *managerImpl) checkAndUpdateBaseline(baselineKey processBaselineKey, ind
 		Namespace:     baselineKey.namespace,
 	}
 
+	autolockEnabled := features.AutoLockProcessBaselines.Enabled() && m.isAutolockEnabledForCluster(baselineKey.clusterID)
+
 	// TODO joseph what to do if exclusions ("baseline" in the old non-inclusive language) doesn't exist?  Always create for now?
 	baseline, exists, err := m.baselines.GetProcessBaseline(lifecycleMgrCtx, key)
 	if err != nil {
 		return false, err
 	}
 
+	inObservation := m.deploymentObservationQueue.InObservation(key.GetDeploymentId())
+
 	// If the baseline does not exist AND this deployment is in the observation period, we
 	// need not process further at this time.
-	if !exists && m.deploymentObservationQueue.InObservation(key.GetDeploymentId()) {
+	if !exists && inObservation {
 		return false, nil
 	}
 
@@ -286,22 +328,63 @@ func (m *managerImpl) checkAndUpdateBaseline(baselineKey processBaselineKey, ind
 		insertableElement := &storage.BaselineItem{Item: &storage.BaselineItem_ProcessName{ProcessName: baselineItem}}
 		elements = append(elements, insertableElement)
 	}
-	if len(elements) == 0 {
+
+	if checkIfBaselineCanBeSkipped(elements, inObservation, baseline, autolockEnabled) {
 		return false, nil
 	}
+
 	if !exists {
-		_, err = m.baselines.UpsertProcessBaseline(lifecycleMgrCtx, key, elements, true, true)
+		userLock := autolockEnabled && !inObservation
+		upsertedBaseline, err := m.baselines.UpsertProcessBaseline(lifecycleMgrCtx, key, elements, true, true, userLock)
+		if err != nil {
+			return false, err
+		}
+		if userLock {
+			err = m.SendBaselineToSensor(upsertedBaseline)
+		}
 		return false, err
 	}
 
 	userBaseline := processbaseline.IsUserLocked(baseline)
 	roxBaseline := processbaseline.IsRoxLocked(baseline) && hasNonStartupProcess
-	if userBaseline || roxBaseline {
+	reprocessRisk := userBaseline || roxBaseline
+
+	if reprocessRisk {
 		// We already checked if it's in the baseline and it is not, so reprocess risk to mark the results are suspicious if necessary
 		m.reprocessor.ReprocessRiskForDeployments(baselineKey.deploymentID)
-	} else {
-		// So we have a baseline, but not locked.  Now we need to add these elements to the unlocked baseline
-		_, err = m.baselines.UpdateProcessBaselineElements(lifecycleMgrCtx, key, elements, nil, true)
+	}
+
+	if !autolockEnabled {
+		if !reprocessRisk {
+			_, err := m.baselines.UpdateProcessBaselineElements(lifecycleMgrCtx, key, elements, nil, true, false)
+			if err != nil {
+				return false, err
+			}
+		}
+		return userBaseline, nil
+	}
+
+	// If this point is reached AutoLockProcessBaselines is enabled.
+	// When AutoLockProcessBaselines we don't need to do anything if the baseline is user or stackrox locked.
+	// However, if the feature is enabled we need to user lock it if it is not user locked. It also needs to be
+	// stackrox locked if it is neither user locked or stackrox locked.
+	if !userBaseline {
+		// If the baseline is out of observation it needs to be user locked.
+		// Since we are here the baseline is not user locked and if it isn't stackrox locked either,
+		// it needs to be updated.
+		userLock := !inObservation
+		if userLock || !roxBaseline {
+			upsertedBaseline, err := m.baselines.UpdateProcessBaselineElements(lifecycleMgrCtx, key, elements, nil, true, userLock)
+			if err != nil {
+				return false, err
+			}
+			if userLock {
+				err := m.SendBaselineToSensor(upsertedBaseline)
+				if err != nil {
+					return false, err
+				}
+			}
+		}
 	}
 
 	return userBaseline, err