Description

Adds auto locking to the cluster protobuf. Also makes it so that the cluster configuration is used to control auto locking. Thus it will be possible to control process baseline auto locking at the cluster level. The feature flag is still in place and in order to enable process baseline auto locking for a cluster the feature flag needs to be enabled and it needs to be enabled for the cluster via the cluster config.

After this change it will not be possible to control this new cluster field via helm or operator. That will be done in other PRs.

The PR to control process baseline auto-locking via helm can be found here #16462

The PR to control process baseline auto-locking via operator can be found here #16697

This PR replaces #16427

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

et the following environment variables

export ROX_BASELINE_GENERATION_DURATION=5m
export ROX_AUTOLOCK_PROCESS_BASELINES=true

Deployed ACS.

Created a pod that could be used to run some processes and entered it.

kubectl run ubuntu-pod --image=ubuntu --restart=Never --command -- sleep infinity
kubectl exec ubuntu-pod -it -- /bin/bash

Logged into the UI and checked "Risk".

The process baseline was still unlocked after more than five minutes.

Ran the following script to enable process baseline auto locking for the cluster

#!/usr/bin/env bash
set -eou pipefail

ROX_ENDPOINT=${1:-https://localhost:8000}

start_time=$(date +%s)

json_clusters="$(curl --location --silent --request GET "${ROX_ENDPOINT}/v1/clusters" -k -H "Authorization: Bearer $ROX_API_TOKEN")"

json_cluster="$(echo "$json_clusters" | jq .clusters.[0])"
id="$(echo "$json_cluster" | jq -r .id)"

json_cluster="$(echo "$json_cluster" | jq '.dynamicConfig.autoLockProcessBaselines.enabled = true')"
echo "$json_cluster" | jq

echo
echo
echo
echo

json_clusters_response="$(curl --location --silent --request PUT "${ROX_ENDPOINT}/v1/clusters/${id}" -k -H "Authorization: Bearer $ROX_API_TOKEN" --data "$json_cluster")"

json_clusters="$(curl --location --silent --request GET "${ROX_ENDPOINT}/v1/clusters" -k -H "Authorization: Bearer $ROX_API_TOKEN")"
echo "$json_clusters" | jq

Created another pod, entered it, and ran a command

kubectl run ubuntu-pod-2 --image=ubuntu --restart=Never --command -- sleep infinity
kubectl exec ubuntu-pod-2 -it -- /bin/bash
cat /proc/1/net/tcp

Initially the process baseline is unlocked.

After a little more than five minutes the baseline is locked.

Running a new process results in a violation

tac /proc/1/net/tcp