Hey folks, I have an issue and I don't know if it's an osquery or fleet issue. The TL;DR is we're using the new

es_fim_enable_open_events

feature in the 5.10.1 pre-release, but every time we make a change to a query in fleet, we see:

Scheduled query has been updated: pack/MacPack/sensitive_file_monitoring
Monitoring path: /Users/clong/.ssh/id_rsa.pub
Monitoring path: /Users/clong/.ssh/id_rsa
etc...

This implies to me that due to a change in the query, osquery has decided to recreate all the file monitoring destination paths. However, the issue is that instead of just monitoring the paths that we've specified, after the config refresh, we start getting events for all files on disk, not just what's specified by the config here:

overrides:
      platforms:
        darwin:
          file_paths:
            aws:
            - /Users/*/.aws/*
            azure:
            - /Users/*/.azure/*.json
            chrome:
            - /Users/*/Library/Application\ Support/Google/Chrome/*/Bookmarks
            - /Users/*/Library/Application\ Support/Google/Chrome/*/Cookies
            - /Users/*/Library/Application\ Support/Google/Chrome/*/History
            - /Users/*/Library/Application\ Support/Google/Chrome/*/Login\ Data
            gcloud:
            - /Users/*/.config/gcloud/*.db
            - /Users/*/.config/gcloud/*.json
            - /Users/*/.config/gcloud/legacy_credentials/*
            - /Users/*/.config/gcloud/cache/*
            - /Users/*/.config/gcloud/configurations/*
            jamf:
            - /usr/local/jamf/bin/jamf
            keychain:
            - /Library/Keychains/*.keychain
            safari:
            - /Users/*/Library/Safari/History.db
            slack:
            - /Users/*/Library/Application\ Support/Slack/storage
            ssh:
            - /Users/*/.ssh/*

TL;DR - whenever osquery reboots due to watchdog or we update a query server-side on fleet, osquery seemingly does not create the file monitoring targets correctly and "fails open" for lack of better terminology

At every config refresh interval (set in osquery), if the configuration that osquery pulls from the backend (in this case FleetDM) has changed, it will indeed call the configure logic of the event publisher: https://github.com/osquery/osquery/blob/f1b6f3c49bf37d641dbf768302c0de9c2a747772/osquery/events/darwin/endpointsecurity_fim.cpp#L74