I am not sure, I feel like the answer is no but I honestly couldn't say for certain.
I have been noodling on the idea of trying to recursively descend using sqlite cte's as a workaround, but standard osquery recursive globbing would definitely be preferred.
t
theopolis
09/25/2020, 2:28 AM
I think the standard globbing is the expected behavior. If that has not worked in early 4.x versions or late 3.x versions it's a critical bug.
f
fritz
09/25/2020, 1:01 PM
@theopolis 👍 I just went back through 4 different versions of osquery and they are all affected so far as I can tell. I will submit a bug report.