@Nico this has been asked about before (not recently) so there might be some discussion in the Slack history. But, porting to a platform like Android would be almost as big as rewriting osquery. It's not only compiling all of the library dependencies for Android, it also requires rewritten or new virtual tables to collect from platform-specific APIs, and whether it has the permissions necessary to provide useful collection. Then there's the question of how it would run as a daemon on Android. If someone had the time (really, the funding because time is money) to contribute such a large contribution to osquery, it should probably be done incrementally, with a roadmap. It's too early to estimate a timeline, without a roadmap and some dedicated people. But it's definitely more than several months of work.
06/03/2021, 6:52 AM
@Mike Myers There is a discussion in the Slack history, but not much and you just gave me a more detailled answer. Thank you Mike!