I've actually thought about this for a bit and it's not as complicated. If a physical keyboard is present, the program is assigned to the keyboard of the curre

I've actually thought about this for a bit and it's not as complicated. If a physical keyboard is present, the program is assigned to the keyboard of the current user's seat (works with sudo since that only sets effective UID/GID not real UID/GID) Additionally, a program with root privileges (or a special CAP) can register itself as a HID in which case the SAM captures any HID's + keyboards of the current seat. Any complex setup would therefore be pushed out of the kernel but still provide reasonable security. An additional edgecase can be seen in debuggers which can be reasonably circumvented by having the SAM mode provide a few pages of memory that aren't mapped into any memory but the current process so a debugger can't read the password. A software keylogger would require strict root privileges to circumvent this system.