revoke()

The evdev input driver opens /dev/input/eventX file descriptors. The same fd can be opened by another process allowing this process to read events coming from the devices. Currently, you need to be root to open the devices.

If the fd of a keyboard can be opened by a user, this user is able to read keyboard events. Example scenario:
1. user A logs in, /dev/input/event0 is opened as keyboard
2. user A starts keyboard sniffer on /dev/input/event0 because he or she has permissions to open this file.
3. user A uses fast user switching
4. user B logs in, /dev/input/event0 is opened as keyboard

Unless any process by user A can be suspended or revoked access to the fd, this process can sniff keyboard events from user B.