Program to capture the keyboard via the kernel ?

-- 
I have a program 'xspy' which capture the keys on a keyboard via X11.
But i have to do an xhost + and launch xspy in the xdm file Xsetup_0.
I'm looking for a program talking directly to the kernel to capture the
keyboard, without any change for the user.
This user like to delete files and ask me to restore them, especially
when i warn everybody that there a failure in the backup system (Backup
UNET, do NEVER buy it!). How can i be sure he's a #_at_$!_at_!* ? 
Does such a program exist ? Does the accounting do that ?
How can i configure the accounting for this ?
Help me please
Thanks.
        Pierre Didierjean - cisitm_at_come.cad.cea.fr - ATHESA
    Aix-en-Provence, France 	     | Opinions expressed are my own and 
    Phone : (33) 42.25.35.51	     | not necessarily those of my agency.