Comment by rawicki

Nothing stops them from writing a minimal kernelspace driver that sends events to the userspace part and evaluates rules there.