I'm a sudoer. I'd like to set something up that whenever (non-sudoer) user student1 is logged in, all keystrokes are logged so that I can later (sudo) review them; student1 should not be able to kill the process; I don't care if they're able to see their own keylog history. No other user should be keylogged, though.
Ideally, if student1 is logged in and then someone switches user (without logging out) to student2, student2's keystrokes would not be logged.
I imagine something can be cobbled together with logkeys and daemons, but would appreciate the details of how to do so. (Other solutions are welcome too.)
(Assume a Debian-based distro, if it matters.)