I found the solution here where someone wanted the exact same thing in the case of a barcode reader:
https://serverfault.com/questions/385260/bind-usb-keyboard-exclusively-to-specific-application/976557#976557
SUBSYSTEM=="input", ACTION=="add", ATTRS{idVendor}=="xxxx", ATTRS{idProduct}=="yyyy", RUN+="/bin/sh -c 'echo remove > /sys$env{DEVPATH}/uevent'"
ACTION=="add", ATTRS{idVendor}=="xxxx", ATTRS{idProduct}=="yyyy", SYMLINK+="diykeyboard"
And then replace xxxx and yyyy by the Vendor and Product ID as found in lsusb. So in my case 1c4f and 0002:
Bus 001 Device 003: ID 1c4f:0002 SiGma Micro Keyboard TRACER Gamma Ivory
The udevadm control --reload thing didn't do it for me, I had to reboot.
Then in theory the data typed on the keyboard should be available at /dev/diykeyboard (the SYMLINK variable).
Now in my case unfortunately there are multiple events that match this vendor+product, and to match the right one I needed to add DEVPATH=="*:1.0/*", KERNEL=="event*" in the second line where it creates the SYMLINK. And then surprise it did not create the link in /dev so I had to do something dirty, create a link myself with ln:
SUBSYSTEM=="input", ACTION=="add", ATTRS{idVendor}=="1c4f", ATTRS{idProduct}=="0002", RUN+="/bin/sh -c 'echo remove > /sys$env{DEVPATH}/uevent'"
SUBSYSTEM=="input", ACTION=="add", ATTRS{idVendor}=="1c4f", ATTRS{idProduct}=="0002", DEVPATH=="*:1.0/*", KERNEL=="event*", RUN+="/bin/sh -c 'ln -sf /dev/input/$kernel /diykeyboard'"
(don't create the link in /tmp since udev happens before the mounting of /tmp at boot)
From there I can read from /diykeyboard (which usually points to /dev/input/event0) either with evtest which shows the keys typed, or directly with my program and then decoding the scancodes.
