The job of the kernel is to run one process: init, which gets process ID 1. It's init's job to run other processes to provide system services and allow users to log in.
There are a few other cases where the Linux kernel will execute a process. For example, when the kernel detects new hardware on certain buses, it executes modprobe
to load a driver as a module. Another example is that it's possible to configure a program to pipe core dumps through. I think all of these cases use the call_usermodehelper_xxx
functions.
You'll note that there are only very few cases, and they're all triggered by a kernel event: hardware event or program termination. These are exceptional cases, reserved for low-level system functionality. The normal way to execute a process is that it's forked from a process that's forked from a process that's … that's forked from init.
The kernel doesn't even know about a “successful login”. Logging in is a high-level concept, well above the kernel. To run a process as root when a user logs in, add it to the PAM configuration, with the pam_exec
module. To run a process as the user who logged in, add it to the user's shell startup file, typically ~/.profile
.