The syscall interface is how applications request kernel services. It is not a general mechanism for the kernel to start userspace applications.
HAL and udev are mechanisms intended to give the kernel a flexible way to invoke userspace applications when events such as "hardware device connection" occur. They certainly are less than perfect, but they are a lot better than a new kernel module for every device in the world. As I understand it, HAL and udev use syscalls to tell the kernel "I'm listening; tell me when something of interest happens" and then try to be helpful when notified of events. This is a sensible strategy, but we still have much to learn about how to use it most effectively. I was not aware of the "global label glitch" for udev rules, but it seems a good example of where improvement is needed. The hardware target moves rapidly (device manufacturers seem obsessed with a need to make esoteric, incompatible products - SANE authors may have unsurpassed experience with this) and until it stops, no scheme is likely to be completely satisfactory. More general message passing schemes (like D-bus) may offer more sophisticated event-handling frameworks that supplant (or augment) udev and HAL in the future. Clearly, we are short of any consensus about best practice in this area.
