In text console there is a getty program waiting for user login. It writes 'login:' and other messages. It is working in init environment. When getty gets user to log in to the system, it invokes the 'login' program. This program sets the user environment and invokes the shell.
Login program sets path as defined in /usr/include/paths.h. This 'login path' is different for root users and other users.
for common users (_PATH_DEFPATH):
for root (_PATH_DEFPATH_ROOT):/usr/local/bin:/usr/bin:/bin:.
/sbin:/bin:/usr/sbin:/usr/bin
Common user's path does not contain any sbin directories. However, it contains the current directory, '.', which is considered dangerous for the root user. Not even /usr/local/bin is available for the root user.
Login path is often overwritten by shell initialization. However, it is possible to use other programs in /etc/passwd as user shells. For example, I have used the following line to start PPP when I log in using special user name. In this case, the pppd has exactly login path.
etu-ppp:viYabVlxPwzDl:1000:1000:Esa Turtiainen, PPP:/:/usr/sbin/pppd