// learn · linux · rhcsa · 9 min

GRUB & rescue boot.

When the system won't boot, GRUB is your seat at the wheel. Edit the kernel command line for one boot, drop into rd.break to reset root, or boot into rescue/emergency targets to fix fstab. This is the lesson that turns a 3 a.m. call into a 3-minute fix.

GRUB and rescue boot animated tutorial. Editing the GRUB menu with 'e', adding rd.break or init=/bin/bash to the kernel command line, single-user mode, rescue.target and emergency.target, password reset workflow with SELinux relabel, and persisting changes with grubby. RHCSA EX200 ready.
// grub & rescue boot

When the system won't boot or you've lost root, GRUB is your seat at the wheel. Six steps from menu to fix.

// before you start
you should know
  • ·The boot-process lesson
  • ·Comfortable in a Bash shell
  • ·SELinux contexts lesson (relabel concept)
by the end you'll

Edit the GRUB cmdline for one boot, use rd.break to reset root, drop into rescue/emergency targets, and persist cmdline changes with grubby.

pace: 9 minutes

grub / rescue — step 1 / 6 · the menu
GNU GRUB version 2.06 — use ↑/↓ · enter · e · c
▶ Red Hat Enterprise Linux 9 (5.14.0-411.el9.x86_64)
Red Hat Enterprise Linux 9 (5.14.0-362.el9.x86_64)
Red Hat Enterprise Linux 9 (rescue) - 5.14.0-411
The highlighted entry will be executed automatically in 4s.

The GRUB menu — your one chance to intervene

On boot, GRUB shows a menu listing kernel entries (current, previous, rescue). It auto-boots the highlighted entry after a few seconds — press any key to pause the timeout. ↑/↓ to pick; press `e` to EDIT the selected entry for ONE boot (great for rescue), or `c` to drop to a GRUB command line. Whatever you do here doesn't persist unless you also run grubby afterwards.

$press any key
$press e
$press c
// key insight

GRUB editing is one-shot rescue; grubby is permanent. After rd.break, two things are non-obvious but mandatory: mount -o remount,rw /sysroot and chroot /sysroot. And after any write inside the rescue chroot, touch /.autorelabel to keep SELinux happy. Forget that and login fails after reboot.

// exam-ready · the rescue toolkit
$[in GRUB] e
$[in GRUB] Ctrl-X / F10
$append: rd.break
$append: init=/bin/bash
$append: single
$append: systemd.unit=rescue.target
$append: systemd.unit=emergency.target
$mount -o remount,rw /sysroot
$chroot /sysroot
$passwd root
$touch /.autorelabel
$systemctl isolate rescue.target
$systemctl default
$grubby --info=ALL
$grubby --update-kernel=ALL --args="X"
$grub2-mkconfig -o /boot/grub2/grub.cfg
// check yourself
4 quick questions
Q1

You can't log in as root and SSH key auth isn't set up. You're at the GRUB menu. What's the move?

Q2

What's the difference between rescue.target and emergency.target?

Q3

You appended an arg in the GRUB editor and it worked. Two days later, after a reboot, the arg is gone. Why, and how do you make it stick?

Q4

After rd.break, you're in a shell with / mounted at /sysroot. What two things must you do before commands like `passwd root` behave normally?

These aren't graded — they're just for active recall, which is what actually makes the lesson stick.

🎚️
// related

Kernel parameters & tuned

Every cmdline arg you add here is a boot-time kernel parameter. See the full picture — boot args vs sysctl, and how tuned bundles them.

open →

Read this lesson as text6 chapters · quiz answers

  1. 01The GRUB menu — your one chance to intervene

    On boot, GRUB shows a menu listing kernel entries (current, previous, rescue). It auto-boots the highlighted entry after a few seconds — press any key to pause the timeout. ↑/↓ to pick; press e to EDIT the selected entry for ONE boot (great for rescue), or c to drop to a GRUB command line. Whatever you do here doesn't persist unless you also run grubby afterwards.

    • $ press any key — pause the auto-boot timer
    • $ press e — edit the highlighted entry (one boot)
    • $ press c — GRUB command line

  2. 02Edit the kernel command line for one boot

    After 'e', you see the entry's grub.cfg snippet. Find the linux (or linuxefi) line — that's the kernel + its cmdline. Append args at the end. Common rescue moves: rd.break (stop in initramfs before pivot), init=/bin/bash (skip systemd, drop to a shell), single (single-user mode), selinux=0 (disable SELinux temporarily). Ctrl-X (or F10) to boot with the edited cmdline. Reboot reverts.

    • $ append: rd.break — stop in initramfs (best for root reset)
    • $ append: init=/bin/bash — bypass systemd entirely
    • $ append: single — single-user mode
    • $ Ctrl-X / F10 — boot with the edited line

  3. 03rd.break — the rescue dropzone

    rd.break stops the boot in the initramfs (the tiny RAM disk before the real root is mounted) and gives you a switch_root shell. The real root is mounted READ-ONLY at /sysroot. Two steps to make it useful: remount it rw with mount -o remount,rw /sysroot, then chroot /sysroot to make /sysroot look like /. Now your normal commands work against the real system.

    • $ mount -o remount,rw /sysroot — real root rw
    • $ chroot /sysroot — make it /
    • $ # now you're inside the real system — as root

  4. 04Reset a forgotten root password

    Inside the chroot from rd.break: passwd root sets a new password. Now the SELinux relabel step — files written from the rescue chroot don't get correct SELinux contexts, so create the trigger touch /.autorelabel to force a full relabel on the next boot (slow but safe). exit the chroot, exit again, system continues. Next boot relabels, then you log in with the new password.

    • $ passwd root — set new password
    • $ touch /.autorelabel — trigger SELinux relabel
    • $ exit — leave chroot
    • $ exit — leave initramfs shell — boot continues

  5. 05Rescue and emergency targets

    Two systemd boot targets exist for trouble. rescue.target (or the older single) drops you to a root shell AFTER mounting the local filesystems — good for fixing fstab. emergency.target is more minimal: root shell with /sysroot mounted read-only and nothing else — for when even rescue.target won't reach. Pick either by appending systemd.unit=rescue.target (or emergency.target) to the cmdline.

    • $ append: systemd.unit=rescue.target — root shell, FSes mounted
    • $ append: systemd.unit=emergency.target — minimal — / read-only
    • $ systemctl isolate rescue.target — switch to it without rebooting
    • $ systemctl default — back to the default target

  6. 06Make a cmdline change PERMANENT — grubby

    Anything you appended in the GRUB editor lasts one boot. To persist it across all installed kernels, use grubby: grubby --update-kernel=ALL --args="quiet selinux=0". Remove with --remove-args. Alternative: edit GRUB_CMDLINE_LINUX in /etc/default/grub and regenerate (grub2-mkconfig -o /boot/grub2/grub.cfg). grubby is safer — it edits the live menu entries without regenerating the whole config.

    • $ grubby --info=ALL — args per kernel entry
    • $ grubby --update-kernel=ALL --args="quiet" — add a permanent arg
    • $ grubby --update-kernel=ALL --remove-args="quiet" — remove one
    • $ /etc/default/grub → grub2-mkconfig -o /boot/grub2/grub.cfg — the older two-step

Quiz — answers

You can't log in as root and SSH key auth isn't set up. You're at the GRUB menu. What's the move?
→Press 'e' to edit, append rd.break to the linux line, boot with Ctrl-X. In the initramfs shell: remount /sysroot rw, chroot /sysroot, passwd root, touch /.autorelabel, exit, exit.rd.break is the standard RHEL root-reset path. The SELinux relabel step (touch /.autorelabel) is critical — without it, the new shadow file has a wrong context and login fails after reboot. The relabel is slow but happens once.
What's the difference between rescue.target and emergency.target?
→rescue.target = root shell with the local filesystems mounted (good for fixing fstab errors). emergency.target = minimal root shell with just the root FS mounted read-only (for when even rescue won't reach).Use rescue when you need /etc, /var, /home mounted to fix something. Use emergency when the system can't even reach rescue (often a broken /etc/fstab making non-root mounts fail).
You appended an arg in the GRUB editor and it worked. Two days later, after a reboot, the arg is gone. Why, and how do you make it stick?
→Edits made via 'e' last ONE boot only. Persist with grubby --update-kernel=ALL --args="..." (or edit /etc/default/grub and run grub2-mkconfig).The GRUB editor is for one-shot rescue, by design. grubby is the supported way to add/remove args across all installed kernels; it's safer than hand-editing grub.cfg (which is regenerated).
After rd.break, you're in a shell with / mounted at /sysroot. What two things must you do before commands like passwd root behave normally?
→Remount /sysroot read-write (mount -o remount,rw /sysroot), then chroot into it (chroot /sysroot) so /sysroot becomes /.rd.break drops you in initramfs with /sysroot mounted ro. Remount rw so you can change things; chroot so /etc/passwd etc. resolve to the real system's files. Then your normal commands work as expected.
// more in linux

keep going — these pair well with what you just learned.

see all linux →
🛡️

SELinux contexts

Why Apache can't read your file. Watch the policy engine decide — and learn the workflow for fixing denials. RHCSA-ready.

8 min · interactiveopen →
⚡

Linux boot process

From power button to login prompt. Every stage in the chain — UEFI, GRUB, kernel, initramfs, systemd — with the rescue moves that save you. RHCSA-ready.

9 min · interactiveopen →
💾

LVM stacking

Layer-by-layer build of an LVM stack: disks → PVs → VG → LVs → filesystem. Then extend live and snapshot. RHCSA-ready.

8 min · interactiveopen →

See also

the boot processall lessons