8.3 Interrupt the Boot Process to Gain Access

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

8.3 Interrupt the Boot Process to Gain Access

Key Takeaways Explain This Topic AI

Interrupt GRUB to edit the kernel command line when you need recovery access without a normal multi-user login.

A common RHEL pattern uses rd.break (initramfs emergency shell) to remount sysroot, chroot, and reset the root password.

After changing authentication data under SELinux, schedule a full relabel (/.autorelabel or fixfiles/touch patterns) so labels are correct on next boot.

Alternative recovery paths include systemd.unit=rescue.target or emergency.target from GRUB when the system can still reach those targets.

Always remount filesystems read-write before editing, write changes, and reboot cleanly; verify login and SELinux mode afterward.

Last updated: August 2026

8.3 Interrupt the Boot Process to Gain Access

Quick Answer: Interrupt GRUB , edit the kernel line, and use a recovery method such as rd.break (initramfs shell) or systemd.unit=emergency.target / rescue.target . For root password reset on RHEL: at the rd.break shell, remount /sysroot read-write, chroot /sysroot , run passwd , touch /.autorelabel (SELinux), exit, and reboot. Verify you can log in and that SELinux returns to enforcing after relabel.

Why “interrupt boot” is an RHCSA skill

Official wording: interrupt the boot process in order to gain access to a system . Real-world and exam situations include:

• Root password lost or never known on a lab clone
• Only console access; SSH keys broken
• System fails to reach multi-user because of a bad unit, but you can still edit from early boot
• Need a maintenance shell before services start

This is authorized recovery on systems you administer (including exam VMs). It is not a covert bypass of someone else’s machine security policy—treat it as break-glass administration.

Step 0: Reach the GRUB menu

Reboot the system ( systemctl reboot if you still can; otherwise use the hypervisor reset).

At GRUB, interrupt the automatic boot. Common patterns:

• Press Esc repeatedly during firmware/GRUB handoff
• On some BIOS GRUB installs, hold Shift
• UEFI systems vary—use whatever the lab shows (menu appears with kernel entries)

Highlight the default kernel entry.

Press e to edit.

You should see lines for linux / linuxefi and initrd / initrdefi . Only edit the kernel command line for these procedures unless a task says otherwise.

Boot the edited entry with Ctrl+x or F10 (platform-dependent).

Timeout tip: If the menu flies by, change GRUB timeout later with bootloader tools (separate objective). For recovery, be ready to press the interrupt key early.

Method A — rd.break (classic RHEL root password reset)

rd.break stops boot inside the initramfs before pivoting fully into the real root as a normal multi-user system. You get a shell with the real root filesystem available under /sysroot .

• 1) Edit GRUB kernel line
• On the linux / linuxefi line, append: rd.break

Optional hardening-related remove/alter: some guides also remove rhgb and quiet so messages are visible—not required for rd.break itself but helpful for seeing errors.

Do not invent random arguments. Keep existing root= , BOOT_IMAGE= , and resume parameters intact.

• 2) Boot and remount sysroot read-write
• At the switch_root:/# style prompt: mount -o remount,rw /sysroot

Without remount, passwd and file edits fail on a read-only tree.

3) chroot into the real system chroot /sysroot

Now / is the real root filesystem. Standard paths ( /etc/shadow , /bin/passwd ) apply.

• 4) Reset root password passwd
• # enter new password twice
• Or set a known password for a specific user if the task requires that account instead of root: passwd student
• 5) SELinux relabel (critical on enforcing systems)

Changing /etc/shadow (and related auth files) outside normal SELinux-aware flows can leave incorrect labels or require a full filesystem relabel so the next boot is healthy. Standard exam-safe pattern inside the chroot : touch /.autorelabel

On the next boot, SELinux performs a full relabel (can take noticeable time). The system may reboot again as part of the relabel workflow. Plan time for this on the exam.

• Alternative approaches seen in docs/labs (know the idea): # sometimes used in maintenance contexts
• fixfiles -F onboot
• # or restorecon on specific files when you know exactly what changed
• restorecon /etc/shadow /etc/security/opasswd 2>/dev/null

For full root password reset via rd.break , touch /.autorelabel is the widely taught durable pattern. Skipping relabel is a common reason login still fails or SELinux denials appear after “successful” passwd.

• 6) Exit cleanly and continue boot exit # leave chroot
• exit # leave rd.break shell / continue init
• # or reboot if instructed by the environment

Allow the system to boot; wait through autorelabel if scheduled; then log in with the new password.

• 7) Verify # after login
• whoami
• getenforce # expect Enforcing after relabel completes (unless task set permissive)
• sudo -v # if exercising sudo user

If getenforce is Permissive because you temporarily changed mode during repair, restore Enforcing when the task expects production defaults: sudo setenforce 1

• # and ensure /etc/selinux/config is SELINUX=enforcing for persistence when required
• Method B — Boot directly to emergency or rescue (systemd.unit=)

When the system can load the real root and systemd but you need a maintenance shell:

• Append to the kernel line: systemd.unit=emergency.target
• or systemd.unit=rescue.target

Then Ctrl+x to boot.

Authenticate with the existing root password if sulogin demands it.

If you do not know root’s password, emergency/rescue sulogin may block you—use rd.break (or equivalent initramfs break) instead, because that path lets you change the password before normal sulogin policies apply the same way.

• In emergency, remount if needed: mount -o remount,rw /
• passwd
• touch /.autorelabel
• systemctl reboot
• (Exact mount state varies; always check mount | grep ' / ' .)
• Method C — rw init=/bin/bash style (awareness)
• Older or generic Linux materials sometimes replace init: rw init=/bin/bash

on the kernel line. On modern RHEL with SELinux and complex initramfs, rd.break + chroot is the method Red Hat training historically emphasizes for password recovery. Prefer rd.break on RHEL 10 exam prep unless documentation for your exact release shows another supported flow.

SELinux and recovery — do not “fix” by leaving the machine insecure

• Bad habit Better approach
• Boot with selinux=0 forever Use temporary recovery; relabel; return to enforcing
• Leave SELINUX=permissive in /etc/selinux/config after reset Set enforcing if that is the required end state
• Skip /.autorelabel after shadow edits via chroot Schedule relabel so contexts match policy

Temporary kernel argument enforcing=0 can help some recovery scenarios (boot permissive for one boot). If you use it, understand it is one boot unless config files also change. Still run relabel after auth file changes when required.

When the problem is not the password

Interrupting boot also helps when:

• Symptom Recovery idea
• Bad /etc/fstab entry emergency/rescue or rd.break; remount rw; fix fstab; reboot
• Broken shell in root’s passwd field chroot; vipw or set shell to /bin/bash
• Typo in systemd unit preventing boot emergency; disable unit systemctl disable --now or fix drop-in
• Forgot network config rescue; fix NetworkManager keyfiles; reboot
• Example fstab fix mindset: mount -o remount,rw /
• vim /etc/fstab
• # comment out bad line or correct UUID
• systemctl daemon-reload
• reboot
• Console security note (exam realism)

Anyone with console + GRUB edit ability can often reset root on an unencrypted disk without a GRUB password. Production systems mitigate with:

• Firmware passwords
• GRUB password requiring authentication to edit entries
• Full-disk encryption (LUKS)—recovery then needs the passphrase

EX200 environments typically allow the recovery procedures above on unencrypted training disks. If LUKS is in play, you must unlock volumes before chroot—follow prompts in initramfs.

End-to-end exam checklist (root password reset)

Reboot → interrupt GRUB → e .

Append rd.break on kernel line → Ctrl+x.

• mount -o remount,rw /sysroot
• chroot /sysroot
• passwd (set root password meeting task policy)
• touch /.autorelabel
• exit ; exit (continue/reboot as needed)
• Wait for relabel/boot; log in; getenforce
• Confirm any task-specific users/services still correct
• Common traps

Forgetting remount rw — passwd fails or changes do not persist as expected.

Editing files in initramfs / instead of /sysroot — wrong tree; changes vanish.

Skipping chroot — tools may not see the real /etc/shadow .

Skipping /.autorelabel — SELinux pain after reset.

Using rescue.target when root password is unknown — sulogin blocks you.

Leaving the system in permissive/disabled SELinux when the exam expects enforcing.

Not waiting long enough for autorelabel and thinking the box is hung.

Typos on the GRUB line that break root= UUID parameters.

Relationship to other chapters

8.1 assumes you can still shut down/reboot normally; this section is when normal access is gone.

8.2 supplies systemd.unit= target selection used as Method B.

SELinux chapters deepen enforcing/permissive/ restorecon ; here you learn the must-not-skip relabel after offline credential changes.

Bootloader modification objectives cover permanent GRUB changes; recovery edits are ephemeral unless you also change grub config files.

Section checkpoint

You should interrupt GRUB, apply rd.break or target-based recovery, remount and chroot to the real root, reset passwords, schedule SELinux autorelabel, complete reboot, and verify login plus SELinux state. That is the EX200 meaning of interrupting boot to gain access—and of leaving the system correctly secured afterward.