Loading...

VONDS ©

Lab 54: Recover Root Password (Simulation)

Lab Index

Recover access when the root password is unknown by using a controlled GRUB edit to boot into a minimal rescue shell. Load SELinux policy, remount the root filesystem read-write, reset the password, trigger a relabel, and return to normal boot.

boot security troubleshooting

Scenario

The root password is forgotten. You have console access and must regain root by editing the GRUB boot entry. Your goal is to boot into a rescue shell, ensure SELinux policy is loaded before making changes, reset the root password safely, trigger an SELinux relabel, and reboot back into normal mode.

Operator context

This workflow is a standard recovery procedure for RHEL-like systems. In production, access to the console and the boot loader is a privileged capability and must be treated as a security boundary.

Objective

  • Interrupt GRUB and enter edit mode.
  • Append a kernel argument to boot into a minimal shell.
  • Boot the modified entry.
  • Load SELinux policy in the rescue shell.
  • Remount / read-write.
  • Reset the root password.
  • Create /.autorelabel to relabel on next boot.
  • Continue booting into normal mode.

What You’ll Practice

  • GRUB edit workflow (console access, modify boot entry).
  • Rescue boot technique using an init override (init=/bin/sh).
  • SELinux policy handling in rescue mode (load_policy).
  • Remounting a filesystem read-write for controlled changes (mount -o remount,rw /).
  • Password reset procedure using passwd.
  • Triggering SELinux relabel via /.autorelabel.
  • Returning to normal boot with exec /sbin/init.

Walkthrough

Step 1 : Interrupt GRUB and edit the selected boot entry.
Action 
e

On reboot, interrupt the boot loader and edit the current boot entry. This provides a one-time, in-memory change for recovery without permanently modifying the GRUB configuration. 

(GRUB edit screen opens)
Step 2 : Append a kernel argument to boot into a minimal shell.
Command 
init=/bin/sh

Appending init=/bin/sh changes the init process for this boot so the system drops directly into a minimal shell. This is a controlled recovery mode used to regain access when authentication is blocked.

Step 3 : Boot the modified entry.
Action 
Ctrl+x
# OR
F10

Booting the edited entry applies the changes for this session only. Once the system starts, you should land in a shell prompt without a standard login sequence. 

[  OK  ] Started dracut pre-pivot and cleanup hook.
[  OK  ] Reached target Switch Root.
Switching root.
/bin/sh: can't access tty; job control turned off
sh-5.1#
Step 4 : Load SELinux policy before making changes.
Command 
/usr/sbin/load_policy -i

Loading policy ensures SELinux permission checks behave predictably for recovery actions. It also reduces the chance of booting back into a system with mislabeled or blocked authentication state. 

/usr/sbin/load_policy:  done
Step 5 : Remount the root filesystem read-write.
Command 
mount -o remount,rw /

In this recovery mode, the root filesystem is typically mounted read-only. You must remount it read-write before changing account data.

Step 6 : Reset the root password.
Command 
passwd

Running passwd updates the root password. In a rescue environment, this is the direct mechanism to regain login capability. 

New password:
Retype new password:
passwd: all authentication tokens updated successfully.
Step 7 : Trigger SELinux relabel on next boot.
Command 
touch /.autorelabel

Creating /.autorelabel instructs the system to relabel files on the next boot. This is a standard safety step after making sensitive changes from a rescue shell.

Step 8 : Continue booting into normal mode.
Command 
exec /sbin/init

exec /sbin/init replaces the current rescue shell with the normal init process so the system can complete boot. If /.autorelabel is present, relabeling may take time and should be allowed to finish. 

system is rebooting...
SELinux relabel may take several minutes.

Reference

  • e : Enters GRUB edit mode for the selected boot entry.
  • init=/bin/sh : Overrides the init process for a single boot and drops to a minimal shell for recovery.
  • Ctrl+x / F10 : Boots the modified GRUB entry.
  • /usr/sbin/load_policy -i : Loads SELinux policy in rescue mode so permission checks behave consistently.
    • -i : Initializes the policy load for the current runtime.
  • mount -o remount,rw / : Remounts the root filesystem read-write to allow changes.
    • remount : Changes mount options without unmounting.
    • rw : Enables read-write access.
  • passwd : Resets the password for the current user (root in this context).
  • touch /.autorelabel : Triggers SELinux relabel on the next boot.
  • exec /sbin/init : Starts the normal init process to resume standard boot.
    • exec : Replaces the current shell with the specified process.