Interrupt the boot process to gain access to a system

4. Operate Running Systems

📘Red Hat Certified System Administrator (RHCSA – EX200)

This topic is about recovering access to a Linux system when you cannot log in normally, often because:

You forgot the root password.
There is a system problem that prevents normal login.

In Red Hat-based systems (RHEL, CentOS, Rocky Linux, AlmaLinux), this is done by interrupting the boot process and using single-user mode or emergency mode.

1. Understanding the Boot Process

Linux systems start with several stages:

BIOS/UEFI – the firmware that starts the system hardware.
Bootloader (GRUB2) – the program that lets you choose which kernel to boot.
Kernel initialization – loads the Linux kernel and drivers.
Systemd/init – starts services, users, and graphical interface.

To interrupt the boot process, we act at the GRUB2 stage, before the kernel fully starts.

2. Using GRUB2 to Interrupt Boot

Step 1: Access the GRUB2 menu

When the system starts, press any key during the boot countdown to open GRUB2.
If GRUB doesn’t appear automatically, press Esc or Shift (depends on BIOS/UEFI).

Step 2: Edit the boot entry

Use the arrow keys to highlight the kernel you want to boot.
Press e to edit the boot commands.
Find the line starting with linux or linux16. It specifies the kernel and boot options.

Step 3: Modify the boot parameters

Go to the end of the line.
Replace rhgb quiet (if present) with rd.break.
- rd.break stops booting just before the root filesystem is mounted.

This gives you a root shell in initramfs, a minimal environment.

Step 4: Boot into modified entry

Press Ctrl + x to boot.
You will now have root access to repair the system.

3. Gaining Root Access

Once in initramfs shell:

Remount the root filesystem as read-write:

mount -o remount,rw /sysroot

Switch to the real root environment:

chroot /sysroot

Now you are effectively root on the system and can perform administrative tasks, such as:

Resetting passwords: passwd root
Fixing configuration files
Repairing broken boot settings

Exit and reboot:

exit   # leave chroot
exit   # leave initramfs shell

The system will continue booting normally.

4. Emergency Mode (Alternative Approach)

Sometimes you can use emergency mode:

At GRUB, add systemd.unit=emergency.target to the kernel line.
This boots into a minimal environment with root access, but network and normal services are off.
Useful for fixing files or recovering the system without full boot.

5. Important Notes for the Exam

You must know how to edit GRUB2 entries using the keyboard.
You must know rd.break and systemd.unit=emergency.target usage.
Understand remounting root and chroot to gain access.
You do not need to know the underlying BIOS/UEFI details, just GRUB and kernel boot parameters.
These skills are tested under time pressure, so practice in a VM.

6. Practical IT Examples

Forgot root password: Use rd.break to reset it.
Corrupted configuration: Boot into emergency mode to edit /etc/fstab or /etc/passwd.
Rescue a VM remotely: Modify GRUB in VM console to recover system without reinstalling.

✅ Key Commands Summary

Task	Command
Edit GRUB entry	`e` at boot menu
Interrupt boot	Add `rd.break`
Boot into emergency	Add `systemd.unit=emergency.target`
Remount root RW	`mount -o remount,rw /sysroot`
Change root environment	`chroot /sysroot`
Reset root password	`passwd root`
Continue boot	`exit` (twice)

This process is a critical RHCSA skill for system recovery and is often tested in time-limited scenarios. Students should practice in a virtual machine to become confident.