> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Resetting the Root Password
> Guide to reset the root password on RHEL 10 by booting an emergency shell, remounting root read write, setting a new password, and triggering SELinux relabeling
One of the most important recovery skills for a Linux administrator is resetting the root password. If the root password is lost or forgotten, administrative control of the entire system can be lost. This guide shows how to safely reset the root password from the boot process on RHEL 10 systems without reinstalling the OS.
By the end you will be able to:
* Boot into a limited emergency shell from GRUB.
* Remount the root filesystem read-write.
* Set a new root password.
* Trigger SELinux relabeling and resume a normal boot.
Overview of the steps:
* Edit the GRUB entry to boot a limited shell.
* Remount the root filesystem read-write.
* Set a new root password.
* Trigger an SELinux filesystem relabel and continue booting.
Quick summary table
| Step | Action | Command / Notes |
| - | - | - |
| 1 | Edit GRUB to boot a shell | Press `e` on the chosen kernel entry |
| 2 | Ensure root FS is writable | `mount -o remount,rw /` |
| 3 | Set the new password | `passwd root` |
| 4 | Ensure SELinux contexts are correct | `touch /.autorelabel` and reboot |
Prerequisites
* Physical console or remote KVM access to the system (required to edit GRUB).
* If the system uses full-disk LUKS encryption, be prepared to enter the passphrase during early boot.
* Access to the system console is a powerful privilege—protect it (see warning below).
Anyone with physical or console access can gain root by booting into a rescue/emergency shell. Secure the boot process (BIOS/UEFI protections, GRUB passwords, or secure management interfaces) to prevent unauthorized access.
Step-by-step
1. Reboot and enter GRUB edit mode
* Reboot the server. When the GRUB menu appears, use the arrow keys to highlight the kernel entry you want to boot, then press `e` to edit the selected entry.
You should see GRUB output similar to:
```bash theme={null}
GRUB version 2.12
*Red Hat Enterprise Linux (6.12.0-124.8.1.el10_1.x86_64) 10.1 (Coughlan)
Red Hat Enterprise Linux (0-rescue-500d9331afaf4b96957586d4650b73e2) 10.1 ->
Use the ↑ and ↓ keys to select which entry is highlighted.
Press enter to boot the selected OS, 'e' to edit the commands
before booting or 'c' for a command-line.
```
2. Edit the kernel command line
* Locate the line beginning with `linux` (sometimes `linux16` or referencing `vmlinuz`) and modify it:
* Change `ro` to `rw` if you want the kernel to mount root read-write immediately. Note: even if you change this, the emergency shell often mounts read-only, so remounting may still be necessary.
* Append `init=/bin/bash` to the end of the line so the kernel launches a shell as PID 1.
After editing, boot the modified entry (usually by pressing Ctrl+X).
Example edited `linux` line (wrapped for readability):
```text theme={null}
linux ($root)/vmlinuz-6.12.0-124.8.1.el10_1.x86_64 root=/dev/mapper/rhel-root rw \
crashkernel=2G-64G:256M,64G-:512M resume=UUID=f7ba6614-f5c1-4503-a64f-c804eda85768 \
rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet init=/bin/bash
```
3. Remount, reset password, and relabel SELinux
* The system will drop you to a `bash` prompt. Even if you set `rw`, the root filesystem is often mounted read-only in this mode. Execute the following commands from the emergency shell:
```bash theme={null}
# Remount the root filesystem read-write
mount -o remount,rw /
# Set a new root password
passwd root
# Tell SELinux to relabel the filesystem on next boot
touch /.autorelabel
# Continue the normal boot process
exec /sbin/init
```
Sample interaction:
```bash theme={null}
bash-5.2# mount -o remount,rw /
bash-5.2# passwd root
New password:
BAD PASSWORD: The password is shorter than 8 characters
Retype new password:
passwd: password updated successfully
bash-5.2# touch /.autorelabel
bash-5.2# exec /sbin/init
```
If SELinux is enabled, run `touch /.autorelabel` on RHEL systems after changing the root password from an emergency shell. Without relabeling, SELinux contexts may be incorrect and the system can fail to boot normally.
What happens next
* After `exec /sbin/init` the normal boot process resumes. During the next boot you will see SELinux relabeling messages; this can take time depending on filesystem size. Once relabeling completes, log in as `root` using the new password.
Troubleshooting and common issues
| Symptom | Likely cause / resolution |
| - | - |
| Still read-only after `rw` set | Emergency shell may still mount read-only; run `mount -o remount,rw /`. |
| System fails to boot after relabel | Allow relabeling to complete; if failure persists, boot rescue media and inspect `/var/log/audit/audit.log` or `/var/log/messages`. |
| LUKS passphrase prompt blocks editing | Enter the LUKS passphrase when prompted; GRUB editing only affects kernel args after decryption. |
Notes and security considerations
* Physical or console access is required to perform these steps; anyone with such access can gain root by booting into a rescue shell. Protect console/boot access accordingly (e.g., secure GRUB with a password or use appropriate BIOS/UEFI protections).
* If your environment uses full-disk encryption (LUKS), you will be prompted for the passphrase during early boot. You cannot bypass disk encryption by editing GRUB.
* Consider enabling a GRUB password or other boot-time protections in environments where physical access is not tightly controlled.
References
* RHEL Boot Process and GRUB: [https://access.redhat.com/documentation/en-us/red\_hat\_enterprise\_linux/](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/)
* SELinux and relabeling: [https://access.redhat.com/documentation/en-us/red\_hat\_enterprise\_linux/](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/)
This concludes the demo. You now know how to reset the root password on a RHEL 10 system from the boot menu and ensure SELinux relabeling so the system boots cleanly.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.