LFCS 71 🐧 Boot Recovery — Single-User Mode - KandZ

⏱️ Estimated read: 11 min | |

Single-user mode is the boot state in which the system starts with minimal services and presents a root shell without requiring the normal multi-user login sequence. On systemd systems, the equivalent states are rescue.target (single-user mode, local filesystems mounted, networking stopped) and emergency.target (root mounted read-only, almost nothing else). The distinction matters for recovery: rescue.target is sufficient for most password and service repairs, while emergency.target is used when the filesystem configuration itself is broken .

This chapter covers the two routes into single-user mode, the GRUB kernel parameter that selects each route, the read-write remount that almost every recovery task requires, and the SELinux relabeling step that is easy to forget and produces a confusing login failure when omitted.

Key point: The kernel parameter systemd.unit=rescue.target boots to rescue mode with the root password prompt. The parameter init=/bin/bash bypasses systemd entirely and drops to a root shell with no password prompt, but the filesystem remains read-only until it is explicitly remounted. The second option is the one used when the root password is lost.

Why single-user mode exists

The authentication deadlock problem. A system whose root password is unknown cannot be repaired through normal login. Single-user mode provides a path that runs before the login prompt, allowing an administrator with console access to reset the credential. The parameter init=/bin/bash is the most direct form: the kernel executes Bash as PID 1 instead of systemd, and Bash does not ask for a password .

The service interference problem. A service that hangs during startup or a configuration file that fails validation can prevent the system from reaching a login prompt. Single-user mode starts only the minimum required to provide a shell, bypassing the services that would otherwise block recovery. This is why it is used for repairing a broken /etc/fstab or disabling a failing unit .

The read-only default problem. The kernel mounts the root filesystem read-only by default during recovery boot. This is a safety measure: if the filesystem is corrupted or the configuration is broken, a read-only mount prevents further damage. The recovery procedure must include an explicit remount to read-write before any changes are made .

The SELinux relabel problem. On SELinux-enabled systems, changing the root password modifies /etc/shadow. If the SELinux context of that file becomes inconsistent, the login prompt rejects the new password even though it was set correctly. Creating /.autorelabel before rebooting forces a relabel on the next boot, which resolves the inconsistency .

a. Route One: systemd rescue target

The systemd.unit=rescue.target parameter boots the system into rescue mode, which mounts local filesystems and starts a root shell. If the root account has a password, the shell prompts for it before granting access. If the root account has no password, the shell is granted without a prompt .

# At the GRUB menu, highlight the kernel entry and press e
# Locate the line beginning with "linux"
# Append the parameter to the end of that line
systemd.unit=rescue.target

# Press Ctrl+X or F10 to boot

After the shell is available, the filesystem must be remounted read-write before any repair.

# Remount the root filesystem read-write
mount -o remount,rw /

The rescue.target route is appropriate when the root password is known or when the repair does not involve authentication. It is also the safer choice for filesystem repairs because systemd has already mounted the filesystems in a known state, which reduces the risk of corrupting a filesystem that the kernel has not fully initialized.

b. Route Two: init=/bin/bash

When the root password is unknown, rescue.target is not usable because it prompts for the password that is missing. The init=/bin/bash parameter bypasses systemd entirely. The kernel executes Bash as the init process, and no authentication occurs .

# At the GRUB menu, highlight the kernel entry and press e
# Locate the line beginning with "linux"
# Replace "ro" with "rw" and append the init parameter
rw init=/bin/bash

# On RHEL-family systems, the line may contain "ro" followed by other parameters
# The "ro" must be changed to "rw" for the filesystem to be writable

The rw replacement is the difference between a shell that cannot modify anything and a shell that can reset the password. If the line is left as ro, passwd will fail with a read-only filesystem error, and the error message does not always explain that the mount option is the cause .

# Verify that the filesystem is writable
mount | grep " / "

# If it shows "ro", remount it
mount -o remount,rw /

# Reset the root password
passwd root

# On SELinux systems, create the relabel trigger
touch /.autorelabel

# Exit or continue the boot
exec /sbin/init

The exec /sbin/init command replaces the Bash process with systemd, continuing the normal boot sequence without a reboot. This is faster than a full reboot and is the standard way to exit init=/bin/bash mode on systems that support it .

c. The SELinux Relabel Step

On RHEL, CentOS, Fedora, and other SELinux-enforcing systems, the touch /.autorelabel step is not optional. Without it, the next boot attempts to log in with the new password, and the login fails because the SELinux context of /etc/shadow was not updated when the file was modified .

# Create the relabel trigger
touch /.autorelabel

# On the next boot, SELinux relabels the filesystem
# This can take several minutes on a large filesystem
# The system reboots automatically after relabeling completes

The relabel is a full filesystem pass. On a system with many files, it can add several minutes to the boot time. This is expected behavior, not a hang. The login prompt appears after the relabel completes and the system reboots .

Complete Example Session

# ============================================
# PART 1: ACCESS THE CONSOLE
# ============================================
# Single-user mode requires console access
# Cloud: use the provider's VNC or serial console
# Physical: use a keyboard and monitor
# SSH does not work for this procedure


# ============================================
# PART 2: INTERRUPT THE GRUB MENU
# ============================================
# Reboot the system
# On BIOS systems: hold Shift as the firmware screen clears
# On UEFI systems: tap Esc repeatedly
# When the GRUB menu appears, press any arrow key to stop the countdown


# ============================================
# PART 3: EDIT THE KERNEL ENTRY
# ============================================
# Highlight the normal boot entry and press e
# Use the arrow keys to locate the line beginning with "linux"
# This line may wrap across multiple visual lines


# ============================================
# PART 4: MODIFY THE PARAMETERS
# ============================================
# For rescue.target (root password known):
#   Append: systemd.unit=rescue.target
#
# For init=/bin/bash (root password lost):
#   Replace "ro" with "rw"
#   Append: init=/bin/bash


# ============================================
# PART 5: BOOT WITH THE MODIFIED PARAMETERS
# ============================================
# Press Ctrl+X or F10
# The system boots into the selected recovery mode


# ============================================
# PART 6: REMOUNT THE FILESYSTEM
# ============================================
# For rescue.target: filesystems are mounted, remount root rw
mount -o remount,rw /

# For init=/bin/bash: root is read-only, remount rw
mount -o remount,rw /


# ============================================
# PART 7: PERFORM THE REPAIR
# ============================================
# Reset the root password
passwd root

# Or repair fstab
# nano /etc/fstab
# mount -a


# ============================================
# PART 8: SELINUX RELABEL (RHEL-FAMILY)
# ============================================
# Create the autorelabel trigger
touch /.autorelabel


# ============================================
# PART 9: EXIT RECOVERY MODE
# ============================================
# For init=/bin/bash: continue the boot without rebooting
exec /sbin/init

# For rescue.target: reboot
reboot


# ============================================
# PART 10: VERIFY
# ============================================
# Wait for the relabel to complete (if triggered)
# Log in with the new password
# Verify that the repair resolved the original problem

The ten parts trace the complete procedure. The critical decision is in Part 4: rescue.target for known passwords and standard repairs, init=/bin/bash for lost passwords and authentication recovery.

Quick Reference

Recovery Mode Parameters

Parameter	Boots To	Password Prompt	Filesystem
`systemd.unit=rescue.target`	Rescue shell	Yes (if root has password)	Mounted, read-only
`init=/bin/bash`	Root shell	No	Read-only until remounted
`rd.break`	Initramfs shell	No	`/sysroot` read-only
`systemd.unit=emergency.target`	Emergency shell	Yes	Root read-only

Required Steps After Boot

Step	Command	Purpose
Remount	`mount -o remount,rw /`	Make filesystem writable
Reset password	`passwd root`	Change root credential
SELinux relabel	`touch /.autorelabel`	Fix file contexts
Exit	`exec /sbin/init` or `reboot`	Continue boot

GRUB Edit Keys

Key	Action
`e`	Edit selected entry
`Ctrl+X` / `F10`	Boot with modified parameters
Arrow keys	Navigate the kernel line

Best Practices

✅ Do This:

# Remount the filesystem read-write before any change
mount -o remount,rw /                                                 # ✅

# Create the SELinux relabel trigger on RHEL-family systems
touch /.autorelabel                                                   # ✅

# Use exec /sbin/init to continue boot without a full reboot
exec /sbin/init                                                       # ✅

# Verify the filesystem is writable before running passwd
mount | grep " / "                                                    # ✅

❌ Don’t Do This:

# Run passwd without remounting read-write
passwd root  # fails on read-only filesystem                           # ❌

# Skip the SELinux relabel on RHEL-family systems
# Login rejects the new password                                       # ❌

# Use SSH to access single-user mode
# Networking is not started                                             # ❌

# Assume rescue.target works when the root password is lost
# It prompts for the missing password                                   # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
`passwd` fails with read-only error	Filesystem not remounted	`mount -o remount,rw /`
Login rejects new password	SELinux context inconsistency	`touch /.autorelabel` and reboot
GRUB menu does not appear	Boot too fast or wrong key	Reboot and try again; use console
`rescue.target` prompts for unknown password	Root password lost	Use `init=/bin/bash` instead
System hangs after recovery	Relabel in progress	Wait; relabel can take minutes

Real-World Examples

1. Boot to rescue.target

Append systemd.unit=rescue.target to the linux line

2. Boot to init=/bin/bash

Replace ro with rw, append init=/bin/bash

3. Remount Read-Write

mount -o remount,rw /

4. Reset Root Password

passwd root

5. SELinux Relabel

touch /.autorelabel

6. Continue Boot

exec /sbin/init

7. Verify Mount Options

mount | grep " / "

8. Access GRUB on UEFI

Tap Esc repeatedly during firmware screen

9. Access GRUB on BIOS

Hold Shift during firmware screen

10. Emergency Target for fstab Repair

Append systemd.unit=emergency.target

Visual

The Two Recovery Routes

┌──────────────────────────────────────────────────────────────┐
│  ROOT PASSWORD KNOWN?                                        │
│                                                              │
│  ┌─────────────────┐                                        │
│  │ YES             │────► systemd.unit=rescue.target        │
│  │                 │      Prompts for password               │
│  │                 │      Filesystems mounted                │
│  └─────────────────┘                                        │
│                                                              │
│  ┌─────────────────┐                                        │
│  │ NO              │────► init=/bin/bash                    │
│  │                 │      No password prompt                 │
│  │                 │      Filesystem read-only               │
│  └─────────────────┘                                        │
│                                                              │
│  The choice is determined by whether the password is known.  │
│  rescue.target is safer; init=/bin/bash is the recovery path │
│  when authentication is impossible.                          │
│                                                              │
└──────────────────────────────────────────────────────────────┘

GRUB Parameter Modification

┌──────────────────────────────────────────────────────────────┐
│  BEFORE:                                                     │
│  linux /vmlinuz... root=/dev/mapper/rhel-root ro quiet       │
│                                                              │
│  AFTER (rescue.target):                                      │
│  linux /vmlinuz... root=/dev/mapper/rhel-root ro quiet       │
│       systemd.unit=rescue.target                             │
│                                                              │
│  AFTER (init=/bin/bash):                                     │
│  linux /vmlinuz... root=/dev/mapper/rhel-root rw quiet       │
│       init=/bin/bash                                         │
│                                                              │
│  The "ro" → "rw" change is what makes the filesystem         │
│  writable in init=/bin/bash mode.                            │
│                                                              │
└──────────────────────────────────────────────────────────────┘

SELinux Relabel Flow

┌──────────────────────────────────────────────────────────────┐
│  init=/bin/bash SHELL                                        │
│                                                              │
│  ┌─────────────────┐                                        │
│  │ passwd root     │  Changes /etc/shadow                   │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ touch           │  Triggers relabel on next boot         │
│  │ /.autorelabel   │                                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ exec /sbin/init │  Boot continues                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ SELinux relabel │  Corrects file contexts                │
│  │ (several min)   │                                        │
│  └────────┬────────┘                                        │
│           ▼                                                  │
│  ┌─────────────────┐                                        │
│  │ Reboot          │  Login with new password               │
│  └─────────────────┘                                        │
│                                                              │
│  Without the relabel, login rejects the new password.        │
│                                                              │
└──────────────────────────────────────────────────────────────┘

Recovery Mode Comparison

┌──────────────────────────────────────────────────────────────┐
│  rescue.target              init=/bin/bash                   │
│                                                              │
│  ┌─────────────────┐        ┌─────────────────┐             │
│  │ systemd runs    │        │ systemd bypassed│             │
│  │ Local FS mounted│        │ FS read-only    │             │
│  │ Network stopped │        │ No services     │             │
│  └─────────────────┘        └─────────────────┘             │
│                                                              │
│  ┌─────────────────┐        ┌─────────────────┐             │
│  │ Password prompt │        │ No prompt       │             │
│  │ (if set)        │        │                 │             │
│  └─────────────────┘        └─────────────────┘             │
│                                                              │
│  Use for:                   Use for:                         │
│  - fstab repair             - Password reset                 │
│  - Service disable          - Authentication recovery        │
│  - Filesystem check         - When root password is unknown  │
│                                                              │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Rescue mode parameter	`systemd.unit=rescue.target`
Password-bypass parameter	`rw init=/bin/bash`
Filesystem default	Read-only in recovery
Required remount	`mount -o remount,rw /`
SELinux trigger	`touch /.autorelabel`
Exit without reboot	`exec /sbin/init`
GRUB edit key	`e`
Boot modified entry	`Ctrl+X` or `F10`
Console required	Yes; SSH unavailable

Key takeaways:

The recovery route depends on whether the root password is known. rescue.target prompts for the password and mounts filesystems normally. init=/bin/bash bypasses authentication entirely, which is the only option when the password is lost .
The filesystem is read-only until explicitly remounted. The kernel mounts root read-only during recovery to prevent damage. mount -o remount,rw / is required before passwd or any file modification .
SELinux relabeling is mandatory on RHEL-family systems. Changing /etc/shadow without creating /.autorelabel produces a login failure that appears to be a wrong password but is actually a context mismatch. The relabel takes several minutes and is not a hang .
exec /sbin/init continues the boot without a reboot. After the repair and relabel trigger, executing the init process replaces the recovery shell with systemd and continues the normal boot sequence. This is faster than a full reboot and preserves the relabel trigger .
Console access is required. Single-user mode does not start networking or SSH. The procedure must be performed through a VNC console, serial console, or physical keyboard and monitor .

Remember: Single-user mode is a controlled bypass of the normal boot and authentication sequence. It exists because some repairs cannot be performed on a running system and some credentials cannot be reset through the login prompt. The two parameters serve different purposes: rescue.target is a systemd-managed recovery state that respects the root password, and init=/bin/bash is a direct kernel-to-shell path that ignores it. The remount is the step that turns the shell from a read-only observer into a writable repair environment. The SELinux relabel is the step that prevents the repair from being rejected by the security layer that was not running when the change was made.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!