4

In RHEL, after we
do an rd.break, and all the procedure, and
do a touch /.autorelabel,
what does the /.autorelabel do?

  • 3
    have you done any research to try to answer your question? – jsotola Apr 1 at 3:21
7

The rd.break parameter interrupts the boot process before the control is passed over to the kernel. At this point, when you run the passwd command to do the password reset, the associated shadow file (/etc/shadow) is modified with an incorrect SELinux context. The touch /.autorelabel command creates a hidden file named .autorelabel under the root directory. On the next boot, the SELinux subsystem will detect this file, and then relabel all of the files on that system with the correct SELinux contexts. On large disks, this process can take a good amount of time.

An alternative to the complete relabeling approach is also mentioned in the documentation. First, use the parameters rd.break enforcing=0 when editing the GRUB entry. This will result in the system eventually booting with SELinux set to permissive mode (warn, but do not block). Then, proceed to change the password in the same manner as before. Continue the boot process and allow the system to come up. Once it comes up, run restorecon /etc/shadow to restore the correct SELinux context to the /etc/shadow file. Then, run setenforce 1 to re-enable SELinux and start using the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.