In RHEL, after we do an rd.break, and all the procedure, and do a touch /.autorelabel, what does the /.autorelabel do?

  • 4
    have you done any research to try to answer your question?
    – jsotola
    Apr 1, 2019 at 3:21

1 Answer 1


The rd.break parameter interrupts the boot process before the control is passed over to the kernel. At this point, when you run the passwd command to do the password reset, the associated shadow file (/etc/shadow) is modified with an incorrect SELinux context. The touch /.autorelabel command creates a hidden file named .autorelabel under the root directory. On the next boot, the SELinux subsystem will detect this file, and then relabel all of the files on that system with the correct SELinux contexts. On large disks, this process can take a good amount of time.

An alternative to the complete relabeling approach is also mentioned in the documentation. First, use the parameters rd.break enforcing=0 when editing the GRUB entry. This will result in the system eventually booting with SELinux set to permissive mode (warn, but do not block). Then, proceed to change the password in the same manner as before. Continue the boot process and allow the system to come up. Once it comes up, run restorecon /etc/shadow to restore the correct SELinux context to the /etc/shadow file. Then, run setenforce 1 to re-enable SELinux and start using the system.

  • 1
    rd.break is a Dracut kernel command line option - drop to shell at the end. rd refers to "ramdisk"
    – fpmurphy
    Jan 22, 2021 at 17:27
  • The documentation link is 404 now :/
    – Noah May
    Jul 28, 2021 at 4:26
  • @NoahMay Thanks for the heads-up. I have updated the URL.
    – Haxiel
    Jul 28, 2021 at 15:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .