What are soundd daemons, and why does nginx need the type under SELinux?

Question

Curious what is soundd daemon. The wiki at http://wiki.centos.org/TipsAndTricks/SelinuxBooleans says it is "soundd daemon" but I'm not finding much additional info on internet.

To get nginx (configured to bind on a unix socket) to start with systemctl I need to add a type enforcement rule on httpd_t to soundd_port_t:tcp_socket. More specifically:

 sudo systemctl status nginx.service

fails with message:

nginx.service - The nginx HTTP and reverse proxy server
  Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled)
  Active: failed (Result: exit-code) since Mon 2015-07-13 19:53:57 EDT; 7s ago
 Process: 2699 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=1/FAILURE)

Jul 13 19:53:57 localhost.localdomain nginx[2699]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Jul 13 19:53:57 localhost.localdomain nginx[2699]: nginx: [emerg] bind() to 0.0.0.0:8000 failed (13: Permissi...ied)
Jul 13 19:53:57 localhost.localdomain nginx[2699]: nginx: configuration file /etc/nginx/nginx.conf test failed
Jul 13 19:53:57 localhost.localdomain systemd[1]: nginx.service: control process exited, code=exited status=1
Jul 13 19:53:57 localhost.localdomain systemd[1]: Failed to start The nginx HTTP and reverse proxy server.
Jul 13 19:53:57 localhost.localdomain systemd[1]: Unit nginx.service entered failed state.

Next I do:

sudo cat /var/log/audit/audit.log | audit2allow

and see:

#============= httpd_t ==============
allow httpd_t soundd_port_t:tcp_socket name_bind;

After importing this module, nginx is able to start.

Answer 1

If you run the following command, you'll see that port 8000/tcp is defined in SELinux as soundd_port_t:

# semanage port -l | grep soundd
soundd_port_t                  tcp      8000, 9433, 16001

This doesn't mean that nginx has anything to do with soundd, just that it's trying to bind to tcp port 8000. I suggest you use the range of ports set aside for nginx/proxy uses, http_cache_port_t:

# semanage port -l | grep http_cache_port_t
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010

If you listen on port 8080 instead of 8000, you won't have to rebuild your SELinux policy.

Answer 2

After hours of searching through this article prove useful for CentOS users

I followed the entire article but what solved the issue I believed were the following commands:

yum install -y policycoreutils-{python,devel}
ausearch -m avc -se httpd_t | audit2allow -M nginx
semodule -i nginx.pp
usermod -a -G user nginx
chmod g+rx /home/user/

Please substitute user with your actual user for granting permissions. Same applies for the directory under chmod command.