1

Curious what is soundd daemon. The wiki at http://wiki.centos.org/TipsAndTricks/SelinuxBooleans says it is "soundd daemon" but I'm not finding much additional info on internet.

To get nginx (configured to bind on a unix socket) to start with systemctl I need to add a type enforcement rule on httpd_t to soundd_port_t:tcp_socket. More specifically:

 sudo systemctl status nginx.service

fails with message:

nginx.service - The nginx HTTP and reverse proxy server
  Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled)
  Active: failed (Result: exit-code) since Mon 2015-07-13 19:53:57 EDT; 7s ago
 Process: 2699 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=1/FAILURE)

Jul 13 19:53:57 localhost.localdomain nginx[2699]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Jul 13 19:53:57 localhost.localdomain nginx[2699]: nginx: [emerg] bind() to 0.0.0.0:8000 failed (13: Permissi...ied)
Jul 13 19:53:57 localhost.localdomain nginx[2699]: nginx: configuration file /etc/nginx/nginx.conf test failed
Jul 13 19:53:57 localhost.localdomain systemd[1]: nginx.service: control process exited, code=exited status=1
Jul 13 19:53:57 localhost.localdomain systemd[1]: Failed to start The nginx HTTP and reverse proxy server.
Jul 13 19:53:57 localhost.localdomain systemd[1]: Unit nginx.service entered failed state.

Next I do:

sudo cat /var/log/audit/audit.log | audit2allow

and see:

#============= httpd_t ==============
allow httpd_t soundd_port_t:tcp_socket name_bind;

After importing this module, nginx is able to start.

3
  • 1
    nginx is listening on a not-allowed port. Fix that first. – Michael Hampton Jul 14 '15 at 0:18
  • @MichaelHampton Thanks. How can you tell? When I disable selinux enforcement nginx starts and I can connect on :8000. I can also start gunicorn listening on 0.0.0.0:8000 and no complaints. – Snorex Jul 14 '15 at 0:27
  • 1
    nginx: [emerg] bind() to 0.0.0.0:8000 failed (13: Permissi...ied) tells that binding to port 8000 is not allowed. – Tero Kilkanen Jul 14 '15 at 0:58
4

If you run the following command, you'll see that port 8000/tcp is defined in SELinux as soundd_port_t:

# semanage port -l | grep soundd
soundd_port_t                  tcp      8000, 9433, 16001

This doesn't mean that nginx has anything to do with soundd, just that it's trying to bind to tcp port 8000. I suggest you use the range of ports set aside for nginx/proxy uses, http_cache_port_t:

# semanage port -l | grep http_cache_port_t
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010

If you listen on port 8080 instead of 8000, you won't have to rebuild your SELinux policy.

1
  • 1
    You can also listen on ports defined as http_port_t. – Michael Hampton Jul 14 '15 at 14:32
1

After hours of searching through this article prove useful for CentOS users

I followed the entire article but what solved the issue I believed were the following commands:

yum install -y policycoreutils-{python,devel}
ausearch -m avc -se httpd_t | audit2allow -M nginx
semodule -i nginx.pp
usermod -a -G user nginx
chmod g+rx /home/user/

Please substitute user with your actual user for granting permissions. Same applies for the directory under chmod command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.