# auditd
/sbin/auditctl -- system_u:object_r:auditctl_exec_t:s0
/sbin/auditd -- system_u:object_r:auditd_exec_t:s0
/var/log/audit.log -- system_u:object_r:auditd_log_t:s15:c0.c255
/var/log/audit(/.*)? system_u:object_r:auditd_log_t:s15:c0.c255
/etc/auditd.conf -- system_u:object_r:auditd_etc_t:s0
/etc/audit.rules -- system_u:object_r:auditd_etc_t:s0