# auditd
/sbin/auditctl		--	system_u:object_r:auditctl_exec_t:s0
/sbin/auditd		--	system_u:object_r:auditd_exec_t:s0
/var/log/audit.log 	-- 	system_u:object_r:auditd_log_t:s15:c0.c255
/var/log/audit(/.*)?  	 	system_u:object_r:auditd_log_t:s15:c0.c255
/etc/auditd.conf	--	system_u:object_r:auditd_etc_t:s0
/etc/audit.rules	--	system_u:object_r:auditd_etc_t:s0