# auditd
/sbin/auditctl		--	system_u:object_r:auditctl_exec_t
/sbin/auditd		--	system_u:object_r:auditd_exec_t
/var/log/audit.log 	-- 	system_u:object_r:auditd_log_t
/var/log/audit(/.*)?  	 	system_u:object_r:auditd_log_t
/etc/auditd.conf	--	system_u:object_r:auditd_etc_t
/etc/audit.rules	--	system_u:object_r:auditd_etc_t