# certwatch.fc
/usr/bin/certwatch	-- system_u:object_r:certwatch_exec_t