# auditd
/sbin/auditd -- system_u:object_r:auditd_exec_t
/var/log/audit.log -- system_u:object_r:auditd_log_t