selinux-refpolicy/refpolicy/policy/modules/services/arpwatch.fc

#
# /usr
#
/usr/sbin/arpwatch	--	gen_context(system_u:object_r:arpwatch_exec_t,s0)

#
# /var
#
/var/arpwatch(/.*)?		gen_context(system_u:object_r:arpwatch_data_t,s0)
/var/lib/arpwatch(/.*)?		gen_context(system_u:object_r:arpwatch_data_t,s0)