documentation_complete: true

title: 'Record Execution Attempts to Run SELinux Privileged Commands'

description: |-
    At a minimum, the audit system should collect the execution of
    SELinux privileged commands for all users and root.
