In the launch script /etc/init.d/S02auditd (buildroot/package/audit/S02auditd), line 23: mkdir -p /var/log/audit -Z `selabel_lookup -b file -k /var/log/audit | cut -d ' ' -f 3` does not work when coreutils mkdir replaces the one supplied by busybox. The -Z context needs to be placed before the directory name with coreutils and BusyBox will accept it both ways. With coreutils, a folder is created with the name of the context in the current directory, auditd appears to start, appears in ps, but does no SELinux logging. Doing a restart will show an OK on stopping and a FAIL on starting. Starting again shows an OK but no logging occurs.
Thank you for your report. The issue tracker for the Buildroot project has been moved to the Gitlab.com issue tracker: https://gitlab.com/buildroot.org/buildroot/-/issues We are taking this opportunity to close old issues in this old tracker. If you believe your issue is still relevant, please open one in the new issue tracker. Thank you!