---
- name: Refresh setup facts
  setup:

- name: Indicate whether selinux is disabled
  cache:
    key: 'selinux_disabled'
    value: "{{ ansible_selinux.status == 'disabled' }}"

- block:
  - name: Permanently disable SELINUX
    selinux:
      state: disabled
    when:  ansible_selinux.status == 'enabled'
    register: selinux_disabled

  - name: Persist SELINUX disableD state
    lineinfile:
      path: /etc/sysconfig/selinux
      line: 'SELINUX=disabled'
      regexp: '^SELINUX=.*'
  become: yes

- name: Restart node
  debug:
    msg: 'SELinux MUST be disabled, selinux has been updated, please restart node now...'
  when: selinux_disabled.changed