---
- name: Refresh setup facts
  setup:

- name: Indicate whether selinux is disabled
  cache:
    key: 'selinux_disabled'
    value: "{{ ansible_selinux.status == 'disabled' }}"

- name: Permanently disable SELINUX
  selinux:
    state: disabled
  when:  ansible_selinux.status == 'enabled'
  register: selinux_disabled

- name: Persist SELINUX disableD state
  lineinfile:
    path: /etc/sysconfig/selinux
    line: 'SELINUX=disabled'
    regex: '^SELINUX=.*'

- name: Restart node
  debug:
    msg: 'SELinux MUST be disabled, selinux has been updated, please restart node now...'
  when: selinux_disabled.changed