---
- name: Add .autorelabel file (requires a reboot)
  ansible.builtin.file:
    path: /.autorelabel
    mode: "0600"
    state: touch
  listen: __selinux_autorelabel
  when:
    - selinux_state == "enforcing"
    - selinux_current == "disabled"