---
- block:
    - name: Set selinux policy
      selinux:
        policy: "{{ selinux_policy }}"
        state: "{{ selinux_state }}"
      register: __sestatus

    - name: Add .autorelabel file (requires a reboot)
      file:
        path: /.autorelabel
        state: touch
      when:
        - selinux_state == "enforcing"
        - __sestatus.changed
  become: True
  become_user: root