---
- name: check if selinux is enabled
  command: getenforce
  register: sestatus
  changed_when: false
  tags:
    - always