Description:

• make following modifications to selinux_state and selinux_not_disabled rules:
  • stop using fixfiles -F relabel
  • enhance the description to inform that fixfiles onboot should be used and the system should be rebooted
  • add Ansible task which basically does the same thing as if fixfiles onboot would be run

Rationale:

• there is no policy which mandates fixfiles relabel to be actually used, fixfiles onboot should be enough

• Moreover, the current implementation is inconsistent - Bash remediation is not the same as Ansible.

• Also the current Bash remediation clears the /tmp directory and that is not expected.

• Fixes https://issues.redhat.com/browse/RHEL-99311

Review Hints:

Run Automatus tests.