Found out that seboolean requires the libselinux-python package. We'll need to decide if we're okay with installing this everywhere that we'd use the seboolean ansible module.

Note that I recently added to tasks/cloud_setup_basic.yml

{{{
- name: enable ssh_sysadm_login sebool
action: seboolean name=ssh_sysadm_login state=yes persistent=yes
}}}

which you need if you want to ssh there as root

Update: needs both libselinux-python and libsemanage-python

Which has been added to roles/base/tasks/main.yml

Please note that ssh_sysadm_login only takes effect on MLS (non-targeted) hosts: in targeted, every user is unconfined_u.

so, I am pretty sure ansible has the selinux support we need.

There is boolean support and the file module can set arbitrary contexts and we can ship our own policy if needed.