Ansible team found in their tests that restorecon always return 0. This could be problem for checking if restorecon relabeled objects on system.   Ansible want to do support for "changed" status in ansible for following play: https://github.com/linux-system-roles/selinux/blob/5f861341d84a7d3b752f7bf5ae3de7d1076acc69/tasks/main.yml#L100