/etc/sysconfig/selinux:
  file.sed:
    - before: 'enforcing'
    - after: 'disabled'
    - limit: '^SELINUX='

------------------------

# cat /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

--------------------------

'/etc/sysconfig/selinux': {'__env__': 'base',
                           '__sls__': 'servers.basics.selinux',
                           'file': [{'before': 'enforcing'},
                                    {'after': 'disabled'},
                                    {'limit': '^SELINUX='},
                                    'sed']},