If SELinux disabled and current state is enabled, then change state dyna...

...mically

While runtime changing on selinux from disabled to any other state isn't possible, it is possible to move from any state to disabled.

This enables the selinux module to do so.
http://docs.puppetlabs.com/references/latest/type.html#exec

"There are three main ways for an exec to be idempotent:
[snip]
The exec has an onlyif, unless, or creates attribute, which prevents Puppet from running the command unless some condition is met."

By using refreshonly on the selinux_config file resource, you'd actually make the exec 'less' idempotent by triggering the exec on mere white space/comment/layout changes to the configuration file.

Let me know what you think, I'm fine either way.