selinux::fcontext puppet module that does not take ages to verify.

gistfile1.pp

define selinux::fcontext($ensure, $type, $path, $grep) {
  # Add or remove a permanent SELinux local file context to the system
  # Normally this is done in a specific SELinux module but the define can
  # be used for one-offs.

  case $ensure {
    'present': {
      exec { "semanage-fcontext-$title":
        command => "/usr/sbin/semanage fcontext -a -t $type '$path'",
        unless  => "/bin/grep -q '^$grep' /etc/selinux/targeted/contexts/files/file_contexts.local",

        #XXX: The command below is the canonical way to check for active persistant
        #     file contexts, but this takes ~5 seconds per run instead of the
        #     simple grep above because semanage fcontext -l takes a long time.
        #unless  => "/usr/sbin/semanage fcontext -l | /bin/grep -q '^$grep'",
      }
    }
    'absent': {
      exec { "semanage-fcontext-$title":
        command => "/usr/sbin/semanage fcontext -d -t $type '$path'",
        unless  => "/bin/grep -q '^$grep' /etc/selinux/targeted/contexts/files/file_contexts.local",

        #XXX: The command below is the canonical way to check for active persistant
        #     file contexts, but this takes ~5 seconds per run instead of the
        #     simple grep above because semanage fcontext -l takes a long time.
        #unless  => "/usr/sbin/semanage fcontext -l | /bin/grep -q '^$grep'",
      }
    }
    default: {
      error("unknown ensure value $ensure")
    }
  }
}