SELinux fact not being correctly detected

I'm working with a user who had to write their own fact to parse the output of sestatus. I was surprised and did a little digging. They have found that on their systems, Facter says that SE Linux is enabled but permissive. However, it is disabled. (I assume that some kernel module is loaded that causes the appropriate /sys data to be populated, but SE Linux is not enabled)

Here's the code for our SE Linux fact:

https://github.com/puppetlabs/facter/blob/4a495e877d68648b6315b1a68755627de4c3c52d/lib/src/facts/linux/operating_system_resolver.cc#L61

Basically, the assumptions are not true for this user:

[root@rhel7 ~]# facter -p selinux
true
[root@rhel7 ~]# grep selinuxfs /proc/self/mounts
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0

[root@rhel7 facter]# cat /sys/fs/selinux/enforce
0

[root@rhel7 ~]# getenforce
Disabled
[root@rhel7 ~]# sestatus
SELinux status: disabled

So basically, the code seems to indicate that if /sys/fs/selinux exists, the SE linux is enabled and if /sys/fs/selinux/enforce is zero, that it's in permissive mode.

However, as can be plainly seen, getenforce and sestatus both show that SE Linux is disabled, but both would say permissive if that were the case

I suggest that if our SE Linux fact disagrees with getenforce and sestatus, we should probably change our fact.