#### SUMMARY
When trying to copy a file using the ansible `copy` module to a remote system with SELinux enforcing on a  `vfat` partition, throws the error below: 

```
TASK [SCORED | 1.5.2 | Copy superusers file containing password - modifed for selinux] ********************************************************************
fatal: [centos8.tatu.home]: FAILED! => {"changed": false, "checksum": "c752bf3bf5307fd295d14bdfa4fbfaceebe7ed5a", "cur_context": ["system_u", "object_r", "dosfs_t", "s0"], "gid": 0, "group": "root", "input_was": ["system_u", "object_r", "boot_t", "s0"], "mode": "0700", "msg": "invalid selinux context: [Errno 95] Operation not supported", "new_context": ["system_u", "object_r", "boot_t", "s0"], "owner": "root", "path": "/boot/efi/EFI/redhat/.ansible_tmphes6pya1user.config", "secontext": "system_u:object_r:dosfs_t:s0", "size": 14, "state": "file", "uid": 0}
```

However, when using the `touch` module, it works as expected.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
`copy`

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste 
ansible 2.9.10
  config file = /home/mdemello/.ansible.cfg
  configured module search path = ['/home/mdemello/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/mdemello/.virtualenvs/py38/lib64/python3.8/site-packages/ansible
  executable location = /home/mdemello/.virtualenvs/py38/bin/ansible
  python version = 3.8.3 (default, May 15 2020, 00:00:00) [GCC 10.1.1 20200507 (Red Hat 10.1.1-1)]
```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
DEFAULT_BECOME(/home/mdemello/.ansible.cfg) = True
DEFAULT_BECOME_ASK_PASS(/home/mdemello/.ansible.cfg) = False
DEFAULT_BECOME_USER(/home/mdemello/.ansible.cfg) = root
DEFAULT_FORKS(/home/mdemello/.ansible.cfg) = 6
DEFAULT_HOST_LIST(/home/mdemello/.ansible.cfg) = ['/home/mdemello/ansible/inventory']
DEFAULT_JINJA2_NATIVE(/home/mdemello/.ansible.cfg) = True
DEFAULT_MODULE_NAME(/home/mdemello/.ansible.cfg) = command
DEFAULT_REMOTE_PORT(/home/mdemello/.ansible.cfg) = 22
DEFAULT_REMOTE_USER(/home/mdemello/.ansible.cfg) = root
DEFAULT_ROLES_PATH(/home/mdemello/.ansible.cfg) = ['/home/mdemello/ansible/roles']
DEFAULT_TIMEOUT(/home/mdemello/.ansible.cfg) = 10
DEFAULT_VERBOSITY(/home/mdemello/.ansible.cfg) = 0
```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
```
[root@localhost EFI]# cat /etc/redhat-release 
CentOS Linux release 8.2.2004 (Core) 


[root@localhost EFI]# uname -a
Linux localhost.localdomain 4.18.0-193.6.3.el8_2.x86_64 #1 SMP Wed Jun 10 11:09:32 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

[root@localhost EFI]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31

[root@localhost EFI]# rpm -aq | grep selinux | sort 
container-selinux-2.124.0-1.module_el8.2.0+305+5e198a41.noarch
libselinux-2.9-3.el8.x86_64
libselinux-utils-2.9-3.el8.x86_64
python3-libselinux-2.9-3.el8.x86_64
rpm-plugin-selinux-4.14.2-37.el8.x86_64
selinux-policy-3.14.3-41.el8_2.4.noarch
selinux-policy-targeted-3.14.3-41.el8_2.4.noarch
```

##### STEPS TO REPRODUCE
1) Install a CentOS 8
2) Ensure the /boot/efi partition is using `vfat`
```
/dev/vdb1	 /boot/efi               vfat    umask=0077,shortname=winnt 0 2
```
3) Try the playbook below:
```
---
- hosts: centos8.tatu.home
  become: true
  gather_facts: yes
  vars:
    destfile: "/boot/efi/EFI/redhat/user.config"
    force_touch: True
    force_remove: True

  tasks:
  - name: Remove file
    file:
      path: "{{ destfile }}"
      state: absent
    when: force_remove|bool

  - name: Touching file
    file:
      path: "{{ destfile }}"
      state: touch
    when: force_touch|bool

  - name: "SCORED | 1.5.2 | Copy superusers file containing password - modifed for selinux"
    copy:
        owner: root
        group: root
        mode: 0700
        dest: "{{ destfile }}"
        src: 'user.config'
    register: copyuserconfig
    when:
      - ansible_facts['os_family'] == 'RedHat'
      - ansible_distribution_major_version == "8"
```

** When using the module `touch` the file can be deployed

```
ansible-playbook  -l centos8.tatu.home -e force_touch=true -e force_remove=true 02680135_copy_selinux.yaml  -v
Using /home/mdemello/.ansible.cfg as config file

PLAY [centos8.tatu.home] **********************************************************************************************************************************

TASK [Gathering Facts] ************************************************************************************************************************************
ok: [centos8.tatu.home]

TASK [Remove file] ****************************************************************************************************************************************
changed: [centos8.tatu.home] => {"changed": true, "path": "/boot/efi/EFI/redhat/user.config", "state": "absent"}

TASK [Touching file] **************************************************************************************************************************************
changed: [centos8.tatu.home] => {"changed": true, "dest": "/boot/efi/EFI/redhat/user.config", "gid": 0, "group": "root", "mode": "0700", "owner": "root", "secontext": "system_u:object_r:dosfs_t:s0", "size": 0, "state": "file", "uid": 0}

TASK [SCORED | 1.5.2 | Copy superusers file containing password - modifed for selinux] ********************************************************************
changed: [centos8.tatu.home] => {"changed": true, "checksum": "c752bf3bf5307fd295d14bdfa4fbfaceebe7ed5a", "dest": "/boot/efi/EFI/redhat/user.config", "gid": 0, "group": "root", "md5sum": "ceee01ff81a642f440bae29f1d33c23d", "mode": "0700", "owner": "root", "secontext": "system_u:object_r:dosfs_t:s0", "size": 14, "src": "/root/.ansible/tmp/ansible-tmp-1592882744.8798356-28805-242242527265135/source", "state": "file", "uid": 0}

PLAY RECAP ************************************************************************************************************************************************
centos8.tatu.home          : ok=4    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
```
```
[root@localhost EFI]# ls -laZ /boot/efi/EFI/redhat/
total 12
drwx------. 2 root root system_u:object_r:dosfs_t:s0 4096 Jun 22 23:25 .
drwx------. 3 root root system_u:object_r:dosfs_t:s0 4096 Jun 22 23:10 ..
-rwx------. 1 root root system_u:object_r:dosfs_t:s0   14 Jun 22 23:25 user.config
```

** When using the module `copy` directly, the copy fails

```
ansible-playbook  -l centos8.tatu.home -e force_touch=false -e force_remove=true 02680135_copy_selinux.yaml  -v
Using /home/mdemello/.ansible.cfg as config file

PLAY [centos8.tatu.home] **********************************************************************************************************************************

TASK [Gathering Facts] ************************************************************************************************************************************
ok: [centos8.tatu.home]

TASK [Remove file] ****************************************************************************************************************************************
changed: [centos8.tatu.home] => {"changed": true, "path": "/boot/efi/EFI/redhat/user.config", "state": "absent"}

TASK [Touching file] **************************************************************************************************************************************
skipping: [centos8.tatu.home] => {"changed": false, "skip_reason": "Conditional result was False"}

TASK [SCORED | 1.5.2 | Copy superusers file containing password - modifed for selinux] ********************************************************************
fatal: [centos8.tatu.home]: FAILED! => {"changed": false, "checksum": "c752bf3bf5307fd295d14bdfa4fbfaceebe7ed5a", "cur_context": ["system_u", "object_r", "dosfs_t", "s0"], "gid": 0, "group": "root", "input_was": ["system_u", "object_r", "boot_t", "s0"], "mode": "0700", "msg": "invalid selinux context: [Errno 95] Operation not supported", "new_context": ["system_u", "object_r", "boot_t", "s0"], "owner": "root", "path": "/boot/efi/EFI/redhat/.ansible_tmphes6pya1user.config", "secontext": "system_u:object_r:dosfs_t:s0", "size": 14, "state": "file", "uid": 0}

PLAY RECAP ************************************************************************************************************************************************
centos8.tatu.home          : ok=2    changed=1    unreachable=0    failed=1    skipped=1    rescued=0    ignored=0
```

##### EXPECTED RESULTS
`copy` should work

##### ACTUAL RESULTS
`copy` module fails.

 Trying to understand why the `copy` module fails and `touch` works in this scenario

undecodable in the ``encoding`` specified, then use this error
            handler to deal with them.  The default is ``surrogate_or_strict``
            which means that the bytes will be decoded using the
            surrogateescape error handler if available (available on all
            python3 versions we support) otherwise a UnicodeError traceback
            will be raised.  This does not affect transformations of strings
            given as args.
        :kw expand_user_and_vars: When ``use_unsafe_shell=False`` this argument
            dictates whether ``~`` is expanded in paths and environment variables
            are expanded before running the command. When ``True`` a string such as
            ``$SHELL`` will be expanded regardless of escaping. When ``False`` and
            ``use_unsafe_shell=False`` no path or variable expansion will be done.
        :kw pass_fds: When running on Python 3 this argument
            dictates which file descriptors should be passed
            to an underlying ``Popen`` constructor. On Python 2, this will
            set ``close_fds`` to False.
        :kw before_communicate_callback: This function will be called
            after ``Popen`` object will be created
            but before communicating to the process.
            (``Popen`` object will be passed to callback as a first argument)
        :returns: A 3-tuple of return code (integer), stdout (native string),
            and stderr (native string).  On python2, stdout and stderr are both
            byte strings.  On python3, stdout and stderr are text strings converted
            according to the encoding and errors parameters.  If you want byte
            strings on python3, use encoding=None to turn decoding to text off.
        '''
        
        self._clean = None
        if not isinstance(args, (list, binary_type, text_type)):
            msg = "Argument 'args' to run_command must be list or string"